Send a short, factual summary of what you do today, backed by two or three pieces of evidence, and be clear about what is in progress. A dependency inventory or SBOM, a description of your pull request checks and branch rules, and your update cadence usually answer the question. Do not claim certifications you do not hold.
What the customer really wants
A questionnaire item about third party code is a proxy for three questions. Do you know what is in your product? Would you find out quickly if a component was compromised? Can someone slip a change in without review? Answer those three plainly and most reviewers are satisfied.
The package to send
| Item | What to include |
|---|---|
| Summary | One page on inventory, alerts, installs, branch rules and ownership |
| SBOM | In CycloneDX or SPDX, if they ask, from your latest release |
| Evidence | A screenshot of branch rules, a sample alert decision record |
| Cadence | How often you update and review |
| Contact | A named person for follow up |
CISA describes an SBOM as a nested inventory of the components that make up software, and both CycloneDX and SPDX are open formats for it. Send what your customer's tooling reads. Ask which format they prefer before sending.
Sample wording
Write in specific, present tense statements. For example:
- We generate a software bill of materials for each release and review dependency advisories weekly.
- Changes to our main branch require review and passing checks.
- We install from committed lockfiles in CI.
- A named engineer owns supply chain security and reports monthly.
Only say what is true today. If a control is planned, say it is planned and give a quarter.
Honest limits
Say what you do not do. If you do not sign your releases or publish provenance, say so and that you are reviewing it. Buyers tend to trust a vendor who admits gaps more than one who claims everything. Do not describe a framework alignment as certification, and do not call an audit complete if it is in progress.
Words to avoid
- Fully secure, unhackable, or similar absolutes.
- Compliant with a standard, unless an independent party has said so.
- Any number you cannot source.
The NIST Secure Software Development Framework is a handy vocabulary for describing practices, but say you draw on it, not that you conform to it, unless you have assessed that.
Keep a reusable answer bank
Store the approved answers in one document with the date each was last checked. Update it each quarter. When a salesperson answers a questionnaire, they copy from the bank, and nobody improvises a claim. This also helps when the owner is away.
For broader context see how to answer how you vet new dependencies.
What if they ask for a scan report
Offer a summary of findings with your triage decisions, not a raw export. A raw list of hundreds of items causes alarm and questions. A table with decision and reason shows control.
Safeguard produces SBOMs and dependency scan results, and compliance and evidence automation can help assemble the package. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Do we have to send an SBOM?
Only if the customer asks or your contract requires it. Check the request, and confirm the format they want.
Can we say we follow a framework?
Say you draw on it if that is accurate. Do not claim conformance or certification without an independent assessment.
Sources
- CISA, Software Bill of Materials (SBOM)
- CycloneDX, Specification overview
- SPDX, About
- NIST SP 800-218, SSDF Version 1.1
Last reviewed: 19 October 2026.
