Use a 30 minute session with five blocks: what an SBOM is, the first reply, the escalation list, phrases to avoid, and a practice request. Keep slides to a minimum and work from real emails. End with one page everyone can keep.
Why short and practical
Sales teams do not need to read a specification. They need to answer confidently, avoid overclaiming and know when to hand off. A short session built on real requests achieves this, and a short document afterward keeps it fresh.
The agenda
| Minutes | Block | What you cover |
|---|---|---|
| 0 to 5 | What an SBOM is | The ingredients list idea, the two formats, what it does not say |
| 5 to 10 | The first reply | Four questions and the template |
| 10 to 15 | Escalation | Which requests go to engineering and legal |
| 15 to 20 | Phrases to avoid | The six overstatements and their replacements |
| 20 to 30 | Practice | A real request, a reply, and feedback |
Block one: what it is
Use CISA's own wording. The 2026 minimum elements call an SBOM a nested inventory, a list of ingredients that make up software. State two limits: it is data about components, and it does not carry vulnerability status. Name the two widely used formats, SPDX and CycloneDX.
Block two: the first reply
Walk through the four questions: product and version, format, purpose and recipient. Show the template from what sales should say first. Stress that each version has its own SBOM, a point from the CISA text.
Block three: escalation
Show the triage table from which requests to escalate. Name the people who receive escalations. Names matter more than a process diagram.
Block four: phrases to avoid
Put the six phrases on one slide, with the replacement beside each. See which phrases sales should never use. Ask the group to add one they have heard from a competitor or a customer, without naming anyone.
Block five: practice
Give pairs a fake request: "Please send your SBOM for compliance." One person is the customer, the other the rep. The rep writes a first reply in five minutes. Swap and critique. Use three criteria:
- Does it ask for the version and format?
- Does it avoid overclaiming?
- Does it say when the customer will hear back?
What to hand out
One page with the four questions, the triage table, the six phrases and the names of the engineering contacts. Add the date so people know when to ask for a refresh.
How to know it worked
Do not measure test scores. Look at the next five real requests. Were the first replies complete? Were the escalations well formed? Did anyone promise something that engineering could not deliver? Adjust the training based on what you see.
Try it yourself
Show the demo during block one. Click through the inventory so the group sees what a component list looks like.
Click through it at your own pace, or open it full screen.
Quick check
Should customer success attend as well?
Yes. They hear the same requests at renewal and during support.
How often should we repeat the session?
Repeat when guidance changes or at least once a year. CISA published new minimum elements on 29 July 2026, replacing the 2021 NTIA version, so older training material may be out of date.
Safeguard's SBOM and dependency scanning gives engineering a current inventory to answer from, and the free scan is a good live example for the session.
Sources
Last reviewed: 19 October 2026.
