Do not use a single pass or fail gate. Give supplier SBOMs four outcomes: accept, accept with warnings, quarantine and reject. Reject only files you cannot parse, quarantine files that parse but look wrong, and always tell the supplier why. Silent acceptance corrupts your risk numbers.
Why two outcomes are not enough
If you only accept or reject, you will make one of two mistakes. A strict gate rejects useful files over cosmetic flaws and the supplier stops sending. A loose gate accepts files so thin that your scans report zero findings by accident. Four states let you keep useful data while recording its weakness.
The four states
| State | When to use | What happens next |
|---|---|---|
| Accept | Parses, valid identifiers, no major gaps | Match and monitor |
| Accept with warnings | Usable but weak: some versionless components, missing supplier fields | Match, flag data quality, send feedback |
| Quarantine | Parses but suspicious: empty component list, duplicate references, mismatched product | Hold, human review, do not feed dashboards |
| Reject | Cannot parse, wrong type, unsafe content | Return error with reason |
Sample rules
- Parse failure: reject. The error message should name the line or field if possible.
- Component list empty: quarantine. An empty list on a real product is almost always a generator problem.
- Share of components without version above your threshold: accept with warnings, or quarantine for critical products.
- Duplicate reference values: CycloneDX says each reference identifier must be unique within the BOM, so duplicates are a validity problem.
- Invalid purl: CycloneDX says a purl, when present, must be valid under the purl specification. Warn or quarantine depending on how many.
- Product does not match the request: quarantine and ask.
- Timestamp in the future or very old: warn.
Pick thresholds with your own risk team. The numbers are policy, not standards.
Tell the supplier what happened
Every non-accept outcome should send a short, specific message: the file name, the state, the rule that fired, and one suggested fix. Suppliers fix what they can see. Keep a log so you can show a trend in their quality over time.
Keep quarantined data out of totals
Quarantined files should not count toward coverage or vulnerability numbers until reviewed. Otherwise a bad file with zero findings lifts your apparent posture.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a gate gives a pass or fail with reasons, then compare that with a four-state intake.
Where Safeguard fits
Safeguard lets you define policies, gates and guardrails on findings, and you can run a free scan to see how a file performs before you set thresholds.
Quick check
Should an SBOM with zero components be accepted?
Quarantine it. A real product almost never has none, so the file is likely incomplete.
Do the standards set quality thresholds?
No. Validity rules exist, but thresholds such as acceptable share of versionless components are your policy.
Sources
- CycloneDX 1.6 JSON reference: uniqueness of reference IDs and purl validity.
Last reviewed: 19 October 2026.
