In the first 30 minutes with a new supplier SBOM: record receipt and a hash, check who sent it and which product it covers, validate the file, match components to advisories, list gaps, and send an acknowledgment with questions. Deep analysis can wait. A clean record and a quick reply cannot.
Minutes 0 to 5: record
- Save the original file unchanged to your store.
- Compute and record a content hash.
- Log supplier, sender, channel, received date and the product or contract it relates to.
- Note any terms attached, such as an NDA, so access rules apply from the start.
Minutes 5 to 10: identity
- Read the document identity. CycloneDX carries a serial number and a version that rises with each change. SPDX carries a namespace unique to the document version and a created time in UTC.
- Check whether you already hold an earlier revision. If so, mark the old one superseded.
- Read the root component and compare its version with the release you run.
Minutes 10 to 15: validate
- Run schema validation.
- Count components, count those with a valid identifier, and count those with no version.
- Assign an intake state: accept, accept with warnings, quarantine or reject.
Minutes 15 to 25: match
- Match components to advisory sources.
- Flag any entry in CISA's Known Exploited Vulnerabilities catalog, which lists vulnerabilities with reliable evidence of active exploitation.
- Apply any supplier VEX statements, noting that OpenVEX not affected statements need a justification or impact statement.
- Produce a short list: top findings, unresolved components, quality warnings.
Minutes 25 to 30: reply
- Send the supplier a brief note. Confirm receipt, state the intake outcome, list up to five questions, and say when you will follow up.
- Create tasks for internal owners with the short list.
- Set the next check date based on the product's criticality.
What to leave for later
Full triage of every finding, reachability review, license analysis and the diff with prior revisions can follow within days. The first half hour is about not losing anything and not leaving the supplier guessing.
A tip on tone
Suppliers who share an SBOM are doing you a favor. Reply promptly, be specific, and thank them. They will share more next time.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow a finding from detection to a recorded decision, and compare it to the match and reply steps above.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning with reachability analysis. Use the free scan to run steps 8 to 14 on a real file.
Quick check
Should I analyze every finding in the first half hour?
No. Record, validate, rank the top items and reply. Deep triage follows.
Why hash the file on arrival?
It proves later what you received and lets you detect changes or duplicates.
Sources
- CycloneDX 1.6 JSON reference: serial number and version.
- SPDX 2.3.1, document creation information: namespace and created field.
- CISA KEV catalog: catalog meaning.
- OpenVEX specification: not affected justification.
Last reviewed: 19 October 2026.
