Keep a stable internal supplier ID, and treat names as aliases attached to it. When a supplier is renamed or acquired, add the new name, keep the old one, and link both to the same record. Do not edit old SBOMs. Then check whether the new owner will keep issuing SBOMs.
Why names break things
The NTIA minimum elements report defines supplier name as the entity that creates, defines and identifies a component. It also says the capability to note multiple names or aliases for supplier and component names should be supported if possible.
That is the hook. If your records are keyed by a display name, a rename splits one supplier into two. Searches for the old name miss new files, and the reverse. Acquisitions make it worse, because the parent may also appear as a new supplier name in later SBOMs.
Step by step
- Assign an internal supplier ID. A number or short code that never changes. Everything else points to it.
- Store aliases. Old name, new name, parent company name, and any product brand names.
- Keep old SBOMs untouched. They record what the supplier called itself on that date. Rewriting history makes later comparisons unreliable.
- Add a change record. Date, type of change (rename, acquisition, merger), source of the information, and who entered it.
- Re-check the contact and delivery path. Acquirers often change portals, email domains and support teams.
- Ask for continuity. Will the SBOM and update commitment continue under the new owner?
What the continuity question looks like
Send a short note to your existing contact: "We understand the company has changed its name or ownership. Please confirm whether SBOM delivery, any VEX statements and update timing stay as they were, and tell us if the contact or portal changes." Keep a copy.
| Scenario | What changes in the SBOM | What you do |
|---|---|---|
| Rename only | Supplier name field | Add alias, no other change |
| Acquisition, product continues | Supplier name may change; product name may stay | Add alias, confirm commitments |
| Acquisition, product retired | New releases may stop | Plan replacement, ask about end-of-support |
| Merger of two product lines | Component lists may merge | Request new SBOM for merged product |
Search tips
When looking for a component after an advisory, search by component name and package URL, not only by supplier name. The NTIA report notes that supplier and component names are human-readable strings, and that other unique identifiers support automated mapping across ecosystems. Identifiers hold up better through renames.
Do not forget the risk side
Ownership changes sometimes bring staffing and tooling changes. That is not a reason for alarm, but it is a reason to ask for a fresh SBOM within a quarter and compare it with the last one. A big shift in components can follow a re-platforming.
If you need to check a new file quickly, Safeguard's free scan is at gold.safeguard.sh/scan.
Quick check
Should we update old SBOMs to show the new supplier name?
No. Leave them as received and add an alias in your records.
Do commitments carry over after an acquisition?
That depends on the agreement, which is a question for your legal team. Ask the supplier to confirm in writing.
Sources
Last reviewed: 19 October 2026.
