For most commercial software, share the SBOM on request or through a gated trust center, with an NDA when needed. Publish it openly only if your product is open source or your customers expect it and you can keep it current. The deciding factor is who needs it and whether you can maintain it.
What the guidance says
CISA's attestation form page states that agencies may require software producers to provide a current SBOM upon request. The key word is current. CISA also published updated SBOM minimum elements on 29 July 2026, replacing the 2021 NTIA elements, so check which element set a buyer expects before you send a file.
Three approaches
| Approach | Good for | Cost |
|---|---|---|
| Public download | Open source projects, products with a security-minded audience | Must update with every release; exposes components to anyone |
| Gated on trust center | Commercial products with many buyers | Access flow and logging to run |
| On request | Few buyers, early stage | Slow replies, manual effort |
Weighing the exposure
A component list tells an attacker which libraries and versions you ship. If you patch quickly, the exposure window is short. If your release cadence is slow, a public list can point to known weaknesses. This is not a reason to hide the list from customers. It is a reason to control who gets it and to patch.
Make any SBOM usable
Whichever approach you pick, the file has to be accurate and match the shipped release. A stale SBOM is worse than none because it creates false confidence. Generate it in the build, tag it with the release version, and keep the history. Pair it with exploitability statements where relevant; see customer asks for your SBOM: what to send.
Steps to decide
- List your buyer types and what they have asked for so far.
- Check whether contracts or regulation require delivery to certain customers.
- Decide format and element set, and confirm a buyer's expectation.
- Choose public, gated or on request per product, not company wide.
- Automate generation per release and review quarterly.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the component inventory, the raw material of any SBOM, and think about which fields you would be comfortable sharing.
Quick check
Is an SBOM confidential by default?
No rule says so. It is your choice and your contracts. Many vendors treat it as confidential and share under NDA.
Does sharing an SBOM replace answering vulnerability questions?
No. It lists components. Buyers still want to know how you handle findings in them.
Safeguard generates SBOMs and runs dependency scanning, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
