No source sets a fixed response time for SBOM requests. CISA's 2026 text says SBOMs should be available promptly to those who need them. So set your own tiers, publish them to sales and support, and measure first reply, delivery and correction. Choose numbers you can meet every time.
What the guidance does and does not say
The CISA 2026 minimum elements say, under distribution and delivery, that SBOMs should be available promptly to those who need them, and that access controls should not prevent sharing between authorized parties or stop organizations from loading the data into trusted security tools. It gives ways to share: with installation, through a version specific URL, an API or a public repository.
It does not give a number of days. That is deliberate, because needs vary. A promise of "one business day" that you miss twice is worse than "three business days" that you always meet.
Three clocks to track
| Clock | Starts | Stops | Why it matters |
|---|---|---|---|
| First reply | Request arrives | A human confirms the ask | Customers judge responsiveness here |
| Delivery | Request confirmed | File delivered | The actual commitment |
| Correction | Error reported | Revised file delivered | The CISA text says errors should be corrected promptly |
Track all three. Teams often measure only delivery, and miss that the first reply sat for a week.
How to pick your tiers
- Look at your own history. Pull the last ten requests from the ticket log. How long did each take?
- Separate routine from unusual. A stored file for a released version is a lookup. A new format or a regenerated old version is a project.
- Set a standard tier for routine requests. Pick a number of working days that allows for holidays and a sick engineer.
- Set an escalated tier for unusual ones. Promise a date for the plan, not for delivery.
- Write them down. Put the tiers in the sales playbook so every rep quotes the same thing.
- Review quarterly. If you miss, change the process or the promise, not the customer's expectations.
What makes delivery faster
- A stored SBOM for every release, next to the artifact. See archive SBOMs for every release.
- A delivery channel you can audit, such as an authenticated portal or expiring link.
- A named owner for requests. See who owns SBOM and VEX requests.
- A cover note template, so writing it is a fill in task.
What to avoid
Do not promise same day delivery as a sales tactic. If the file needs a review for leaked internal paths, same day is not safe. Do not hide a slow step. Say "we review each file before sending" and give the timing.
Quick check
Is there a regulatory deadline for answering an SBOM request?
None appears in the CISA or NTIA texts. A contract or a specific rule that applies to you might set one, so read that text directly.
Should we measure response time by customer?
Measure by request type first. Then look at the slowest cases and ask what was different.
Safeguard's SBOM and dependency scanning can keep a current inventory ready, which shortens the lookup, and the free scan shows what that looks like.
Sources
Last reviewed: 19 October 2026.
