SBOM readiness checklist

How to use the assessment

Choose one product family or business unit. Mark a control evidenced only when you can point to the relevant artifact, test or approved process. Record an owner and target date for gaps. A documented exception is different from an implemented control.

Use the CSV for a retained assessment. The checkboxes below are a temporary browsing aid and do not persist after a page reload. Print the page to retain a working copy. The completion count is a tally, not a risk score or statement of legal compliance.

0 of 36 controls checked

Governance

Name an accountable SBOM program ownerEvidence: Approved responsibility mapIdentify product security, engineering, procurement and compliance rolesEvidence: Named owners for generation, intake and responseDocument applicable authorities and contractsEvidence: Versioned applicability register

Scope

Inventory supported products and releasesEvidence: Product catalog with support stateMap deployed assets to software versionsEvidence: Reconciled asset-to-release sampleDocument artifact variants and generation boundariesEvidence: Artifact/architecture/configuration register

Generation

Select methods for source, build, binary and container coverageEvidence: Method-to-artifact mapTest transitive and vendored component coverageEvidence: Reference corpus resultsCapture first-party and licensed softwareEvidence: Attributed manual/supplier evidencePin generator versions in CI/CDEvidence: Version-controlled job configuration

Formats

Agree exact accepted formats and versionsEvidence: Named intake profileTest conversion and extension lossEvidence: Round-trip report

Quality

Run independent schema validationEvidence: Validator results tied to artifact digestTest component and version correctnessEvidence: Identity findings with evidenceValidate dependency graph referencesEvidence: Graph result and reviewed exceptionsCompare against independent reference contentsEvidence: Coverage findingsRecord unknown and withheld informationEvidence: Exception queue with owner/date

Supplier

Specify supplier delivery and correction commitmentsEvidence: Contract or agreed delivery profileAuthenticate and safely parse supplier artifactsEvidence: Intake test resultsAssign correction ownership and target datesEvidence: Supplier issue workflow

Lifecycle

Bind inventories to exact product releasesEvidence: Release-to-artifact evidenceRetain original and normalized dataEvidence: Retrievable paired recordsMaintain correction and supersession lineageEvidence: Tested revision chain

Security

Test read/write/export/delete rolesEvidence: Least-privilege permission resultsProtect private component informationEvidence: Documented sharing and confidentiality policyVerify integrity and authorship where applicableEvidence: Signature/trust findings

Risk

Map advisory sources and refresh coverageEvidence: Feed coverage and staleness thresholdsDistinguish candidate matches and applicability decisionsEvidence: Assessment sampleDefine VEX trust and reevaluationEvidence: Policy and revised-statement testRoute remediation to product ownersEvidence: Ticketing integration result

Operations

Rehearse an affected-release incident queryEvidence: Verified exposure listMonitor failed ingestion and stale mappingsEvidence: Alerts with owner and response targetDefine retention and deletionEvidence: Approved retention scheduleTest full export and recoveryEvidence: Independent reconstruction and restore results

Procurement

Identify gaps in existing SCA/DevSecOps toolingEvidence: Gap assessmentDefine pilot acceptance and all pricing metersEvidence: Approved tests and usage scenarios

Choose the next improvement

Group gaps into inventory quality, release mapping, ownership, integration and purchasing. Address dependencies in that order where practical: a risk dashboard cannot compensate for unknown installed versions. A failed export test should influence architecture and contract terms before launch.

For an early program, a good milestone is one internal product and one supplier product with validated inventories, named owners and a completed incident drill. For a mature program, examine historical releases, exceptions, stale intelligence and recovery.

Download and retain the evidence

UNGATED WORKBOOK · CSV

Readiness assessment

36 controls with evidence, owner, status, target date and next-action fields.

Download CSV

Record the scope and assessment date when using the file. Keep evidence references accessible to the reviewers who will approve the resulting action plan. Reassess after major changes to products, suppliers, receiving systems or applicable obligations.

Primary sources

CISA and partners · 2026 Minimum Elements (ACSC publication)Published government guidance
NIST · SSDF 1.1, SP 800-218Final government guidance