A request form for security documents should collect who is asking, their company, which document and version they need, why, and whether an agreement is in place. It should route to one owner, record what was sent, and give a response time. Keep fields few so buyers finish it.
What the sharing primer shows
CISA's SBOM Sharing Primer describes the manual version in detail. A customer emails the vendor. The vendor's legal and production teams verify that the requester is an existing customer or has a pre-sales agreement in place, and that technology transfer rules do not bar the request. The vendor then sends an NDA, the customer signs it, and the SBOM goes back by encrypted email. The primer lists the cautions: not automatable or scalable, legal requirements, and a longer time to delivery.
A portal version moves the same steps online. In the primer's example, customers are vetted ahead of time, the NDA is presented in the portal and signed electronically, and access to download is then granted automatically. The primer calls this more streamlined, with the legal agreement done inline.
The fields
| Field | Why |
|---|---|
| Name and work email | Know who to answer, and check the domain |
| Company | Match to a customer or prospect record |
| Document and version | Avoid back and forth |
| Purpose | Decide the tier: review, integration, audit |
| Agreement status | Skip the NDA step if one exists |
| Deadline | Prioritize against deals and audits |
Avoid asking for things you will not use. Each extra field lowers completion.
Back-end steps
- Route. Send to one queue with one owner, not a shared inbox.
- Check. A person or rule verifies the requester against your customer list and your internal policy. The primer notes legal and compliance vetting as a standard step. Ask your own counsel what applies to you.
- Decide. Approve, approve with a summary, or decline with a reason.
- Deliver. Use a link with expiry, or a portal download over HTTPS.
- Record. Log who received what and when.
Response time
Set a target and publish it. Many buyers worry less about the wait than about silence. A target such as "within two business days" works if you can keep it. The 2026 CISA minimum elements say SBOMs should be available promptly to those who need them, so slow handling counts against you.
Automate what you can
Pre-approved tiers help. If a customer with a signed agreement requests the current SBOM, approval can be automatic. Prospects might receive a summary automatically and a full file after review. The primer notes that its manual routes do not scale, so plan to automate the routine cases first.
Where Safeguard fits
Safeguard's compliance and evidence automation helps teams organize the documents and evidence behind these requests, and its SBOM scanning produces the inventory data. Try a free scan at gold.safeguard.sh/scan.
Quick check
Can sales send the document directly?
Only for documents your register marks as sales-safe. Everything else should go through the owner and be logged.
Do I need a form at all?
For a handful of requests, an email address works. A form helps once volume grows or you need consistent checks.
Sources
Last reviewed: 19 October 2026.
