Measure SBOM coverage with five numbers: the share of in-scope suppliers who sent an SBOM, the share that are current, the share that pass validation, the share of components with usable identifiers, and the share mapped to a running system. Counting files alone overstates your position.
Start with the denominator
Coverage needs a list to be measured against. Decide which suppliers and products are in scope, for example those that ship code you run or that touch sensitive data. Rank them by criticality. A program that reaches ninety percent of low-risk suppliers and none of the critical ones is not working.
The five metrics
| Metric | Formula | What it reveals |
|---|---|---|
| Receipt | Suppliers with an SBOM divided by in-scope suppliers | Basic reach |
| Freshness | SBOMs matching the deployed release divided by SBOMs received | Whether files describe reality |
| Validity | SBOMs that parse and pass checks divided by received | File quality |
| Identifier quality | Components with a valid purl or equivalent divided by all components | Whether matching can work |
| Mapping | SBOMs linked to a running system divided by received | Whether you can act |
Why identifier quality is the quiet one
Matching depends on identifiers. CycloneDX says a purl, when present, must be valid under the purl specification, and a component can assert identity by purl or CPE. A file with thousands of components and no identifiers looks complete and finds nothing.
Read the numbers by tier
Report each metric separately for critical, important and standard suppliers. Aggregate figures hide where the weakness sits. If critical suppliers lag, that is the story.
Turn numbers into actions
- List suppliers with no SBOM, sorted by criticality, and assign an owner for each ask.
- For stale files, request a refresh tied to the deployed release.
- For invalid files, send the specific error back.
- For low identifier quality, ask for a generator setting or tool change.
- For unmapped files, ask the product owner to confirm the link.
- Recheck monthly and chart the trend.
Set targets with care
Pick targets you can defend and revisit. A target of one hundred percent in one quarter encourages gaming. Better to set a floor for critical suppliers and a direction for the rest.
Report to leadership in plain terms
Show the five metrics, the trend and the two or three suppliers causing most risk. Avoid listing every file. Tie the numbers to a decision, such as which supplier contracts need an SBOM clause.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls connect to evidence, and consider which of your five metrics would serve as that evidence.
Where Safeguard fits
Safeguard provides compliance and evidence automation plus SBOM and dependency scanning, which can feed these metrics. Try the free scan to see the data it produces.
Quick check
Is the number of SBOMs received a good measure?
It is a start, but pair it with freshness, validity and identifier quality.
Should every supplier be in scope?
No. Scope by criticality and by whether their code runs in your environment.
Sources
- CycloneDX 1.6 JSON reference: purl and cpe component identity.
Last reviewed: 19 October 2026.
