An Enterprise Customer Asked for an SBOM: What a Small SaaS Vendor Should Check Before Sending It
Published August 2026 by Solarc Labs
Start by confirming which product and release the customer is asking about
An SBOM is useful only when the recipient can tell what software it describes. Before sending anything, confirm the product, edition or deployment boundary, the release or build the customer is evaluating, and whether the request is for a current procurement review or an ongoing delivery commitment. CISA and NTIA guidance treats SBOM exchange as a supply-chain workflow between software suppliers and consumers, including procurement and delivery use cases. That makes product identity and version context part of the handoff, not administrative detail to add later.
Validate the artifact before treating “we generated an SBOM” as the answer
Check that the file is the supported format and version you intend to provide, that it parses cleanly in the receiving workflow you support, and that key component identifiers and relationships are present rather than silently dropped. Preserve the exact artifact and its product/build reference so a later review can identify what was actually sent. CISA resource guidance distinguishes having an SBOM from validating and using it. A machine-readable file can exist and still be incomplete, stale, mismatched to the requested release or unsuitable for the customer’s stated job.
Review licence evidence without turning the result into legal clearance
Enterprise procurement may use SBOM data for several jobs, including licence review, supply-chain risk and vulnerability analysis. Those jobs should remain separate. If your immediate task is open-source licence review, normalize the supported components, surface known licence expressions, route unknown or policy-sensitive cases to a human and record the disposition. Do not convert that review into a legal opinion that every licence obligation has been satisfied. Likewise, a licence-focused pass does not prove that the product is vulnerability-free or that every component is safe to use.
Decide the sharing method and update expectation explicitly
SBOMs can be delivered through a contractual procurement process, customer portal, direct supplier handoff or another agreed mechanism. There is no reason to make every SBOM public merely because one customer requested it. Choose a delivery method that matches the commercial and security context, and make clear whether the artifact is a one-time snapshot or part of a versioned update process. If the customer expects a new SBOM for each release, document that operating commitment. If the request is for one procurement review, avoid accidentally promising continuous maintenance that the current process cannot support.
Answer the customer’s real follow-up questions from evidence, not from the filename
A procurement reviewer may ask whether a component is affected by a vulnerability, whether a licence needs special treatment, whether the SBOM covers the deployed build, or how changes will be communicated later. The SBOM is evidence for those questions, not the answer to all of them by itself. Keep the source artifact, licence disposition, vulnerability or VEX evidence, product identity and customer-facing response as separate layers. That makes it possible to update one conclusion later without rewriting what the original SBOM contained.
SBOM Risk Pack is a bounded review of an existing customer-provided SBOM
SBOM Risk Pack starts from one existing supported CycloneDX or SPDX JSON SBOM, normalizes the components it can understand, applies deterministic licence-policy states and sends ambiguous cases to human review. The output is a provenance-backed evidence pack for the reviewed input. It does not clone or execute source code, generate an SBOM from an arbitrary repository, provide legal licence clearance, run a vulnerability scanner or certify CRA compliance. Those boundaries keep the procurement handoff honest about the job that was actually performed.
Primary sources
Sources used for this article
Continue the job