OMB M-26-05 says agencies "may also choose to adopt contractual terms that require a software producer to provide a current software bill of materials (SBOM) upon request." That is an option, not a universal rule. If you meet the clause, you need a process that produces a current SBOM quickly.
What the memo says
The sentence sits in the paragraph on agency assurance policies. A footnote adds: "For a cloud platform, agencies adopting such a contractual term should specify that the producer must provide an SBOM of the runtime production environment upon request."
The memo points to the CISA minimum elements for SBOMs for additional information. The final 2026 version, published 29 July 2026, replaces the 2021 NTIA baseline.
Three words to read closely
Current. An SBOM for last year's release does not answer a question about today's. CISA's elements say each software version or update should have an associated SBOM, and a corrected SBOM should be issued when errors are found.
On request. You are not told to publish. The clause implies a request path, so you need an owner, an inbox or portal, and a time you can honor.
Runtime production environment. For cloud services, this is a different object from a source repository SBOM. CISA's own text notes that SaaS changes often and that distributing SBOMs through an API can capture snapshots.
What to prepare
- Name one owner for SBOM requests.
- Decide what you can produce on demand for each product and version, and how long it takes.
- Check the file against the 2026 minimum elements, including hashes, licenses and the generation context. See which minimum elements to follow.
- Decide how you handle confidentiality. CISA's text says access controls may limit sharing with unauthorized parties but should not stop authorized parties. For redaction questions, see can you redact an SBOM before sharing it.
- For cloud services, decide how you would describe the runtime image set, and how often it changes.
Responding to a request
Send the file, state the product and version it covers, the generation context, the SBOM author and the timestamp. Say plainly what is unknown. CISA says unknown information should be marked unknown or withheld, not left blank.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how the component list changes between runs. That drift is why an SBOM on request has to be current rather than archived.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and its compliance and evidence automation can help keep a current SBOM and its supporting evidence ready. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Can an agency demand an SBOM from any vendor under M-26-05?
The memo lets agencies choose to adopt a contract term for it. Whether it applies to you depends on your contract.
Is a source repository SBOM enough for a cloud service?
The memo's footnote asks for an SBOM of the runtime production environment for cloud platforms where this term is adopted.
Sources
Last reviewed: 19 October 2026.
