Keep a sharing register: one row per document sent, recording the customer, document, version, date, channel, named recipients, expiry and who approved it. A spreadsheet is enough to start. It lets you revoke access, refresh stale files and answer an auditor or customer asking exactly what you provided.
Why you need one
Without a register, the answers live in people's inboxes. When a customer asks what you sent last year, or an incident forces you to find everyone who received a certain SBOM, you are searching mail threads under pressure.
A register turns those questions into a filter.
The columns
| Column | Why it helps |
|---|---|
| Customer | Group by account |
| Document name | What was shared |
| Version and revision | Which copy |
| As-of date | How current it was when sent |
| Date sent | When it left |
| Channel | Email, link, portal |
| Named recipients | Who can see it |
| Access expiry | When access ends |
| Approver | Who allowed it, tied to your lane rules |
| Checksum or signature | Proof of the exact file |
| Notes | Redactions, special terms |
Keep it to these. A register with thirty columns will not be filled in.
Where to keep it
Use the tool your team already opens daily. Options:
- A shared spreadsheet, with restricted editing. Fine for a small number of customers.
- Your CRM, with a custom object or notes field for evidence sent. Good when sales owns the relationship.
- A ticketing system, with a ticket per customer request. Good when security handles requests.
Whatever you choose, make one person responsible for its accuracy, and make updating it part of the send, not an afterthought.
Use it, not just keep it
A register earns its keep when you act on it:
- Weekly: check for expiries in the next two weeks and offer renewals.
- On release: list customers holding the previous SBOM revision and decide who to notify. See should you notify customers when your shared SBOM changes.
- At contract end: pull every access for the customer and revoke it. See revoking customer access to your evidence.
- At audit: show the register as evidence of controlled sharing.
Compare it with access logs now and then to catch anything outside the plan. See log who opened your shared security evidence.
Starting from nothing
You do not need to reconstruct history. Start the register today for all new sends. Then add your top ten customers by looking back through recent threads. Perfect coverage of the past matters less than reliable capture going forward.
Try it yourself
Mapping evidence to controls is the same discipline as mapping documents to customers. This demo shows evidence mapped to frameworks, and the gaps that appear when something is missing.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation keeps the evidence itself current, and your register records where each copy went. A free scan shows a sample export.
Quick check
Is a spreadsheet really enough?
For a small customer count, yes, if one person owns it and updates it with every send. Move to a CRM or ticketing tool as volume grows.
Should the register itself be confidential?
Yes. It reveals who your customers are and what they received. Restrict editing and viewing to the people who need it.
Last reviewed: 19 October 2026.
