For a cloud platform, OMB M-26-05 says an agency that adds an SBOM-on-request term should ask for an SBOM of the runtime production environment. CISA's 2026 SBOM guidance admits SaaS is harder: shared responsibility and constant change. Snapshots delivered through an API are one practical answer.
What the sources say
M-26-05, footnote 1: for a cloud platform, "agencies adopting such a contractual term should specify that the producer must provide an SBOM of the runtime production environment upon request."
CISA's 2026 minimum elements apply to all software, including SaaS. Its discussion section says:
- Shared responsibility between SaaS producers and operators may limit some SBOM use cases.
- SaaS changes often, so delivering and receiving SBOMs at high frequency may overwhelm both sides.
- Precise specification of what is deployed in the container can offset that, and APIs can capture snapshots as code changes.
- Additional elements for SaaS may be worth exploring later.
On-premises vs SaaS
| Question | On-premises product | SaaS product |
|---|---|---|
| What is the SBOM of? | The shipped release | What runs in production |
| How often does it change? | Per release | Continuously |
| Who is the author? | The producer | The producer, with the operator's layer in play |
| Best delivery | Attached to the release | A version-specific URL or API with timestamped snapshots |
How to prepare an answer
- Decide the unit: per service, per container image, or per environment.
- Generate the SBOM from what is deployed, not only from source, and label the generation context.
- Time-stamp each snapshot and keep prior ones, so you can answer "were we running that on a given day?"
- State clearly which layers you do not control, such as a cloud provider's managed services.
- Offer a contact for questions about redacted or unknown fields.
CISA also says authors should explicitly state whether missing information is unknown or withheld.
What to avoid
Do not promise an SBOM for every deploy unless your pipeline can produce one. Agree on a frequency, such as on request plus after major changes. For the contract wording, see the SBOM on request clause after M-26-05.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how the image's packages are listed. A deployed image is a natural unit for a production SBOM.
Quick check
Does M-26-05 require SaaS providers to deliver an SBOM?
No. It says agencies may choose such a term, and gives a footnote on how to specify it for cloud platforms.
Is a source-based SBOM enough for SaaS?
The memo's wording points to the runtime production environment, so a deployed view is the safer answer.
Safeguard provides SBOM and dependency scanning, container image scanning and asset discovery. Run the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
