Ask for four things: a current SBOM for the version you will run, any VEX statements issued since the last one, a short note on what changed in the component list over the term, and a written update commitment. Renewal gives you a natural timing that mid-term requests lack, so use it once.
Why renewal is the moment
Most SBOM requests happen at onboarding. By renewal, the file you hold may be a year old. The NTIA minimum elements report says a new SBOM should be created when a component is updated with a new build or release, so a year of releases should have produced several.
Renewal also puts the supplier in a mood to be accommodating. Procurement conversations are already open, and a clear, small request fits into them.
The four requests
- A current SBOM for the version you will run. Not the latest marketing release, the one in your environment. Ask for the build date.
- VEX statements. CISA describes VEX as an attestation that indicates whether a product is affected by known vulnerabilities. If the supplier issues them, ask for those relevant to your version.
- A change summary. Which components were added, removed or upgraded since the SBOM you hold. You can produce this yourself by comparing the two files, but the supplier's explanation of why is useful.
- An update commitment. How often will you receive new SBOMs, and how will you be notified of corrections?
Do your own homework first
Before asking, compare the old SBOM with whatever you can see today. If you have scanned the deployed software, note differences. Arrive with specifics.
| Prepare | Why |
|---|---|
| Old SBOM and date received | Baseline for the diff |
| Any open questions from the last review | Close them at renewal |
| Incidents involving this supplier | Context for the conversation |
| The tier you assigned the supplier | Sets how much to ask |
What to do with the answers
If the new SBOM shows major changes, such as a new database driver or a different cryptography library, send them to the technical owner before signing. If the supplier cannot provide an update, record that as a finding in your vendor file. It does not need to block renewal, but it should be a conscious decision with a name against it.
A note on contract language
If you want SBOM delivery written into the agreement, ask your legal team how to phrase it. This post covers the technical request, not contract terms. The NTIA report says access control and delivery terms can be specified through licensing or contracts, and are outside the document itself.
Quick check
Should we require an SBOM before renewing?
That is a business decision for you and your counsel. Technically, asking is reasonable, and recording a refusal is useful either way.
What if the supplier says the old SBOM is still fine?
Ask for the date it was made and the version it covers. If the product has had releases since, a newer file should exist.
If you want a quick look at a received file, Safeguard's free scan is at gold.safeguard.sh/scan.
Sources
- The Minimum Elements For a Software Bill of Materials (SBOM), NTIA
- Software Bill of Materials (SBOM), CISA
Last reviewed: 19 October 2026.
