Accept it as a starting point, then ask for a machine-readable version. A PDF or spreadsheet can be read by a person, but it cannot be matched against vulnerability data or searched across suppliers without retyping. Request CycloneDX or SPDX, and in the meantime check that the fields are present.
Why the file type matters
The NTIA minimum elements report lists automation support as its own requirement. It asks for machine-readability so SBOMs can scale across organizations, and names SPDX, CycloneDX and SWID tags as formats used to generate and consume them. A PDF fails that test. So does a spreadsheet unless its columns follow a known structure.
The practical cost shows up later. When a new advisory lands, you want to search every supplier's component list in one query. A folder of PDFs turns that into an afternoon of copy and paste.
Step by step
- Say thank you and log the receipt date. Do not reject the file; the NTIA report asks consumers to be tolerant of mistakes made in good faith.
- Check the seven data fields: supplier name, component name, version, other unique identifiers, dependency relationship, author of the SBOM data, and timestamp.
- Note which product and which version the file describes. A list with no product name is hard to use.
- Ask the supplier whether a CycloneDX or SPDX export exists. Many tools produce both, and the request is often a few minutes of work for them.
- If they cannot, decide whether to convert it yourself (see below) or to record the gap as a finding.
Converting it yourself
If the spreadsheet has clean columns, you can map them into CycloneDX or SPDX with a short script. This is reasonable for a one-off review. It is a poor long-term plan.
| Approach | Good for | Risk |
|---|---|---|
| Request a native export | Every ongoing supplier | Takes a reply cycle |
| Convert a clean spreadsheet | A single urgent review | Your edits may introduce errors |
| Retype from a PDF | Almost never | Slow and error prone |
| Record as incomplete | Suppliers who cannot comply | Needs a follow-up date |
If you do convert, record that the data was transformed by you, who did it and when. The NTIA report separates the author of the SBOM data from the supplier of the component, and that distinction matters here: you are now an author of derived data.
What to put in the reply
Keep it short. Name the product and version, say you can use the file for a first read, and ask for a CycloneDX or SPDX export with the same content. Ask whether they will send a new one with each release. The NTIA report describes frequency as a practice: a new SBOM when the software is built or released again, or when the supplier learns something new about the components.
Do not ask for more than the minimum on the first round. Suppliers who are new to this respond better to one clear request than to a long questionnaire.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a structured inventory lets you filter and search components, which a flat document cannot do.
Once you have a CycloneDX or SPDX file, Safeguard's SBOM and dependency scanning can match it against known vulnerabilities, and the free scan is at gold.safeguard.sh/scan.
Quick check
Should we refuse a supplier SBOM that is not machine-readable?
Usually no. Accept it, review it, and ask for a structured export. Refusing outright can end the conversation before you learn anything.
Does a spreadsheet count as an SBOM?
It can hold the same data, but without an agreed structure it is hard for tools to read. The NTIA report points to SPDX and CycloneDX for automation.
Sources
Last reviewed: 19 October 2026.
