--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # SBOM records and relationships in Third-party Risk Management # SBOM records and relationships in Third-party Risk Management {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of SBOM records and relationships in Third-party Risk Management This content explains how Software Bill of Materials (SBOM) data is managed within the Third-party Risk Management (TPRM) application in ServiceNow. It details the records, related lists, and relationships created when SBOM data is collected, how SBOM submissions are tracked, and their connection to engagements and third parties. The focus is on helping customers understand how to handle SBOM submissions, monitor their status, and link SBOM components to risk assessments and third-party records. Show full answer Show less ## SBOM Document and BOM Components Tracking * **SBOM Document Related List (Engagement):** Each engagement record includes a related list showing every SBOM submission attempt, whether successful or failed. Submissions must be in JSON or XML formats; unsupported formats cause parse errors and failed entries. All submission attempts create separate SBOM document records, preserving historical data. * **BOM Components Related List (Engagement):** This list displays all individual BOM component records derived from submitted SBOM files for the engagement. Components represent libraries or dependencies declared in the SBOM. When vulnerability response applications are present, vulnerability details may be visible per component, though severity is not summarized at the engagement or third-party level. ## Data Model and Relationships SBOM data is linked through multiple relationships to maintain traceability and context within TPRM workflows: * **Engagement to SBOM Document:** A many-to-many (M2M) relationship links engagements to their SBOM documents. * **SBOM Document to Source Assessment:** Each SBOM document records the Smart Assessment Engine (SAE) instance that triggered the upload, enabling tracking of submission origin. * **SBOM Document to BOM Entity:** The parsed SBOM file creates a parent BOM entity record representing the entire SBOM document. * **BOM Entity to BOM Components:** Each BOM entity contains child BOM component records for individual software libraries or dependencies. * **BOM Component to Third Party:** Components can associate with third parties via product model manufacturer references, linking to core company records. * **Engagement to BOM Components:** Components are accessible through the chain from engagement to SBOM document to BOM entity to components, but only when SBOMs are collected through TPRM workflows (not via the standalone SBOM workspace). ## Work Notes and Processing Tracking Work notes on external assessments provide a detailed processing log of SBOM submissions, including status updates such as queued, processed successfully, errors with reasons, or third-party declines. This facilitates transparency and troubleshooting during SBOM data ingestion. ## SBOM Questionnaire Template and Automation * **Questionnaire Template:** ServiceNow provides a default SBOM questionnaire configured as an external TPRM questionnaire with scoring disabled. It includes questions about SBOM availability, disclosure preferences, and file upload when applicable. Customers can customize this template to fit their internal processes. * **Post-Assessment Automation:** A Flow Designer subflow automates handling after questionnaire submission. It sends files to the SBOM API, updates record statuses, creates necessary relationships, logs errors for resubmission, and records responses if third parties decline to provide SBOMs. ## Practical Implications for ServiceNow Customers * Customers can efficiently collect, track, and manage SBOM submissions as part of third-party risk assessments. * Historical submission records are retained, enabling auditability and review of past SBOM data. * Integration with vulnerability response applications allows component-level vulnerability insights. * Automated workflows reduce manual effort in processing SBOM data and managing assessment outcomes. * Customization options for questionnaires support alignment with organizational policies on SBOM disclosure. The records, related lists, and relationships created when you collect SBOM data in Third-party Risk Management, and how those records relate to engagements and third parties. ## SBOM document related list (engagement) {#tprm-sbom-relationship__tprm-sbom-ref-sbom-doc-rl} The SBOM document related list appears on the engagement record and tracks each SBOM submission attempt for that engagement. Separate entries are created for successful and failed uploads. Successful processing depends on whether the submitted file conforms to a supported SBOM schema and can be parsed by the SBOM API. Supported formats are JSON and XML. Files submitted in any other format return a parse error and a new entry is created in this list to record the failed attempt. Each submission attempt creates a separate SBOM document record. Previously submitted documents are retained and not replaced or removed. Note: Third-party assessment reviewers can view records in the SBOM document related list and the BOM components related list on the engagement and third-party records. Reviewers do not have access to the SBOM workspace. {#tprm-sbom-relationship__table-sbom-doc-fields__entry__2} | Field | Description | |-|-| | Format | The declared file format of the SBOM submission, for example, JSON or XML. | | Version | The version declared in the SBOM file. | | Status | The processing status of the submission, for example, queued, processed successfully, or error. | | Source assessment | The assessment instance that triggered the SBOM upload. | [Table 1. SBOM document related list fields] {#tprm-sbom-relationship__table-sbom-doc-fields} ## BOM components related list (engagement) {#tprm-sbom-relationship__tprm-sbom-ref-bom-components-rl} The BOM components related list on the engagement record shows all BOM component records generated from SBOM files collected for that engagement. Each component represents a declared library or dependency from the submitted SBOM. If the SBOM Response and ITSM Vulnerability Response applications are available, vulnerability-related columns may appear at the individual component level. Vulnerability severity is not rolled up to the engagement or third-party level. ## Data model and record relationships {#tprm-sbom-relationship__tprm-sbom-ref-data-model} This table describes how SBOM records relate to each other and to TPRM records after a successful upload. {#tprm-sbom-relationship__table-sbom-data-model__entry__2} | Relationship | How it works | |-|-| | Engagement → SBOM document | An M2M table (`sn_vdr_risk_asmt_m2m_engagement_sbom_doc`) links each engagement to the SBOM documents collected for it. | | Engagement SBOM document → Smart assessment instance | The M2M table also links to the SAE assessment instance (`sn_smart_asmt_instance`) that triggered the SBOM upload. This relationship is surfaced as the Source assessment field on the SBOM document record. | | SBOM document → BOM entity | When the SBOM API parses a file, it creates a parent BOM entity record representing the submitted SBOM document as a whole. | | BOM entity → BOM components | Each BOM entity has one or more child BOM component records representing individual libraries and dependencies declared in the SBOM. | | BOM component → third party | BOM components can be associated with a third party through the product model relationship. The product model manufacturer field can reference a `core_company` record. | | Engagement → BOM components | Components are surfaced on the engagement through the relationship chain: engagement → SBOM document → BOM entity → BOM components. | [Table 2. SBOM data model relationships] {#tprm-sbom-relationship__table-sbom-data-model} Note: The SBOM workspace has no engagement concept. Engagement-level linkage occurs only when SBOMs are collected through the TPRM workflow. SBOM files uploaded directly into the SBOM workspace do not appear in engagement-level related lists. ## Work notes tracking {#tprm-sbom-relationship__tprm-sbom-ref-worknotes} Work notes on the external assessment provide a running log of SBOM processing activity. Examples include: * Queued for processing --- written when the submission is sent to the SBOM API. * Processed successfully --- written when the SBOM API confirms successful parsing. * Error message --- written when parsing fails, including the reason returned by the SBOM API. * Third-party declined --- written when the engagement contact selects a No response option. {#tprm-sbom-relationship__ul_pqb_csn_fjc} ## SBOM questionnaire template {#tprm-sbom-relationship__tprm-sbom-ref-template} The SBOM questionnaire template is provided by ServiceNow and is configured as a TPRM external questionnaire with scoring disabled. The template includes these questions: 1. Can you provide an SBOM? * Yes * No, we do not generate SBOMs. * No, we do not disclose SBOMs outside the company. * No, other. (Please explain.) {#tprm-sbom-relationship__ul_rqb_csn_fjc} 2. Upload your SBOM file. This question appears only when the response to question 1 is Yes. {#tprm-sbom-relationship__ol_qqb_csn_fjc} You can modify the questionnaire template to meet internal requirements. ## Post-assessment automation {#tprm-sbom-relationship__tprm-sbom-ref-automation} A subflow in Flow Designer handles post-assessment actions when an SBOM questionnaire is submitted. The subflow performs these actions: * Sends the uploaded file to the SBOM API. * Tracks the `sn_bom_doc` record status. * On success, creates the engagement-to-SBOM relationship and updates assessment activity. * On error, records the error message and enables resubmission. * On third-party decline, records the response and closes the assessment. {#tprm-sbom-relationship__ul_sqb_csn_fjc} **Related concepts** * [Exploring software bill of materials collection](https://www.servicenow.com/docs/D5HKQ8~8LGj40YZyW_mXww "Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.") * [Collecting software bill of materials](https://www.servicenow.com/docs/tKBQ5MvyeX~S5Dq2WfvExQ "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.") **Related tasks** * [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/m2u04m24uAeK0oZbM8hAKw "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.") * [Review an SBOM submission from an engagement](https://www.servicenow.com/docs/jG3yj_LCt3V0evQEVR89Yg "Track processing status and review the outcome of a SBOM submission from an engagement, including successful upload, failed upload, and decline.") * [Activate SBOM support](https://www.servicenow.com/docs/DNVHdQMYI_hGoTSiXmMM9w "Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM).")