Sales can handle a standard request for one released version in a common format. Escalate to engineering when the request involves a format you do not produce, an unreleased version, a claim of missing components, or a contract term. Escalate to legal when access terms or liability language appear.
Why a triage list helps
Most SBOM requests are routine. A few carry risk: a promise nobody can keep, a file that leaks internal detail, or a contract clause that commits the company to a schedule. A short list lets a salesperson tell the difference in a minute.
The triage table
| Request | Who handles it |
|---|---|
| One released version, SPDX or CycloneDX, no special terms | Sales or customer success, with a standard file from engineering |
| Format you do not usually produce | Engineering |
| Version that is unreleased or no longer supported | Engineering |
| Customer says a component is missing or wrong | Engineering, same day |
| Customer scanned the SBOM and sent findings | Engineering and security |
| Request for updates on a schedule | Engineering and the account owner |
| Contract language on access, reuse or timing | Legal, with engineering input |
| Request tied to a regulator or audit | Security lead and legal |
Escalation triggers in plain words
Escalate when any of these appear.
- The customer names a regulation, a contract clause or an audit. Reference the exact text and do not paraphrase it from memory.
- The customer asks for something recurring, such as a file with every release. The CISA 2026 text says each version or update should have an associated SBOM, so a recurring ask is reasonable, but the commitment belongs to engineering and the account owner.
- The customer says the SBOM is wrong. The CISA text says SBOM authors should correct errors promptly, so treat this as time sensitive.
- The customer asks for hashes, signatures or generation context. These are elements in the 2026 list, and only engineering can say what the file contains.
- The customer asks you to hide or share something unusual, such as internal package names. The CISA text expects the author to say whether information is unknown or withheld, and to have a process for recipients to ask about redactions.
What to include in the escalation
Send the customer's exact words, the product and version, the format, the deadline, the recipient and any contract text. Do not summarise from memory. A good template is in what an engineering ticket for an SBOM request should contain.
What stays with sales
Sales owns the relationship, the date and the tone. Engineering owns the content of the file. If the two disagree, the date goes to the customer only after engineering agrees.
Quick check
Can sales send an SBOM from last quarter?
Only if it matches the version the customer runs and engineering confirms it is still accurate. The CISA text says new builds and corrections both warrant a new SBOM.
Who decides whether to share the SBOM publicly?
That is a company policy decision, usually owned by security and legal. NTIA's 2021 report notes some suppliers prefer public access and others limit it to specific customers.
Safeguard's SBOM and dependency scanning can give engineering a current inventory to work from, and the free scan is a quick way to try it.
Sources
- 2026 Minimum Elements for a Software Bill of Materials (SBOM), CISA and partners, 29 July 2026
- The Minimum Elements For a Software Bill of Materials (NTIA, 2021)
Last reviewed: 19 October 2026.
