A license evidence pack is a small, dated bundle you can hand to an auditor or customer: your open source license policy, a component and license inventory per release, a log of exceptions and decisions, and proof the checks run regularly. Build it once and refresh it per release.
The five items
- Policy. One page stating allowed, review and deny licenses, who decides, and how exceptions work.
- Inventory. For each release, a list of components with version, detected license and scope. An SBOM in SPDX or CycloneDX is a common format.
- Decisions. A log of review items and unknowns: what was found, what was decided, who approved, when.
- Exceptions. Active waivers with an owner and an expiry date.
- Run history. Evidence that scans happen on a schedule or on every change, such as CI run records.
Why these five
Requests tend to ask the same questions in different words: do you track third party licenses, what is your policy, can we see a list, what do you do about copyleft, and how do you know it is current. The pack answers each with a document, not a paragraph of assurance.
Keep it honest
| Do | Do not |
|---|---|
| Date every artifact | Reuse last year's list as current |
| Show unknowns as unknown | Hide them to look clean |
| Link decisions to the exact version | Describe decisions in general terms |
| State what you do not cover | Claim a certification or audit you do not hold |
Describing a program accurately matters more than describing it impressively. See answering open source license questions in security questionnaires.
Refresh routine
- Per release: regenerate the inventory and notices file.
- Monthly: review open unknowns and expiring exceptions.
- Yearly: review the policy itself.
Store the pack in one place with version history, so you can show what was true on a given date.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one control can link to several pieces of evidence.
Safeguard's compliance and evidence automation helps collect this kind of record, and its SBOM and dependency scanning supplies the inventory. Nothing here is legal advice.
Quick check
Is an SBOM the whole pack?
No. It is the inventory. You also need policy, decisions, exceptions and run history.
How often should the inventory be refreshed?
At every release at minimum, since a dependency change can change a license.
Last reviewed: 19 October 2026.
