--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # SBOM records and relationships in Third-party Risk Management # SBOM records and relationships in Third-party Risk Management {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read The records, related lists, and relationships created when you collect SBOM data in Third-party Risk Management, and how those records relate to engagements and third parties. ## SBOM document related list (engagement) {#tprm-sbom-relationship__tprm-sbom-ref-sbom-doc-rl} The SBOM document related list appears on the engagement record and tracks each SBOM submission attempt for that engagement. Separate entries are created for successful and failed uploads. Successful processing depends on whether the submitted file conforms to a supported SBOM schema and can be parsed by the SBOM API. Supported formats are JSON and XML. Files submitted in any other format return a parse error and a new entry is created in this list to record the failed attempt. Each submission attempt creates a separate SBOM document record. Previously submitted documents are retained and not replaced or removed. Note: Third-party assessment reviewers can view records in the SBOM document related list and the BOM components related list on the engagement and third-party records. Reviewers do not have access to the SBOM workspace. {#tprm-sbom-relationship__table-sbom-doc-fields__entry__2} | Field | Description | |-|-| | Format | The declared file format of the SBOM submission, for example, JSON or XML. | | Version | The version declared in the SBOM file. | | Status | The processing status of the submission, for example, queued, processed successfully, or error. | | Source assessment | The assessment instance that triggered the SBOM upload. | [Table 1. SBOM document related list fields] {#tprm-sbom-relationship__table-sbom-doc-fields} ## BOM components related list (engagement) {#tprm-sbom-relationship__tprm-sbom-ref-bom-components-rl} The BOM components related list on the engagement record shows all BOM component records generated from SBOM files collected for that engagement. Each component represents a declared library or dependency from the submitted SBOM. If the SBOM Response and ITSM Vulnerability Response applications are available, vulnerability-related columns may appear at the individual component level. Vulnerability severity is not rolled up to the engagement or third-party level. ## Data model and record relationships {#tprm-sbom-relationship__tprm-sbom-ref-data-model} This table describes how SBOM records relate to each other and to TPRM records after a successful upload. {#tprm-sbom-relationship__table-sbom-data-model__entry__2} | Relationship | How it works | |-|-| | Engagement → SBOM document | An M2M table (`sn_vdr_risk_asmt_m2m_engagement_sbom_doc`) links each engagement to the SBOM documents collected for it. | | Engagement SBOM document → Smart assessment instance | The M2M table also links to the SAE assessment instance (`sn_smart_asmt_instance`) that triggered the SBOM upload. This relationship is surfaced as the Source assessment field on the SBOM document record. | | SBOM document → BOM entity | When the SBOM API parses a file, it creates a parent BOM entity record representing the submitted SBOM document as a whole. | | BOM entity → BOM components | Each BOM entity has one or more child BOM component records representing individual libraries and dependencies declared in the SBOM. | | BOM component → third party | BOM components can be associated with a third party through the product model relationship. The product model manufacturer field can reference a `core_company` record. | | Engagement → BOM components | Components are surfaced on the engagement through the relationship chain: engagement → SBOM document → BOM entity → BOM components. | [Table 2. SBOM data model relationships] {#tprm-sbom-relationship__table-sbom-data-model} Note: The SBOM workspace has no engagement concept. Engagement-level linkage occurs only when SBOMs are collected through the TPRM workflow. SBOM files uploaded directly into the SBOM workspace do not appear in engagement-level related lists. ## Work notes tracking {#tprm-sbom-relationship__tprm-sbom-ref-worknotes} Work notes on the external assessment provide a running log of SBOM processing activity. Examples include: * Queued for processing --- written when the submission is sent to the SBOM API. * Processed successfully --- written when the SBOM API confirms successful parsing. * Error message --- written when parsing fails, including the reason returned by the SBOM API. * Third-party declined --- written when the engagement contact selects a No response option. {#tprm-sbom-relationship__ul_pqb_csn_fjc} ## SBOM questionnaire template {#tprm-sbom-relationship__tprm-sbom-ref-template} The SBOM questionnaire template is provided by ServiceNow and is configured as a TPRM external questionnaire with scoring disabled. The template includes these questions: 1. Can you provide an SBOM? * Yes * No, we do not generate SBOMs. * No, we do not disclose SBOMs outside the company. * No, other. (Please explain.) {#tprm-sbom-relationship__ul_rqb_csn_fjc} 2. Upload your SBOM file. This question appears only when the response to question 1 is Yes. {#tprm-sbom-relationship__ol_qqb_csn_fjc} You can modify the questionnaire template to meet internal requirements. ## Post-assessment automation {#tprm-sbom-relationship__tprm-sbom-ref-automation} A subflow in Flow Designer handles post-assessment actions when an SBOM questionnaire is submitted. The subflow performs these actions: * Sends the uploaded file to the SBOM API. * Tracks the `sn_bom_doc` record status. * On success, creates the engagement-to-SBOM relationship and updates assessment activity. * On error, records the error message and enables resubmission. * On third-party decline, records the response and closes the assessment. {#tprm-sbom-relationship__ul_sqb_csn_fjc} **Related concepts** * [Exploring software bill of materials collection](https://www.servicenow.com/docs/4hH485MGEha91MUz5lB_IQ "Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.") * [Collecting software bill of materials](https://www.servicenow.com/docs/DnoMDiLODr_OwqY_vt93Bw "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.") **Related tasks** * [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/bTTa32BbtMcgLsf3kd4wpg "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.") * [Review an SBOM submission from an engagement](https://www.servicenow.com/docs/FP~0KA0Qn4OYXiBnSG4KCQ "Track processing status and review the outcome of a SBOM submission from an engagement, including successful upload, failed upload, and decline.") * [Activate SBOM support](https://www.servicenow.com/docs/5YskNRbUuHQSWuAJd2WCMg "Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM).")