CISA's SBOM sharing primer describes six patterns: email, a vendor portal, a portal with pre-vetting, open source publishing through tooling, a federated registry, and sharing along a manufacturing supplier chain. Email gives the most control and the least scale. Registries scale best but are still immature.
The six patterns
1. Proprietary software by email. The consumer asks, the vendor checks legal and export rules, signs an NDA, then sends an encrypted email. Benefit: a high degree of control. Caution: not automatable or scalable, and slow. CISA rates discovery low, access medium, transport low.
2. Vendor portal on request. The consumer logs in and requests the SBOM, and the vendor sends a secure link after internal checks. Same benefits and cautions as email. Ratings: discovery medium, access medium, transport low.
3. Vendor portal with pre-vetting. The vendor uploads the SBOM without waiting for a request, customers are vetted in advance, and an NDA is signed inline. More streamlined than email, still reliant on the consumer starting each request. Ratings all medium.
4. Open source shared via tooling. Maintainers publish source and build SBOMs automatically to agreed names and locations, such as release artifacts. Consumers can collect them at scale, helped by dependency update tooling. Caution: the consumer needs a mapping from the package to the project. Ratings: discovery medium, access low, transport medium. The primer notes that container registries can hold SBOMs as artifacts, with the registry operator acting as a distributor.
5. Open source shared via a platform. Federated attestation registries let consumers query by package URL or hash and find SBOMs plus other attestations such as provenance and VEX documents. Caution: "immature and not widely adopted," and needs deep technical knowledge. Ratings: discovery high, access medium, transport high.
6. Proprietary software along a supply chain. Each tier uploads SBOMs to the next tier's portal, and a tier one supplier bundles upstream SBOMs with its own for the automaker. Caution: duplicated effort across customers, and confidentiality means proprietary SBOMs are unlikely to be public. Ratings: discovery medium, access high, transport medium.
Choosing between them
- You sell proprietary software to a few large customers: a portal with pre-vetting is the practical middle.
- You maintain an open source project: publish consistently named SBOMs with every release and keep access open.
- You sit in a tiered manufacturing chain: use the customer's document exchange, and plan to provide a different bundle for each OEM.
- You have hundreds of customers: invest in automation, and an API or registry becomes worth it.
Cautions that apply to all six
- Sharing is not quality control. The primer says quality, accuracy and format are out of scope.
- Legal terms often decide the pattern before engineering does.
- Moving up in sophistication is optional. CISA says it is not a ladder you must climb.
For the three phase model behind these ratings, see how SBOM sharing works.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how ongoing checks pick up new releases, which is why automated sharing beats one off emails.
Quick check
Which pattern scales best?
Federated registries and automated tooling scale best, but CISA calls the registry approach immature and not widely adopted.
Should every vendor build a registry?
No. The right choice depends on customers, contracts and tooling. A pre-vetted portal serves many vendors well.
Sources
Last reviewed: 19 October 2026.
