Open the file and check seven data fields on a sample of components: supplier, component name, version, other unique identifiers, dependency relationship, author of the SBOM data, and timestamp. Then check depth and whether the supplier states what it could not list. Ten minutes of sampling tells you whether the SBOM is usable.
The seven fields
These come from the NTIA minimum elements report. For each one, here is what to look for.
- Supplier name: Who makes or distributes the component. Blank or "unknown" on many rows is a warning sign.
- Component name: The name the supplier uses. Aliases are allowed.
- Version: A real version string. Entries with no version cannot be matched to vulnerabilities.
- Other unique identifiers: Identifiers that map the component across databases. The report names CPE and SWID tags as examples.
- Dependency relationship: Which component includes which. Without it you cannot tell direct from indirect.
- Author of SBOM data: The party that made the SBOM, not the software.
- Timestamp: When the data was assembled.
Sample, do not read it all
Pick thirty components at random. Score each field present or missing. If more than a few rows miss a version or identifier, ask the supplier for a corrected file. Record what you found, so the request is specific.
Check the depth
The report says an SBOM should list all primary components with their transitive dependencies. Ask whether the file does. A flat list of top level packages is a different thing from a full tree. Compare a few entries to the product's public documentation if you can.
Look for known unknowns
When the full dependency graph is not listed, the report says the author must say so explicitly. Look for that statement. Silence is not the same as completeness. If a supplier says nothing, ask the direct question: is anything missing from this file, and what?
Check the date and the product version
The report says a new build or release should come with a new SBOM. Make sure the SBOM matches the version you actually run. An SBOM for last year's release tells you little about this year's risk.
A note on newer guidance
CISA published a draft update to the minimum elements on 22 August 2025 and ran a public comment period. The page describes it as a draft building on the 2021 NTIA work. Check the CISA page for the current status before you write requirements into a contract.
What to do with the result
Write down gaps, send them to the supplier, and set a date. Keep the SBOM with your vendor record. If you collect many of these, an inventory tool helps you search them when a new vulnerability appears.
Safeguard can ingest and analyze SBOMs as part of its SBOM and dependency scanning, and the free scan at https://gold.safeguard.sh/scan shows the output on a sample repository.
Quick check
Is a supplier SBOM missing a license field a failure?
Not against the seven NTIA data fields, which do not include licenses. It may still matter to your legal team, so ask for it if you need it.
Sources
- NTIA, The Minimum Elements For a Software Bill of Materials
- CISA, 2025 Minimum Elements for a Software Bill of Materials (draft)
Last reviewed: 19 October 2026.
