--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Collecting software bill of materials # Collecting software bill of materials {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Collecting software bill of materials A software bill of materials (SBOM) is a detailed inventory listing the components, libraries, and dependencies included in a software product, provided by the software vendor. Within ServiceNow's Third-party Risk Management (TPRM), SBOM collection is integrated into the due diligence process to help risk teams review and assess potential risks associated with third-party software components. Show full answer Show less SBOM files must adhere to industry-standard formats like CycloneDX or SPDX, typically in JSON or XML. The ServiceNow platform facilitates collection, parsing, and association of SBOM data but does not generate or edit SBOM files itself. ## SBOM Collection Process in Third-party Risk Management * SBOM collection is triggered via the third-party due diligence request form by selecting the SBOM required field. * An SBOM questionnaire template is sent to the vendor as part of the engagement-level external assessment through the third-party portal. * Upon submission, the uploaded SBOM file is processed by the Unified Security Exposure Management (USEM) API, parsed, and linked to the relevant engagement and third-party records. * Users with roles such as third-party risk assessor, manager, and administrator can access the SBOM workspace to upload or update manufacturer data. Reviewers can view component records but do not have workspace access. * Editing manufacturer data requires additional permissions on the CMDB product model table. ## Key Limitations * SBOM collection supports only the Smart Assessment Engine (SAE) engagements, not classic assessments. * Collection occurs only at the engagement level, not directly at the third-party level. * Supported file formats are JSON and XML; other formats cause parse errors and require resubmission. * Supported workflows include onboarding, renewal, and reassessment; offboarding is not supported. * SBOM data does not automatically affect the overall TPRM risk score but can be configured to do so. * Relationships between SBOM components and sub-vendors or sub-processors are not automated; only the software manufacturer is referenced. ## Feature Availability and Requirements * SBOM functionality requires separate procurement and installation of specific ServiceNow applications from the ServiceNow Store. * Essential applications include Security Support Common, Data Model for SBOM, and SBOM Core. * To view vulnerability details linked to SBOM components, additional applications such as SBOM Response and Vulnerability Response are needed. * Some SBOM features require further configuration after installation to activate full support. ## Practical Benefits for ServiceNow Customers Integrating SBOM collection into your third-party risk assessments enables comprehensive visibility into the software components your vendors use, thereby improving your ability to identify and manage supply chain risks. By leveraging standardized SBOM data formats and automated parsing through USEM, organizations can streamline due diligence workflows without disrupting existing processes. This capability supports informed decision-making around vendor risk and security posture while maintaining flexibility through configurable risk scoring and component relationships. A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process. ## SBOM overview {#tprm-sbom__tprm-sbom-concept-overview} A software bill of materials (SBOM) is a structured inventory file generated by a software vendor that lists the components, libraries, and dependencies used in a product. Risk teams can use SBOM data to review declared components and assess potential exposure associated with those components. Parsed SBOM data can be viewed in TPRM or in Unified Security Exposure Management (USEM) (Unified Security Exposure Management). For more information about SBOM collection in Third-party Risk Management, see [Exploring software bill of materials collection](https://www.servicenow.com/docs/D5HKQ8~8LGj40YZyW_mXww "Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved."). SBOM files follow industry-standard formats and must conform to a supported SBOM standard, such as CycloneDX or SPDX. Vendors typically provide SBOM files in JSON format. XML formats are also supported. If a third party uploads a file in any other format, such as PDF or Word, the system returns a parse error. For details on preparing and formatting SBOM files, see the [Unified Security Exposure Management (USEM) SBOM documentation](https://www.servicenow.com/docs/r/security-management/sbom-core/vr-sbom-preparing-upload.html). Note: The vendor generates and maintains SBOM files using their own tooling. The ServiceNow platform does not create or edit SBOM files. Third-party Risk Management collects, parses, and links the submitted file to related records. ## SBOM collection in Third-party Risk Management {#tprm-sbom__tprm-sbom-concept-how-it-works} SBOM collection occurs during third-party due diligence. The SBOM required field on the third-party due diligence request form indicates when SBOM collection is required