Check which version the customer runs now, send the SBOM that matches it, and explain what changed since the file you sent last time. If they are behind on versions, say so and offer the file for the version they run, plus the one they will move to.
Why customers ask at renewal
Renewal is a natural review point. A new security lead may join, a policy may have changed, or the previous SBOM is a year old. The CISA 2026 minimum elements say each software version or update should have an associated SBOM, so a file from last year describes last year's software.
Steps for the account owner
- Pull the last record. Look at the log from the earlier request: version, format, date, promises. See what to record about an SBOM request.
- Confirm the current version. Ask which release the customer runs today. Do not assume it is the latest.
- Match the file. Send the SBOM for that exact version. If you ship newer releases, offer that one too.
- Compare with the old file. Note components added, removed or upgraded. See how to diff two SBOMs.
- Explain corrections. If you issued a revised file since last time, say why.
- Offer a refresh path. State how new files will reach them, if you have agreed to that.
A summary the customer can read in a minute
| Item | Last time | Now |
|---|---|---|
| Product version | 3.8 | 4.2 |
| SBOM version | 1.0 | 1.0 for the new release |
| Components added | n/a | Listed in the file |
| Components removed | n/a | Listed in the file |
| Known gaps | Hashes missing for some | Updated in cover note |
Fill the table with real values from the two files. Do not describe changes in numbers you have not counted.
Offer a path, do not promise the world
Some customers want a new file for every release. The CISA text says a new release warrants a new SBOM, so the request is reasonable, but a delivery commitment is an operational decision. Agree it with engineering first. Possible answers include delivering on request, delivering via a version specific URL, or delivering through a portal. The CISA text lists a version specific URL, an API or a public repository as sharing options.
When the customer is on an old version
If they run something old, say so kindly and factually. Send the file for their version, and note any known issues fixed since. Avoid scaring them with a list of vulnerabilities. Point them to the upgrade path and your support period. See support periods and end of life dates.
Quick check
Should a renewal always include a new SBOM?
Only if the customer asks or the version changed. If nothing changed, you can confirm that the earlier file still applies, after checking with engineering.
Can we tie a fresh SBOM to the renewal price?
That is a commercial decision outside the sources. Do not tie accuracy of the data to commercial terms. Keep the two separate.
Safeguard's SBOM and dependency scanning can help keep the inventory current between renewals, and the free scan is a quick way to see where yours stands.
Sources
Last reviewed: 19 October 2026.
