Look at the details in the request. A named version, a named format, a scanner and a deadline suggest a team that will use the file. A one line ask on a form suggests a checkbox. Answer both well, but spend your effort where the customer will act on the data.
Why the distinction helps
A checkbox request needs a clean file and a clear cover note. A working request may lead to scans, follow up questions, VEX requests and recurring delivery. If you treat the second like the first, the follow up will arrive and surprise you. If you treat the first like the second, you waste engineering time.
Neither is bad. Both deserve a polite, accurate answer. The goal is to size the response.
Signals that suggest a working need
| Signal | What it suggests |
|---|---|
| Names a specific format and version | Their tool reads it |
| Names a scanner or platform | They will load the file |
| Asks about hashes, signatures or generation context | They know the CISA elements or a similar list |
| Asks about update frequency | They want a feed, not a file |
| Cites a regulation or contract clause | A formal obligation may sit behind it |
| Comes from a security or risk role | Likely to be read |
Signals that suggest a checkbox
- It appears as one line in a long questionnaire.
- It asks "do you provide an SBOM, yes or no."
- It comes from procurement with no security contact.
- It has no format, version or deadline.
What to do with each
For a likely checkbox, answer yes with a short statement of what you provide: per version, in a common format, on request, under stated terms. Offer more detail. Keep the cover note.
For a likely working need, ask the four questions from what sales should say first, involve engineering early, and ask which scanner they use so you can reproduce findings.
Do not assume
You can be wrong. A checkbox request can lead to a real review, and a detailed request can end with a filed PDF. Ask a light question to find out: "Will your team load this into a scanner, or file it for audit?" The answer sets the depth.
Watch for requirements you cannot verify
If a request says a regulation or contract requires something, do not argue from memory and do not agree on the spot. CISA's 2026 text says the minimum elements do not create new requirements and are not compliance advice. Ask for the clause, route it to the person who owns contracts, and answer in writing. If the request mentions the EU Cyber Resilience Act, the CISA text notes the regulation requires manufacturers of products with digital elements to provide an SBOM as part of technical documentation. Whether that applies to your product is a question for your legal team.
Keep the record either way
Log the request, the size you judged it to be and the answer you gave. If the customer returns with a deeper question, you will see how the relationship evolved. See what to record about an SBOM request.
Quick check
Should we send less detail to a checkbox request?
Send the same accurate file and cover note. Do less back and forth, not less honesty.
What if we cannot tell?
Ask the light question about how they will use the file. It costs one email and saves a misjudged response.
Safeguard's SBOM and dependency scanning can help engineering answer either kind of request from a current inventory, and the free scan is a way to preview it.
Sources
Last reviewed: 19 October 2026.
