Ask a supplier ten things about its SBOM: what it covers, how it was generated, what is unknown, how often it is updated, whether it is signed, how you receive it, how corrections work, who the component producers are, and how the supplier acts on vulnerabilities in it. The questions below follow CISA's 2026 elements.
The questions
1. Which product and version does this SBOM describe? The version must match what you run. CISA says each software version or update should have an associated SBOM.
2. Who authored it? The SBOM author is the entity that created the SBOM data, which may differ from the component producer.
3. How was it generated? CISA's generation context names source, build or after build. A source SBOM and a binary SBOM can differ. See source versus binary SBOM generation.
4. Does it include transitive dependencies? CISA says there is no minimum depth, and expects all components that make up the software.
5. What is marked unknown, and why? The guidance says authors should state whether information is unknown to them or withheld. It also says an SBOM may be considered incomplete if essential data is withheld.
6. Is it signed, and by whom? The 2026 elements add an SBOM author signature so you can tell the file was not changed after signing. See what a signed SBOM proves.
7. How often is it updated? Expect a new SBOM for each build or release, and a revised one when errors are found.
8. How do we receive it, and who can see it? CISA lists examples: with installation, at a version specific URL, through an API or in a public repository. Access controls may limit sharing with unauthorized parties but should not block authorized ones.
9. How are corrections handled? The guidance says authors should correct errors promptly and accommodate updates.
10. What do you do when a listed component has a new vulnerability? Ask about advisories such as VEX or CSAF, response timelines and who notifies you. See vex questions to ask a supplier.
Scoring the answers
Use three buckets, not a number.
- Clear: specific, documented, with a sample.
- Partial: the supplier has a plan or covers some products.
- Gap: no answer, or the answer is that SBOMs are not provided.
A gap is a finding for your register, not an automatic rejection. Pair it with a date for follow up.
Keep the paper trail
Save the supplier's answers, the SBOM and the date you received it. Next year's review starts from there. Contracts may also set what the supplier owes you. Check the clause.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the inventory and test question four: can you see transitive dependencies, not only direct ones?
Quick check
Should I demand every field in the 2026 list?
Ask for what your risk decision needs. The 2026 elements are a baseline buyers can request, not a legal requirement on their own.
What if the supplier will not share an SBOM?
Record it as a gap, ask why, and consider compensating checks such as scanning the delivered product.
Sources
Last reviewed: 19 October 2026.
