Share an SBOM by answering three questions: how will a customer find it (discovery), who may open it (access), and how will it arrive (transport). CISA's SBOM Sharing Primer uses these three phases. A clear answer to each gives you a repeatable process instead of ad hoc emails.
The three phases in plain terms
The primer defines each phase this way. Discovery is the mechanism a consumer uses to know an SBOM exists and how to get it. Access is the set of controls the author or distributor uses to decide who can view or use it. Transport is how the SBOM moves from one party to another, including the consumer receiving it.
The primer also names three roles. The author creates the SBOM. The consumer receives it. The distributor receives SBOMs in order to pass them on, without producing or using the data itself.
Question 1: how will they find it?
Options in the primer range from a consumer emailing the vendor, to a known website or portal, to automated propagation of new SBOMs. For a small product, a clearly labeled page that says what is available and how to request it is enough. For a larger catalog, a stable location per product and version makes automation possible.
Question 2: who may open it?
Choices run from no controls, to login, to fine-grained roles. Match the control to the content. Pre-sales prospects might get a summary. Signed customers might get full files. The 2026 CISA minimum elements add that access controls should not prevent sharing between authorized parties.
Question 3: how will it arrive?
The primer lists human-initiated transfer at the low end and documented, repeatable, automated access through well-known protocols such as a REST API at the high end. Between them sit portals and HTTPS downloads. If a customer wants to load your SBOM into their own tools, a file download or API is more useful than a PDF.
Put the answers in one table
| Phase | Our answer | Review date |
|---|---|---|
| Discovery | Security page lists each product and how to request its SBOM | |
| Access | Login for customers, summary for prospects | |
| Transport | HTTPS download of the machine-readable file |
Fill this in once and you can hand it to sales and support. Adjust it when your volume grows. A process that works for five customers may need an API for fifty.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how an inventory is built from a project's dependencies. That inventory is what you would be sharing.
Where Safeguard fits
Safeguard's SBOM and dependency scanning builds the inventory, and its compliance and evidence automation helps track what you shared and when. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a more automated sharing method always better?
No. The primer says sophistication does not imply maturity or preference. Pick the method that fits your licensing, industry, and customers.
What is an SBOM distributor?
An organization that receives SBOMs to share with consumers or other distributors, without necessarily producing or using the data itself.
Sources
Last reviewed: 19 October 2026.
