Record who asked, for which product and version, in which format, what you sent, the file hash, the terms, any promise about updates, and the date for the next check. These nine fields let anyone on the team answer the customer's next question without asking engineering again.
Why log it at all
SBOM requests repeat. The same customer asks at renewal, or after a news story, or when a new security lead joins. If the last answer lives in someone's inbox, you start over. The CISA 2026 minimum elements say each version or update should have an associated SBOM and that errors should be corrected promptly. You cannot do either well without knowing what you sent to whom.
The nine fields
| Field | What goes in it |
|---|---|
| Request date and channel | Email, questionnaire, portal, call |
| Requester and role | Name, title, security or procurement |
| Product and version | Exactly as the customer runs it |
| Format and SBOM version | SPDX or CycloneDX, plus the SBOM version of the file sent |
| Generation context | Before build, after build or other |
| File reference and hash | Where the file is stored and its hash |
| Terms | Public, NDA, or the agreement that applies |
| Promises | Update schedule, correction commitments, anything said on a call |
| Next check date | When to confirm the customer still has the right version |
Optional fields that help
- Purpose. Inventory, scanning, audit, contract. It tells you what follow up to expect.
- Findings reply. Link to the response if the customer scanned the file. See how to reply to scanner findings.
- Revision history. Each revised file, its SBOM version and the reason. The CISA text says each version of an SBOM has a new timestamp.
- Redactions. Whether anything was withheld. The CISA text says the author should say whether information is unknown or withheld and have a process for recipients to ask.
Where to keep it
Use your CRM for the relationship view and your ticket system for the technical record, and link the two. Do not paste the SBOM itself into the CRM. Store it in controlled storage and keep the reference. Access to the CRM is usually broader than access to the SBOM.
Reports worth running
- Open requests older than your delivery tier. Set the tier first. See how fast to answer.
- Customers holding an SBOM for a version they no longer run.
- Requests with a promise attached and no follow up date.
- Requests that ended in a correction, grouped by cause.
Quick check
Should the hash of the file be in the CRM?
Yes, as a reference. It lets you prove later exactly which file you sent.
Who owns the CRM record?
The account owner, with engineering owning the technical fields in the ticket. Agree on this before the first request.
Safeguard's SBOM and dependency scanning can help engineering keep the underlying inventory current, and the free scan is a quick way to try it.
Sources
Last reviewed: 19 October 2026.
