When you ask a supplier for an SBOM, ask for license data in a form you can check: valid SPDX identifiers, a marker for declared or concluded, expressions for compound cases, and an honest count of unknowns. A file full of NOASSERTION is not a license inventory.
What to ask for
- SPDX identifiers or expressions, not free text, wherever SPDX has an id. In CycloneDX, that means id or expression, with name only for licenses SPDX does not define.
- Declared versus concluded, so you know whether a person verified the value. CycloneDX has an acknowledgement for this, and SPDX has separate declared and concluded fields.
- Files detected, in SPDX, for packages where vendored code may carry other licenses.
- Comments wherever concluded differs from declared. The SPDX spec asks for them.
- Links or text for custom licenses.
What to check on receipt
- Do all ids validate? An invalid id breaks automated policy checks.
- What share of packages is NOASSERTION? Ask for the figure, and treat it as an open item.
- Are there NONE values? Those are packages with no license information.
- Are GPL identifiers given with only or or-later suffixes? See the suffix post.
- Are expressions present for dual licensed components?
Contract wording
Keep it factual. Ask the supplier to provide an SBOM for each release with the license fields above, to notify you of license changes in dependencies, and to answer questions on any copyleft component that ships to you. Avoid promising specifics you cannot verify on your side.
What to do with the answers
Feed the file into your own policy checks, using the tiers you defined. Packages in the review tier go to a person. Unknowns go back to the supplier with a date.
Also check the file itself, not only the license fields. The earlier post on validating an SBOM before you accept it covers that.
Sample request
Please provide, for each release, an SBOM in SPDX or CycloneDX that lists a license identifier or expression for every component, marks whether each license is declared or concluded, and lists components with unknown license data separately.
Safeguard's SBOM and dependency scanning can produce and read SBOMs, and the free scan lets you try it on your own code. What you accept is a decision for your team.
Quick check
Is a free text license name acceptable?
Only for licenses SPDX does not define. Otherwise use the SPDX id so policies can match it.
What does a high NOASSERTION share tell me?
That many packages have no license determination, so license risk is unmeasured for them.
Sources
Last reviewed: 19 October 2026.
