A supplier SBOM is stale when it no longer describes what you run. Check the creation timestamp, the product version it names, the document revision, the tool that produced it, and a spot comparison with your deployed system. Two failed checks mean you should ask for a fresh file.
What stale means
Freshness is not just age. A file from yesterday is stale if it describes version 4.1 and you run 4.3. A file from last year is current if the product has not changed. So the test is a match between document and deployment, not a date alone.
The five checks
- Timestamp. SPDX requires a created field in UTC, in the form year, month, day, T, time, Z. Compare it with the product release date you hold.
- Product version. Read the root component. Does its version equal the release deployed in your environment?
- Revision. In CycloneDX, the version integer rises when the BOM is modified. If you hold revision 1 and the supplier is on 3, you are behind.
- Producer. Look at the tool and its version in the metadata. An old generator may miss newer ecosystems.
- Spot check. Pick five components you can verify on your side, such as a library in a container image, and confirm they match the file.
Score it
| Checks failed | Reading | Action |
|---|---|---|
| 0 | Current | Use normally |
| 1 | Possibly stale | Verify, note in record |
| 2 or more | Stale | Request refresh, flag findings as low confidence |
What to ask for
Ask for an SBOM tied to the specific release you run, and for the date of the last change to dependencies. If the supplier regenerates on every build, the answer is easy. If they do it once a year, agree on a cadence and a trigger, such as any security release.
Put freshness in the contract
Write expected frequency into your agreement and measure it. Your supplier management team can track days since last SBOM per product and escalate when it passes the agreed limit. Keep the limit realistic, because a number nobody meets is ignored.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how monitoring keeps checking after a first scan, and compare that with a file that was checked once.
Where Safeguard fits
Safeguard runs continuous monitoring on scanned inventories, so new advisories are matched against components you already hold. A free scan shows the idea on your own project.
Quick check
Is an old SBOM always stale?
No. If the product has not changed, the file may still be accurate. Compare versions, not only dates.
Does a recent timestamp prove the SBOM is accurate?
No. It shows when the file was made. Spot check components to confirm accuracy.
Sources
- SPDX 2.3.1, document creation information: created field format.
- CycloneDX 1.6 JSON reference: version increases when a BOM is modified.
Last reviewed: 19 October 2026.
