For shipped software, the inventory must describe each release customers hold, which may be many versions at once. For hosted software, it must describe what runs now, plus any internal tools. Same format, different scope, different questions. This is a technical framing, not legal advice.
Why the model changes the questions
Shipped means customers install it: desktop apps, mobile apps, agents, appliances, libraries. Old versions stay in the field. Hosted means the company runs it and customers use it over a network. Only the current version matters operationally.
The NTIA minimum elements report notes that an SBOM can accompany each instance of the software or be available and mappable to a specific version, for example through a version specific location. That is easy to apply to shipped software and a little different for hosted services.
Comparison
| Topic | Shipped | Hosted |
|---|---|---|
| What to inventory | Every supported release | Current production plus staging |
| How many files | One per release | One per deployable, refreshed on deploy |
| Old versions | Still in customers' hands | Gone after rollout |
| Patch delivery | Customers must update | Seller deploys |
| License questions for counsel | Redistribution terms matter more | Different terms may apply to network use |
| Vulnerability disclosure | Customer notice, advisories | Fix and rollout, status notes |
Questions for shipped software
- Which versions are supported and which are not?
- Is there an inventory for each, stored with the release?
- How do customers learn about a vulnerable version?
- Which components are bundled inside installers?
Questions for hosted software
- What runs in production today and when was it last deployed?
- Which internal tools touch customer data and what do they depend on?
- How quickly can a library fix reach production?
- Are third party services recorded as suppliers, even though they are not packages?
Products that are both
Many companies have a hosted service plus a mobile app and a command line tool. Treat each surface separately, with its own inventory and rules. A clean hosted inventory says nothing about the app.
What to hand counsel
Give your lawyers the license list, the distribution model per product and the unknown license items. They decide what it means. Do not draw legal conclusions from the inventory alone.
Safeguard offers SBOM and dependency scanning, asset discovery and compliance and evidence automation, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Does a hosted product need an inventory for license reasons?
Often it is still needed for security and customer questionnaires. Whether license terms apply differently is a question for counsel.
Sources
Last reviewed: 19 October 2026.
