Unknown means the SBOM author does not have the information. Withheld means the author has it and chose not to include it. CISA's 2026 minimum elements ask authors to say which one applies, because the difference tells the customer how far to trust the rest of the file.
Where the guidance comes from
The 2026 elements include a practice called explicitly identifying unknown information. If information required for a data field is not provided, the author should state whether it is unknown to them or whether they are withholding it. The text says this can give recipients useful information about both the software and the author. It also says the author should have a process for recipients to ask about redacted, security related information, and that organizations may consider an SBOM incomplete if essential component data is withheld.
This replaced the earlier "known unknowns" element from 2021 to separate information that is known but withheld from information that is unknown.
Where unknowns usually show up
| Field | Typical reason it is unknown |
|---|---|
| Component version | The producer gave none |
| Component producer | No clear originating organization, so mark unknown provenance |
| Hash value | You did not have the executable artifact |
| License | You are not aware of the license information |
| Tool version | The tool did not report one |
Each of these cases has explicit wording in the CISA text, usually "indicate that the information is unknown."
How to explain it to a customer
Give one sentence per unknown.
- "Hashes are unknown for components we did not receive as artifacts."
- "License data is unknown for three components. We are checking with their producers."
- "Two internal components are withheld because they are not part of the delivered product. Ask us if you need to confirm a specific vulnerability against them."
Notice that each sentence says unknown or withheld, and why. Avoid vague wording such as "some details omitted."
What not to do
- Do not leave a field blank. Blank can mean nothing, unknown, or forgotten.
- Do not guess. A made up version number can cause a false match or a false all clear.
- Do not use withheld for unknown. It sounds secretive and invites a harder conversation.
- Do not hide a large gap. If a big share of components has unknown producers, say so up front.
Handling follow up questions
Customers will ask. Prepare a reply plan: who answers, what you will confirm and what you will not. Keep a short log of each question. If the answer changes the data, issue a revised SBOM. The CISA text says each software version or update should have an associated SBOM, and corrections warrant a revised one.
Try it yourself
Open the demo and scan the component list for fields that are empty or incomplete. Look at which ones a customer would ask you about.
Click through it at your own pace, or open it full screen.
Quick check
Is an SBOM with unknown fields a bad SBOM?
Not necessarily. An honest unknown is better than a guess. A file where essential data is withheld may be seen as incomplete, per the CISA text.
Can we redact internal component names?
You can, but say that you did and offer a way to ask about them. See can you redact an SBOM before sharing it.
Safeguard's SBOM and dependency scanning can help engineering see which fields lack data before the file goes out, and the free scan is a quick first look.
Sources
Last reviewed: 19 October 2026.
