Legal and security teams can settle several supply chain topics together before a software contract is signed: how fast the vendor notifies you of serious flaws, whether they provide a component list, how long updates are supported, and how you leave. This is a discussion aid, not legal advice.
Why bring both teams
Lawyers know what wording holds up. Engineers know what is realistic to ask for and to check. A clause nobody can verify is weak, and a technical promise nobody wrote down is hard to rely on.
Topics to cover
| Topic | Question to settle |
|---|---|
| Notification | How quickly, by what channel, and who is told? |
| Component list | Will the vendor provide an SBOM on request, in what format? |
| Updates | How long are fixes provided for the version we buy? |
| Secure development | What do they say about their practices, and in what form? |
| Subcontractors | Which key suppliers do they rely on? |
| Audit and evidence | What proof can we ask for, and how often? |
| Exit | How do we retrieve data and what happens to updates after exit? |
Evidence forms to know
CISA's attestation form page describes a self attestation based on NIST's SSDF, and notes agencies may require an SBOM on request. A self attestation is the vendor's own statement. Some buyers also look for independent assessments. Counsel can advise how much weight each form deserves for your risk.
How to phrase technical asks
Prefer measurable wording: a notification window in hours or days, a named format for the component list, a named contact. Avoid terms such as "industry standard security" which nobody can test.
Keep it living
Record who owns each clause after signing. If the vendor changes hands or builds on a new platform, revisit the questions. A short annual check keeps the contract aligned with reality.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Quick check
Is an SBOM clause common?
It is increasingly raised in buying conversations. Whether to require it is a business and legal decision.
Should engineering see the contract?
Yes, at least the technical sections, so promises match what can be checked.
Sources
- CISA, Secure Software Development Attestation Form
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 19 October 2026.
