---
sourceDocument: Brazil Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Software bill of materials (SBOM)

# Exploring software bill of materials collection {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Exploring software bill of materials collection

Third-party Risk Management (TPRM) in ServiceNow enables the collection of Software Bill of Materials (SBOM) files as part of the due diligence process for third-party engagements.
An SBOM is a detailed inventory listing the components, libraries, and dependencies in software products, typically provided in JSON or XML format by third parties.
This capability is supported only for engagements using the Smart Assessment Engine (SAE), not classic assessments.
Show full answer Show less  

## Key Features

* **SBOM Collection Workflow:** When SBOM collection is required, the system automatically attaches an SBOM questionnaire template to the engagement's external assessment. Third-party contacts upload SBOM files via the portal, which are then processed by the Unified Security Exposure Management (USEM) API. Valid files are parsed and linked to engagement and third-party records; invalid files trigger reassessment, and declines close the assessment.
* **User Roles and Access:**
  * **Third-party risk assessors and managers:** Can send assessments, review SBOM submissions, parsed component records, and vulnerability details, and access the SBOM workspace.
  * **Third-party administrators:** Manage access and permissions related to SBOM collection.
  * **Third-party assessment reviewers:** Can view SBOM component records but do not have workspace access.
  * **Third-party contacts:** Upload SBOM files through the portal on behalf of their organization.
* **Integration with Vulnerability Response:** When SBOM Response and Vulnerability Response applications are installed, assessors and managers can access vulnerability details linked to SBOM components.
* **Configurable Collection Triggers:** The system can be configured to trigger SBOM collection based on specific evaluations or conditions.

## Benefits

* Incorporate SBOM data collection directly into third-party due diligence workflows, improving transparency into software supply chains.
* Enable risk assessors and managers to evaluate software components and associated vulnerabilities efficiently within the engagement context.
* Improve risk evaluation accuracy by associating parsed SBOM data with related third-party records and assessments.

## Next Steps for ServiceNow Customers

To leverage SBOM collection in TPRM, customers should:

* Activate SBOM support applications.
* Understand how to request and collect SBOM files during due diligence.
* Review and analyze SBOM submissions and parsed component records.
* Explore how SBOM data integrates with vulnerability management for comprehensive risk assessment.  

Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.

## SBOM overview {#tprm-sbom-exploring__cf-exploring-parent-overview}

A software bill of materials is a structured inventory file generated by a software vendor that lists the components, libraries, and dependencies used in a product. Third-party Risk Management supports collecting SBOM files as part of the due diligence process for third-party engagements.

SBOM files follow industry-standard formats. Third parties typically provide SBOM files in JSON format. XML formats are also supported. The third party generates and maintains SBOM files and uploads them through the engagement's external assessment for collection and processing. Third-party Risk Management collects, parses, and associates the submitted file with related records.  
Important:  
SBOM collection is supported only for engagements that use the Smart Assessment Engine (SAE). Classic assessments are not supported.

## SBOM users {#tprm-sbom-exploring__cf-exploring-parent-users}

{#tprm-sbom-exploring__tprm-sbom-exploring-users-table__entry__2}

| User | Description |
|-|-|
| Third-party risk assessor | Sends assessments to third-party contacts and reviews submitted and processed SBOM information for an engagement. Can access the SBOM workspace. |
| Third-party risk manager | Oversees SBOM collection across engagements and uses submitted information to support risk evaluation. Can access the SBOM workspace. |
| Third-party administrator | Configures access and permissions to support SBOM collection and review across engagements. Can access the SBOM workspace. |
| Third-party assessment reviewer | Can view SBOM component records on the engagement and third-party records. Does not have access to the SBOM workspace. |
| Third-party contact | Receives the engagement's external assessment through the portal and uploads an SBOM file on behalf of their organization. |
[Table 1. Users]

{#tprm-sbom-exploring__tprm-sbom-exploring-users-table}

## SBOM workflow {#tprm-sbom-exploring__cf-exploring-parent-workflow}

The SBOM collection workflow runs as part of the standard due diligence process for a third-party engagement. When the SBOM required field is selected on the due diligence request and
the engagement uses the SAE, the system automatically associates an SBOM questionnaire template with the external assessment for the engagement.

1. An employee at your organization requesting due diligence selects the SBOM required field on the due diligence request.
2. When the due diligence request advances to the due diligence stage, the system automatically associates the SBOM questionnaire template with the external assessment for the engagement.
3. The engagement contact receives the assessment through the third-party portal and uploads the SBOM file.
4. Post-assessment processing sends the file to the SBOM API, provided by Unified Security Exposure Management (USEM) (Unified Security Exposure Management). The outcome depends on the third party's response:

   * If the file is valid, parsed component records are associated with the engagement and, where applicable, the related third-party record.
   * If the file cannot be parsed, the assessment is reopened for resubmission.
   * If the third party declines to provide an SBOM, the assessment is closed.

   {#tprm-sbom-exploring__ul_hrl_b5n_kjc}

   For details on each path, see [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/bTTa32BbtMcgLsf3kd4wpg "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.").

   For troubleshooting API processing issues, see the Unified Security Exposure Management (USEM) documentation.
5. The third-party risk manager reviews SBOM information in the engagement context.

{#tprm-sbom-exploring__cf-exploring-parent-workflow-ol}  
Note:  
After activating the required applications and using SAE-based due diligence, the automation attaches the default SBOM questionnaire when SBOM required is selected. Your organization can also configure which evaluations or conditions trigger SBOM collection.

## SBOM benefits {#tprm-sbom-exploring__cf-exploring-parent-benefits}

{#tprm-sbom-exploring__tprm-sbom-exploring-benefits-table__entry__3}

| Benefit | Feature | Users |
|-|-|-|
| Request SBOM data as part of due diligence for a third-party engagement. | SBOM collection | Third-party risk assessor, third-party risk manager |
| Review submitted SBOM files and related processing activity in the engagement context. | Assessment activity and processing | Third-party risk assessor, third-party risk manager |
| Review parsed software component declarations for the engagement and, where applicable, related third-party context. | Parsed component records | Third-party risk assessor, third-party risk manager |
| If your instance has the SBOM Response and Vulnerability Response applications installed, access vulnerability details associated with declared SBOM components. | Vulnerability details | Third-party risk assessor, third-party risk manager |
[Table 2. SBOM benefits]

{#tprm-sbom-exploring__tprm-sbom-exploring-benefits-table}

## What to explore next {#tprm-sbom-exploring__cf-exploring-parent-links}

The following topics cover collecting and reviewing SBOM data in Third-party Risk Management:

* [Activate SBOM support](https://www.servicenow.com/docs/5YskNRbUuHQSWuAJd2WCMg "Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM).")
* [Collecting software bill of materials](https://www.servicenow.com/docs/DnoMDiLODr_OwqY_vt93Bw "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.")
* [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/bTTa32BbtMcgLsf3kd4wpg "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.")
* [Review an SBOM submission from an engagement](https://www.servicenow.com/docs/FP~0KA0Qn4OYXiBnSG4KCQ "Track processing status and review the outcome of a SBOM submission from an engagement, including successful upload, failed upload, and decline.")
* [SBOM records and relationships in Third-party Risk Management](https://www.servicenow.com/docs/Xan5SNYGQCUyxfp82SPp7w "The records, related lists, and relationships created when you collect SBOM data in Third-party Risk Management, and how those records relate to engagements and third parties.")
{#tprm-sbom-exploring__tprm-sbom-exploring-links-ul}