Make each SBOM directly mappable to one release. The NTIA minimum elements report says the SBOM can accompany each instance of the software or be reachable through a version-specific URL. Pick one rule, apply it to every release, and write the release identifier inside the SBOM itself.
What the guidance says
The report's distribution and delivery practice says SBOMs should be available in a timely way to those who need them, with appropriate access permissions and roles. It says the data can accompany each instance of the software, or merely be accessible and directly mappable to the specific version in question, for example through a version-specific URL. It adds that delivery can reflect the type of software: executables on endpoints can store the SBOM on disk with the compiled code, while embedded systems or online services can use pointers to SBOM data stored online.
Three patterns
| Pattern | How it works | Good fit |
|---|---|---|
| Ship with the software | SBOM file packaged in the installer or image | Desktop software, containers |
| Version-specific URL | A stable address per release, such as a path that includes the version | Downloadable software and libraries |
| Pointer from the product | The product or its metadata names the URL | Embedded devices, hosted services |
Making the mapping reliable
- Put the product name and exact version in the SBOM's top level data, not only in the filename.
- Use a predictable address. A path containing the product and version lets a customer build the URL without asking you.
- Never overwrite. One URL, one release, one SBOM. When you correct a file, publish a new revision and keep the old one.
- Record the build identifier or digest of what you shipped, so the SBOM can be tied to the artifact and not just to a name.
- Tell customers the pattern in your release notes and in your SBOM request answer.
Hosted software and SaaS
For a hosted service there is no installer to put a file in. The NTIA text explicitly allows pointers for online services. Publish a page or API that says which SBOM describes the version currently running and keep earlier ones available.
Check your work
Take a random customer release. Can a support engineer find its SBOM in under a minute? Does the file name that exact release? If either answer is no, fix the process before a customer asks.
Try it yourself
Open the demo and see how components are listed with versions. Imagine that list attached to a release number, and how the same page for the next release would differ.
Click through it at your own pace, or open it full screen.
Quick check
Is a filename enough to identify the release?
No. Files get renamed. Put the version inside the SBOM and ideally an artifact digest.
Do we need an SBOM per patch release?
The NTIA report says a new build or release needs a new SBOM, which includes builds that update a dependency.
Safeguard's SBOM and dependency scanning can produce an inventory for each build, and the free scan shows what one looks like.
Sources
Last reviewed: 19 October 2026.
