Publish documents that describe posture and carry little risk, such as policies and subprocessor lists. Put documents with technical detail, such as SBOMs, test reports, and architecture notes, behind authentication or a request step. Use an NDA only where the content needs it, because every added step slows buyers down.
Three questions that sort a document
Ask these for each document you might share.
- Audience. Is this for anyone, for prospects, or for signed customers only?
- Detail. Would an outsider learn something that helps them attack you or copy your product?
- Shelf life. Will it be wrong in three months?
A privacy summary scores low on detail and can be public. A penetration test report scores high on detail and belongs behind a gate. A per-release SBOM has high detail and a short shelf life, so it needs a release process, not a one-time upload.
The three tiers
| Tier | Typical content | Control |
|---|---|---|
| Public | Policies, contact for reporting, subprocessors, high-level architecture, certifications and attestations you actually hold | None |
| Authenticated | SBOMs, test summaries, detailed control descriptions | Login for known customers or prospects |
| Under agreement | Full reports, source-level detail, unredacted data flows | Signed NDA plus approval |
CISA's SBOM Sharing Primer describes real patterns along this range. In one, a customer emails a vendor, the vendor's legal and production teams check eligibility, an NDA is signed, and the SBOM is returned by encrypted email. In another, a vendor uploads SBOMs to a portal for customers who were vetted ahead of time, and the NDA is signed inside the portal. The primer lists the same caution for the email route: it cannot be automated or scaled, and delivery takes longer.
Pick the lightest gate that holds
The primer is careful to say that sophistication does not mean maturity or preference. A public download can be the right choice for an open source project. For a vendor with contract limits, a portal may fit better. Choose based on your licensing, your industry, and your priorities.
CISA's 2026 minimum elements guidance adds a practical test: SBOMs should be available promptly to those who need them, and access controls should not block authorized parties. If a customer waits two weeks for a file, the gate is too heavy.
Who approves what
Write the tier next to each document in a simple register: owner, tier, last review date, and who can approve exceptions. Sales can then answer a request in minutes by checking the register rather than asking security each time. The register also makes it clear which documents need a refresh when a release ships.
Where Safeguard fits
Safeguard's compliance and evidence automation helps teams keep documents current in one place, and its SBOM and dependency scanning produces the inventory data behind shared SBOMs. A free scan is at gold.safeguard.sh/scan.
Quick check
Do all security documents need an NDA?
No. Many are fine to publish. Use an NDA for content with real technical detail, and keep the step out of the way for everything else.
Can a public page link to a gated document?
Yes. List what exists, what it contains, and how to request it. Buyers then know the document is available without the file being exposed.
Sources
Last reviewed: 19 October 2026.
