A license folder for a data room needs five things: an index, dated SBOMs with license fields, the open source policy, an exception log, and the third party notices. Each file should prove one point. Keep it short, dated and consistent. This is general information, not legal advice.
The folder layout
| File | What it proves |
|---|---|
| 00 index | What is in the folder, who owns it, as of when |
| 01 policy | You have written rules and a named approver |
| 02 sbom per artifact | You know what ships, with license per component |
| 03 findings and decisions | Each risky license was reviewed and decided |
| 04 exception log | Exceptions have owners and expiry dates |
| 05 third party notices | You meet notice duties for shipped code |
| 06 contribution rules | How outside code and employee contributions are handled |
The index file
Make the first page a plain table: file name, one sentence purpose, owner, last updated date. A reader skimming five data rooms should understand yours in a minute. The post on what makes a security folder easy to review goes deeper on layout.
SBOM details
The SPDX specification offers a concluded license field and a declared license field per package. Concluded is what the SBOM creator decided governs the package, with NONE and NOASSERTION as defined fallbacks. Use consistent values and say which tool and date produced each file. NTIA lists timestamp and author of SBOM data among its minimum elements, which is a good prompt to include both.
Decisions file
For every deny or review result, add a row: component, license, how it is used, decision, approver, date. This turns a scary scanner export into a record of judgment. The red yellow green scoring post shows a simple scale.
Keep it consistent with other claims
Your website, security questionnaire answers and data room should say the same thing about open source. If the questionnaire says you scan every pull request and the folder shows a nightly scan, reconcile it. See answering open source license questions in questionnaires.
Stale evidence
A snapshot from eight months ago can mislead. Date everything and refresh before each major conversation. The post on evidence that goes stale during diligence lists what ages fastest.
Try it yourself
Open the demo and look at the component list. Picture which columns would become the SBOM file in the folder.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation and SBOM generation can feed several of these files. You still review and sign off on what goes into the room.
Quick check
Should we upload raw scanner output?
Include a cleaned SBOM and a decisions file. Raw output without decisions invites questions you could have answered in advance.
Who should own the folder?
One named person, usually engineering or security, with counsel reviewing the decisions file.
Sources
Last reviewed: 19 October 2026.