for an engagement. When selected, the system associates an SBOM questionnaire template with the external assessment for that engagement. The questionnaire is sent to an engagement contact through the third-party portal as part of the engagement-level external assessment. No additional assessments or alternate workflows are introduced as part of this process. When the assessment is submitted, post-assessment processing sends the uploaded file to the SBOM API, provided by Unified Security Exposure Management (USEM) (Unified Security Exposure Management). Parsed SBOM component records are then associated with the relevant engagement and, where applicable, the related third-party record. The outcome of processing depends on the third party's response. For details on each response path, including error handling and third-party decline, see [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/m2u04m24uAeK0oZbM8hAKw "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact."). For troubleshooting API processing issues, see the [Unified Security Exposure Management (USEM) SBOM documentation](https://www.servicenow.com/docs/r/security-management/sbom-core/vr-sbom-preparing-upload.html). The third-party risk assessor, third-party risk manager, and third-party administrator roles can access the SBOM workspace and upload or update manufacturer data. Third-party assessment reviewers can view SBOM component records on the engagement and third-party records but don't have access to the SBOM workspace. Internal reviewers don't have access to the SBOM workspace. Note: Users with access to the SBOM workspace also require edit access to the CMDB product model table to update the manufacturer field. ## Limitations {#tprm-sbom__tprm-sbom-concept-scope} The following constraints apply to SBOM collection: * Smart Assessment Engine (SAE) only: SBOM collection is supported only for engagements that use the Smart Assessment Engine. This feature does not support classic assessments. * Engagement-level collection: The SBOM questionnaire is associated with the engagement-level vendor risk assessment. This feature does not support collection at the third-party level directly. * Supported file formats: JSON and XML are supported. Submitting a file in any other format returns a parse error and reopens the assessment for resubmission. * Supported workflows: onboarding, renewal, and reassessment workflows are supported. For renewal and reassessment engagements, existing SBOM records can be updated rather than fully re-uploaded. This feature does not support offboarding. * Risk scoring behavior: information derived from SBOM components is not incorporated into the overall Third-party Risk Management risk score by default. Organizations can configure this behavior. * Component-to-vendor relationships: SBOM components reference the software manufacturer through the product model record. Automated relationships to sub-vendors or sub-processors are not established. {#tprm-sbom__ul_ccz_s5n_kjc} ## Feature availability {#tprm-sbom__tprm-sbom-concept-licensing} Availability of SBOM- related functionality depends on activated applications and configuration. The core due diligence workflow operates independently of SBOM processing. SBOM collection capabilities are procured separately from Third-party Risk Management. All required applications are available from the ServiceNow Store and must be installed individually. The following applications are required to collect and process SBOM files: * Security Support Common (com.snc.security_support.common), a soft dependency that must be installed before the other required SBOM applications * Data Model for SBOM (com.snc.sbom_dm) * SBOM Core (com.snc.sbom_core) {#tprm-sbom__ul_dcz_s5n_kjc} The following additional applications are required to view vulnerability details associated with SBOM components: * SBOM Response (com.snc.sbom_resp) * Vulnerability Response (com.snc.vulnerability) {#tprm-sbom__ul_ecz_s5n_kjc} Note: Some SBOM capabilities require additional configuration after installation. For more information, see [Activate SBOM support](https://www.servicenow.com/docs/DNVHdQMYI_hGoTSiXmMM9w "Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM)."). **Related concepts** * [Exploring software bill of materials collection](https://www.servicenow.com/docs/D5HKQ8~8LGj40YZyW_mXww "Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.") **Related tasks** * [Activate SBOM support](https://www.servicenow.com/docs/DNVHdQMYI_hGoTSiXmMM9w "Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM).") * [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/m2u04m24uAeK0oZbM8hAKw "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.") * [Review an SBOM submission from an engagement](https://www.servicenow.com/docs/jG3yj_LCt3V0evQEVR89Yg "Track processing status and review the outcome of a SBOM submission from an engagement, including successful upload, failed upload, and decline.") **Related reference** * [SBOM records and relationships in Third-party Risk Management](https://www.servicenow.com/docs/9ycIyON5lxlYjnJWbhXaKQ "The records, related lists, and relationships created when you collect SBOM data in Third-party Risk Management, and how those records relate to engagements and third parties.")