The consumer is the party that receives and uses an SBOM. CISA defines three roles in the sharing lifecycle (author, consumer and distributor) and three phases (discovery, access and transport). As a consumer, you find out an SBOM exists, get permission to read it, and receive it in a form you can use.
The three roles
CISA's SBOM Sharing Roles and Considerations document, published 28 March 2024, defines:
- SBOM Author. Creates the SBOM data. The NTIA minimum elements report calls this the author of SBOM data, separate from the supplier of a component.
- SBOM Distributor. Makes the SBOM available. This can be the author, the supplier, or a third party.
- SBOM Consumer. Receives and uses it.
One organization can hold all three roles for different software. A company that builds a product is an author for its own SBOM, a consumer of its suppliers, and a distributor when it shares with customers.
The three phases
The document organizes sharing into discovery, access and transport. The NTIA report uses similar language: how the existence and availability of an SBOM is made known, and how it is retrieved by or sent to people with permission.
| Phase | Consumer question | Practical answer |
|---|---|---|
| Discovery | How do I know an SBOM exists? | Ask in onboarding, check release pages, read contract terms |
| Access | Am I allowed to read it? | Agree terms, NDA or portal login if needed |
| Transport | How does it reach me? | Email, portal download, registry, or API |
What this means day to day
- Make discovery routine. Add "Do you provide SBOMs, and how?" to supplier intake.
- Set access expectations early. If the supplier restricts access, learn the terms before you need the file in a hurry. The NTIA report says access terms, including allowances for integrating SBOM data into the user's security tools, can be set by licensing or contract.
- Choose a landing place. Decide where received files go, who can see them, and how they are named.
- Check on arrival. Confirm format, fields and version, as covered in the supplier SBOM intake checklist.
- Use it. A stored file with no one reading it adds no security. Match it, search it, review it.
- Give feedback. If you find an error, tell the author. The NTIA report encourages consumers to welcome corrections and to be tolerant of good-faith mistakes.
Where consumers get stuck
Most delays happen in access, not transport. Terms take longer than file transfers. Starting the access conversation early is the single most useful habit.
Another is treating all three roles as separate people. In a small company, one engineer may do all of them. That is fine, so long as someone has the job.
Why the vocabulary helps
Using the same role names as CISA makes contracts and emails shorter. "We are the consumer; please act as distributor and tell us how to access" is clearer than a paragraph of description.
If you want a quick check of a received file, Safeguard's free scan is at gold.safeguard.sh/scan.
Quick check
Can one company be author, consumer and distributor?
Yes, for different software or at different times. The roles describe what a party does, not what kind of company it is.
Which phase is slowest in practice?
Often access, because terms need agreeing. Start that conversation early.
Sources
- SBOM Sharing Roles and Considerations, CISA
- The Minimum Elements For a Software Bill of Materials (SBOM), NTIA
Last reviewed: 19 October 2026.
