Say yes to the request, then ask four things: which product and version, which format their tools read, what they will do with it, and who should receive it. Give a delivery date in the same message. A clear first reply keeps the deal moving and stops guesswork later.
Why the first reply matters
An SBOM request often lands in an inbox with one line: "Please send your SBOM." That line can mean a single file, a file for every release, or a contract term. If the first reply is vague, the second and third messages burn days.
CISA's 2026 minimum elements say each software version or update should have an associated SBOM, and that SBOMs should be available promptly to those who need them. Those two ideas shape a good first reply: be specific about which version, and be quick.
The four questions
| Ask | Why it helps |
|---|---|
| Which product and version do you run? | The SBOM belongs to one version. Sending the wrong one creates rework. |
| Which format do your tools read? | SPDX and CycloneDX are the two widely used formats named in the CISA text. |
| What will you use it for? | Inventory, vulnerability matching and audit evidence need different cover notes. |
| Who should receive it and how? | Access rules and delivery channel depend on the answer. |
A template you can adapt
Keep it short and plain.
Thanks for asking. We can provide an SBOM for the version you run. To send the right file, can you confirm the product and version, the format your tools read (SPDX or CycloneDX), and who on your side should receive it? We will send it by [date]. If your team plans to scan it, tell us which scanner so we can reproduce any findings.
Replace the date with one you can meet. The sources do not set a response time, so pick a target your team can hit every time.
What not to do in the first reply
- Do not attach a file before you know the version. The customer may run an older release.
- Do not promise "all vulnerabilities fixed." An SBOM lists components. It does not say whether any are exploitable.
- Do not ask for an NDA as the first move unless your policy requires it. Ask what they need first, then decide on terms.
- Do not copy the request into five internal channels. Name one owner.
Who owns the reply
Sales or customer success sends the first message. Engineering generates and checks the file. The role split is explained in who owns SBOM and VEX requests. For the engineering side of the handoff, see what an engineering ticket for an SBOM request should contain.
Try it yourself
Open the demo to see what an inventory looks like once it is generated. Look at how direct and indirect components are listed with versions, because that is what your customer will read.
Click through it at your own pace, or open it full screen.
Quick check
Should the first reply include the SBOM itself?
Only if you already know the exact version and format. Otherwise confirm those first, since each SBOM describes one version.
What if the customer does not know their format?
Offer both widely used formats, or ask which tool they plan to load it into. The CISA text says organizations should accept any widely used, interoperable and machine processable format.
Safeguard's SBOM and dependency scanning can help engineering produce the inventory behind your answer, and the free scan lets you see a first pass on your own code.
Sources
Last reviewed: 19 October 2026.
