Treat a vendor SBOM as an inventory to check, not a verdict. CISA describes an SBOM as a nested inventory, a list of ingredients that make up software components. Match it to vulnerability data, ask which findings are reachable, and track changes between versions.
This is general information, not legal advice.
What an SBOM tells you and what it does not
It tells you which components and versions the vendor says are in a product. It does not tell you whether a vulnerable function is called, whether the vendor has patched, or whether the list is complete.
CISA has published draft 2025 minimum elements guidance and described the updated guidance as outlining current practices for software transparency. Check the final version before you write requirements around it.
Five steps
- Check the basics. Does it name suppliers, component names, versions and relationships? Is it dated and tied to a specific product version?
- Match components against vulnerability sources, and record the date of the match.
- Ask the vendor about reachability. A listed vulnerability in code that is never executed is a different priority from one on the main request path.
- Compare against the previous SBOM. New components and changed suppliers are worth a question.
- Store it with the relationship record so monitoring later can reuse it.
Questions to put back to the vendor
| Question | Why |
|---|---|
| How often do you regenerate the SBOM? | A stale list hides new risk |
| Does it cover transitive dependencies and containers? | Direct dependencies are a small part |
| How do you handle a critical advisory? | Process matters as much as the list |
| Can you share a vulnerability exploitability statement? | Separates affected from not affected |
Fits the bank lifecycle
The 2023 interagency guidance asks banks to review information systems and security controls in diligence and to watch the third party's response to new vulnerabilities during monitoring. An SBOM gives you a factual base for both. See also what banking regulators have said about SBOMs.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the findings and note how severity, fix availability and exposure change the order you would work them in.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and reachability analysis can ingest an inventory and show which findings matter. A free scan is at gold.safeguard.sh/scan.
Quick check
Does an SBOM prove software is secure?
No. It lists components. You still need vulnerability data, reachability context and the vendor's response process.
How often should a vendor update it?
With each release at least, and when a component changes. Ask what the vendor does.
Sources
- CISA, Software Bill of Materials
- Interagency Guidance on Third-Party Relationships, Federal Register, 9 June 2023
Last reviewed: 19 October 2026.
