Dev.to Security 🔐 Cybersecurity Sun, 15 Nov 2026 00:43:21 +0000 👁 0 📖 5 min read

Ask a Vendor for an SBOM

CISA’s 2026 minimum elements apply to SaaS and AI software. Ask for the fields, the format, and the date. A slide is not a bill of materials. Edited by Emilio Santos. October 1, 2026. Updated October 24, 2026.

CISA’s 2026 minimum elements apply to SaaS and AI software. Ask for the fields, the format, and the date. A slide is not a bill of materials.

Edited by Emilio Santos. October 1, 2026. Updated October 24, 2026.

Who this is for

The person who signs a software renewal and the person who has to answer a customer security review.

The fields

CISA’s release names four additions on top of the older baseline: component hash algorithm, component license, the name of the tool that generated the SBOM, and the context in which it was generated. Ask for those by name. Also ask for the component names and versions the document is built to carry. If a field is missing, the reply is incomplete against the 2026 list, even if the PDF looks thick.

The ask

Machine-readable, not only a PDF. Say CycloneDX or SPDX if you already consume one of those. If you do not, still refuse a screenshot.
The generation date, and how often a new file is produced. A file from the year the product launched is a souvenir.
Whether hosted software is in scope. CISA says SaaS is in scope for the minimum elements. “We are a cloud app” is not an answer.
Who will send an updated file after a critical component changes, and on what clock.

What fails

Reply	Treat it as
“We are SOC 2”	A different document
A logo slide of “trusted components”	Not an SBOM
A list with no license and no hash algorithm	Short of the 2026 elements
“Legal will not share our ingredients”	A commercial position you can price

Why it is worth asking

An SBOM is a list of the components inside a piece of software. When a serious vulnerability is announced in a common library, the companies that can answer “do we use this, and where?” in an hour are the ones with SBOMs from their vendors. The rest send emails and wait. The NTIA’s 2021 minimum elements set the original baseline: supplier name, component name, version, other unique identifiers, dependency relationships, the author of the SBOM data, and a timestamp. CISA’s 2026 update builds on that list with the four additions above.

The SBOM is also a signal. CISA’s Secure by Demand guide, published with the FBI in August 2024, lists the SBOM among the artifacts a customer can collect to judge whether a vendor builds security into its products. A vendor that can produce one quickly usually has its build process under control.

How to make the request, step by step

Pick the products. Start with software that is internet-facing, handles sensitive data, or runs with high privilege. You do not need SBOMs for everything on day one.
Write the ask in the contract or renewal. Name the 2026 minimum elements, the format (CycloneDX or SPDX), the update frequency, and the time to deliver a new file after a critical component change.
Decide who receives it. A named security contact, not a shared inbox nobody reads.
Check the first file. Open it with a tool or at least a text editor. Confirm it has versions, licenses, a hash algorithm, the generating tool, and a date.
Use it once. The next time a major library vulnerability is announced, search your SBOMs for it. That test tells you whether the files are worth keeping current.

A worked example

Illustrative case. Your company renews a document management product. The order form now says: “Supplier will provide a machine-readable SBOM in CycloneDX or SPDX format meeting CISA’s 2026 minimum elements within 30 days of signature, an updated SBOM with each major release, and an updated SBOM within 10 business days of remediating a critical vulnerability in a third-party component.” The vendor agrees to the first two and pushes back on the third. You settle on 15 business days. That is a real improvement over no clause at all, and it is in the contract rather than in a sales email.

The SBOM request pack builds this request, and the software renewal scorecard counts a missing SBOM against the renewal.

Limits to keep in mind

An SBOM shows what is inside, not whether each component is exploitable in that product. Pair it with the vendor’s vulnerability disclosure policy and, where available, statements on whether a given vulnerability affects the product. It also does not replace patching. It tells you where to look faster.

Before you sign off

The products in scope are listed, starting with internet-facing and high-privilege software.
The contract names the 2026 minimum elements, a format, an update frequency, and a delivery clock after a critical fix.
A named person receives the files and checks the first one.
You have searched the files at least once for a real vulnerability.
Refusals are recorded and priced into the renewal.

If the product includes a model or agent, add the questions in Extra SBOM questions for AI products.

FAQ

Does CISA require my vendor to send this?

The July 2026 document is guidance on minimum elements. Your leverage is the contract. If the order does not ask for the file, you will not get the file.

Is an SBOM a vulnerability report?

No. It is an ingredient list. You still need a way to compare those ingredients to the vulnerabilities you care about.

What about AI features?

Ask for this general SBOM and for the May 12, 2026 AI supplement. They are not substitutes.

Sources

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home