Yes, a dated 90 day roadmap often helps when a startup has gaps in its supply chain controls. List three to five items, give each an owner and a month, and promise only what you control. Reviewers accept honest plans more readily than vague claims of completeness.
When a roadmap helps
A roadmap works for gaps that are real but fixable: no build provenance yet, no SBOM per release, scanning on some repositories but not all. It does not work for gaps that are fundamental, and it never replaces controls the buyer treats as a hard requirement.
The roadmap is also a commitment. Once you share it, a buyer may ask for progress at the next call or at renewal. Write it like a promise.
What goes in
| Element | Example |
|---|---|
| Item | Generate an SBOM for each release from the pipeline |
| Why it matters | Lets customers answer advisory questions quickly |
| Owner | Named engineer or role |
| Target month | Month 1, 2 or 3 |
| Evidence at completion | Sample SBOM file, pipeline run |
Keep to one page. Five items done are more convincing than fifteen half started.
A sensible order
Pick items that shorten future reviews:
- Complete the inventory. Every production repository scanned, with owners.
- Make scans required. Branch rules that block merges on critical findings.
- Automate the SBOM. One per release, stored by version.
- Write the exception process. A register with review dates.
- Describe the pipeline. One page, kept current, with access controls.
Provenance and signing can follow once the basics are steady. The SLSA specification describes levels of build assurance, where Level 1 means provenance exists, and higher levels add tamper resistance. Treat them as stages and claim only the level you can demonstrate.
Wording rules
- Use month names and real dates.
- Use "planned" and "in progress", not "complete", until the evidence exists.
- Do not link the roadmap to a certification or attestation you do not hold. SOC 2, for example, results in an auditor's report, and an audit in progress is not a result.
- Do not include items you do not intend to fund.
Keeping the promise
Put the items into your normal tracker so they get done. Send a short update at day 45 and day 90, even if nothing was asked. A buyer who sees updates arrive on time will often extend more trust than the content alone would earn.
If you slip, say so early, give the new date, and explain what changed. For help with wording gaps in answers, see this gap statement template.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are tracked from detection to closure, which is what a roadmap item like "make scans required" produces.
Safeguard covers SBOM and dependency scanning, policies and gates, and evidence automation, which map to several roadmap items. Start with a free scan.
Quick check
Is 90 days too short?
For focused items, no. If a task needs longer, list it as a later phase and say so.
Should the roadmap be in the contract?
That is a decision for the deal owner and counsel. Do not agree to it casually, since it turns plans into obligations.
Sources
Last reviewed: 19 October 2026.
