Freeze a dated snapshot of your SBOMs and license inventory when you share them in diligence or sign. Your dependencies change daily, so a record of what you disclosed and when protects both sides from arguments about timing. Store it read only with a hash. Not legal advice.
Why a snapshot helps
Software changes continuously. A dependency update on Tuesday can change a license by Wednesday, a point covered in can a dependency update change the license. If someone later asks what you told them, you need the exact list you shared. The NTIA minimum elements include a timestamp, described as a record of the date and time of the SBOM data assembly, and an author of the SBOM data. Those two fields exist for exactly this kind of question.
What to include in the snapshot
| Item | Why |
|---|---|
| SBOM files per artifact | The component and license record |
| License findings and decisions | Shows the judgment behind each item |
| Policy version | Shows which rules applied |
| Exception log | Shows approvals in force on that date |
| Notices file | Shows what you shipped to recipients |
| Index with dates and owners | Ties it together |
How to take it
- Pick the moment: the date you share the folder, and again at signing.
- Regenerate SBOMs from the exact release commits.
- Export decisions and the exception log as files, not screenshots.
- Bundle everything in one archive with a clear name that includes the date.
- Compute a checksum and store it with the archive. Anyone can later verify the file has not changed.
- Keep the archive read only, with access limited to a few named people.
- Note which release versions the snapshot covers.
Handling changes after the snapshot
Do not edit the snapshot when things change. Create a new one and keep both. If you find an error in the earlier one, add a dated correction note instead of silently replacing it. The post on evidence that goes stale in diligence shows which items age fastest.
Do not backdate
A snapshot is only useful if its date is true. Regenerate rather than relabel an old file. If a stale file must be shared, label it with its true date.
Try it yourself
Open the continuous monitoring demo to see how findings change over time, which is the reason a dated snapshot matters.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM generation and continuous monitoring can produce fresh component lists on a schedule, and compliance and evidence automation helps keep the records. What you disclose is your decision.
Quick check
Is a checksum necessary?
It is a simple extra that lets anyone confirm the file is unchanged. It costs little and avoids disputes.
How often should we refresh between snapshots?
Before each major conversation or release. A scheduled regeneration keeps the working copy current.
Sources
Last reviewed: 19 October 2026.
