A footnote in OMB M-26-05 says that for a cloud platform, an agency adding a contract term for an SBOM should specify that the producer must provide an SBOM "of the runtime production environment upon request." In plain terms: the list of what is actually running, not only what sits in a code repository.
The text
M-26-05 says agencies "may also choose to adopt contractual terms that require a software producer to provide a current software bill of materials (SBOM) upon request." The footnote attached to that sentence reads: "For a cloud platform, agencies adopting such a contractual term should specify that the producer must provide an SBOM of the runtime production environment upon request."
Two details are worth noticing. First, the memo says "may," so this is a choice for each agency. Second, it says "current," which points at what is deployed today.
Source SBOM versus runtime SBOM
| Question | Build or source SBOM | Runtime production SBOM |
|---|---|---|
| What does it list? | Dependencies declared or resolved at build time | Components present in the deployed environment, such as base images and installed packages |
| When is it generated? | At build or release | From what is running, or from the deployed images |
| What can it miss? | OS packages added later, drift from the build | Components that are only used at build time |
| Who uses it? | Release and procurement review | Incident response and agency risk review |
CISA's 2026 minimum elements document speaks to the SaaS case. It says shared responsibility and frequent change "complicate applying the SBOM model" to SaaS, and notes that distribution through APIs can accommodate rapid code changes "by capturing snapshots." It also says the precise specification of what is deployed to a container can offset some of the difficulty.
How a SaaS team can prepare
- Know your deployable units. List services, container images and serverless functions in production.
- Generate an SBOM per deployed image, tied to the image digest, so you can say exactly which version it describes.
- Store each SBOM with a timestamp and version. CISA's document says each software version or update should have an associated SBOM, and a revised SBOM should follow if details are corrected.
- Decide how you would deliver one: an access controlled URL or API, which the CISA document lists among accepted ways to share.
- Set an owner and a response time for requests, so the first agency question is not a scramble.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a dependency inventory is built for an application, and think about which part of it you would also want from a running environment.
Where Safeguard fits
Safeguard produces SBOMs and runs dependency scanning, with continuous monitoring so that new advisories can be matched to what you have already shipped. A free scan is at gold.safeguard.sh/scan.
Quick check
Does every agency now require a runtime SBOM?
No. M-26-05 says agencies may choose such a contract term, and the footnote says how to word it for cloud platforms.
Is a build time SBOM enough?
It may satisfy some requests, but the footnote is specific that cloud platform requests should ask about the runtime production environment, so be ready for both.
Sources
Last reviewed: 19 October 2026.
