Yes, procurement can reasonably ask software vendors for an SBOM, and many buyers now do. The useful question is what happens after it arrives. Decide who reads it, how often it refreshes, and what findings trigger a conversation, otherwise the file just sits in a folder.
Why the request is reasonable
CISA calls SBOMs a key building block in software supply chain risk management and a transparency tool across the ecosystem. Its pages name SBOM authors, consumers and distributors as roles in sharing. As a buyer you are the consumer. Federal guidance points the same way: CISA's attestation form page notes agencies may require software producers to provide an SBOM on request.
Before you ask, decide four things
- Owner. Who in security or risk reads it?
- Format. Ask for a standard machine readable format. SPDX describes itself as an open standard, identified as ISO/IEC 5962:2021. Other formats exist, so ask your security team which they can ingest.
- Freshness. One SBOM per major release, or on request after each change?
- Trigger. What finding prompts a vendor call, and what answer do you expect?
What to put in the request
Keep it short and specific.
- SBOM for the version we will deploy
- Machine readable format
- Statement of how it was generated
- Contact for questions about specific components
- How the vendor will tell us when a serious flaw affects the product
What to do when it arrives
Load it into a tool that matches components to vulnerability data. Ask about anything the vendor marks as affected, and ask for a statement when something is listed but not exploitable in their product. Record the answer. Revisit when the vendor ships a new version.
What an SBOM will not settle
It does not prove the vendor builds securely. For that, buyers often ask about secure development practices. NIST's SSDF gives purchasers a shared vocabulary for those conversations with suppliers.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Quick check
Is it fair to make an SBOM a condition of purchase?
That is a business decision. Many buyers start by asking and noting the answer before making it a hard condition. Talk to counsel about contract wording.
What if the vendor refuses?
Ask why, and record it. Refusal is information about how well the vendor tracks its own components.
Sources
- CISA, Software Bill of Materials
- CISA, Secure Software Development Attestation Form
- SPDX, About
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 19 October 2026.
