List the third party component with its real producer, ask that producer for its SBOM, and either include the data or link to it. If you cannot get it, say so explicitly rather than leaving a gap. The customer is buying your product, so the answer is still yours to give.
Why resold components complicate the answer
Many products bundle software written by others: an embedded database, a licensed library, an agent, or an entire module. Your customer asks you for one SBOM. You may not hold the full details for the bundled part.
CISA's 2026 minimum elements are clear on one point. The SBOM author and the component producer are different roles. The author is the entity that creates the SBOM data. The producer is the entity that created the component. They may be the same, or they may differ. The document also says only one organization should be named as producer for a given component, which helps tell apart components of the same name from different producers.
Your options
| Option | What you do | Note |
|---|---|---|
| Embed | Add the producer's component list into your SBOM | You need the producer's data |
| Link | Reference the producer's separate SBOM | The CISA text allows linking if the recipient has access to the linked SBOMs |
| Describe only | List the bundled item as one component with name, producer and version | Mark the missing subcomponents as unknown |
The CISA text says an SBOM may identify subcomponents by listing them in one large document or by linking to separate SBOMs for each, and either can meet the coverage expectation, as long as the recipient can access all linked SBOMs. If you link, check that your customer can actually open the link.
Steps
- List the bundled parts. From your build files and license records, not from memory.
- Name the producer for each. Use the organization's full name. If there is no clear producer, the CISA text says to indicate unknown provenance.
- Request their SBOM. Use the same ask you would want from a supplier. See how to write an SBOM request to a supplier.
- Check what comes back. Open it. Confirm the version matches what you ship.
- Choose embed or link. Check redistribution terms in your agreement first. If you are unsure, ask legal.
- State the gaps. The CISA text says the author should explicitly state whether missing information is unknown to them or withheld.
What to tell the customer
Be plain about who knows what.
Our product includes a component made by another company. We have included its name, producer and version. Their SBOM is linked here. For two sub components we do not have their data yet, so they are marked unknown. We have asked the producer and will send a revised file when we receive it.
This is better than a silent gap. The CISA text says an SBOM author should explain unknowns, and that an organization may consider an SBOM incomplete if essential data is withheld.
When the producer will not share
Do not guess their dependency list. List what you know, mark the rest unknown and tell the customer. If the customer needs more, they can ask the producer or reconsider the purchase. You are not responsible for inventing data you do not hold.
Try it yourself
Open the demo and look at how components are grouped and where each one comes from. Think about which entries in your own product would come from another producer.
Click through it at your own pace, or open it full screen.
Quick check
Are we the component producer for a resold item?
No. Name the organization that created it. You are the SBOM author for your product's SBOM.
Can we skip subcomponents we do not control?
Skipping them silently is a problem. List what you know and mark the rest unknown or withheld.
Safeguard's SBOM and dependency scanning can help you see what is bundled in your own build, and the free scan is a way to preview it.
Sources
Last reviewed: 19 October 2026.
