Collecting software bill of materials
Summarize
Summary of Collecting software bill of materials
A software bill of materials (SBOM) is a detailed inventory file listing components, libraries, and dependencies included in a vendor's software product. In the ServiceNow Third-party Risk Management (TPRM) module, SBOM collection supports the due diligence process by enabling risk teams to analyze software components for potential risks. SBOM data can be parsed and viewed in TPRM or Unified Security Exposure Management (USEM).
Show less
SBOM files must conform to industry standards such as CycloneDX or SPDX and are typically provided in JSON or XML format. Files submitted in unsupported formats like PDF or Word will cause parsing errors.
Note that vendors generate and maintain SBOM files independently; ServiceNow collects, parses, and links these files to related records but does not create or edit SBOMs.
SBOM Collection Process in TPRM
- SBOM collection is initiated during third-party due diligence when the SBOM required field is selected on the due diligence request form.
- An SBOM questionnaire template is automatically associated with the engagement-level external assessment and sent to the vendor via the third-party portal.
- Upon submission, the uploaded SBOM file is processed through the USEM SBOM API, parsed, and linked to the engagement and third-party records.
- Different response outcomes, including error handling and vendor declines, are managed within the process.
- Roles such as third-party risk assessors, managers, and administrators have access to the SBOM workspace for uploading and updating manufacturer data; assessment reviewers can view SBOM data but cannot edit it.
- Users managing SBOM records must also have edit access to the CMDB product model table to update manufacturer information.
Limitations and Constraints
- SBOM collection is supported only for engagements using the Smart Assessment Engine (SAE) and is not available for classic assessments.
- The SBOM questionnaire applies only at the engagement level, not directly at the third-party level.
- Only JSON and XML file formats are supported; other formats result in parsing errors and require resubmission.
- Supported workflows include onboarding, renewal, and reassessment; updates to existing SBOMs are possible during renewals and reassessments, but offboarding is not supported.
- SBOM component data does not automatically influence the overall TPRM risk score, though this behavior can be customized by organizations.
- Component-to-vendor relationships link via product model records; automated links to sub-vendors or sub-processors are not established.
Application Requirements and Availability
SBOM functionality depends on specific ServiceNow applications that must be installed separately from the ServiceNow Store:
- Required for SBOM collection: SBOM Core (snsbomcore), Data Model for SBOM (snsbomdm)
- Required to view vulnerability details: SBOM Response (snsbomresp), Vulnerability Response (snvul)
Additional configuration is necessary after installation to activate full SBOM support.
A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.
SBOM overview
A software bill of materials (SBOM) is a structured inventory file generated by a software vendor that lists the components, libraries, and dependencies used in a product. Risk teams can use SBOM data to review declared components and assess potential exposure associated with those components. Parsed SBOM data can be viewed in TPRM or in Unified Security Exposure Management (USEM) (Unified Security Exposure Management). For more information about SBOM collection in Third-party Risk Management, see Exploring software bill of materials collection.
SBOM files follow industry-standard formats and must conform to a supported SBOM standard, such as CycloneDX or SPDX. Vendors typically provide SBOM files in JSON format. XML formats are also supported. If a third party uploads a file in any other format, such as PDF or Word, the system returns a parse error. For details on preparing and formatting SBOM files, see the Unified Security Exposure Management (USEM) SBOM documentation.
SBOM collection in Third-party Risk Management
SBOM collection occurs during third-party due diligence. The SBOM required field on the third-party due diligence request form indicates when SBOM collection is required for an engagement. When selected, the system associates an SBOM questionnaire template with the external assessment for that engagement.
The questionnaire is sent to an engagement contact through the third-party portal as part of the engagement-level external assessment. No additional assessments or alternate workflows are introduced as part of this process.
When the assessment is submitted, post-assessment processing sends the uploaded file to the SBOM API, provided by Unified Security Exposure Management (USEM) (Unified Security Exposure Management). Parsed SBOM component records are then associated with the relevant engagement and, where applicable, the related third-party record. The outcome of processing depends on the third party's response. For details on each response path, including error handling and third-party decline, see Request a software bill of materials from an engagement. For troubleshooting API processing issues, see the Unified Security Exposure Management (USEM) SBOM documentation.
The third-party risk assessor, third-party risk manager, and third-party administrator roles can access the SBOM workspace and upload or update manufacturer data. Third-party assessment reviewers can view SBOM component records on the engagement and third-party records but don't have access to the SBOM workspace. Internal reviewers don't have access to the SBOM workspace.
Limitations
The following constraints apply to SBOM collection:
- Smart Assessment Engine (SAE) only: SBOM collection is supported only for engagements that use the Smart Assessment Engine. This feature does not support classic assessments.
- Engagement-level collection: The SBOM questionnaire is associated with the engagement-level vendor risk assessment. This feature does not support collection at the third-party level directly.
- Supported file formats: JSON and XML are supported. Submitting a file in any other format returns a parse error and reopens the assessment for resubmission.
- Supported workflows: onboarding, renewal, and reassessment workflows are supported. For renewal and reassessment engagements, existing SBOM records can be updated rather than fully re-uploaded. This feature does not support offboarding.
- Risk scoring behavior: information derived from SBOM components is not incorporated into the overall Third-party Risk Management risk score by default. Organizations can configure this behavior.
- Component-to-vendor relationships: SBOM components reference the software manufacturer through the product model record. Automated relationships to sub-vendors or sub-processors are not established.
Feature availability
Availability of SBOM- related functionality depends on activated applications and configuration. The core due diligence workflow operates independently of SBOM processing.
SBOM collection capabilities are procured separately from Third-party Risk Management. All required applications are available from the ServiceNow Store and must be installed individually.
The following applications are required to collect and process SBOM files:
- SBOM Core (sn_sbom_core)
- Data Model for SBOM (sn_sbom_dm)
The following additional applications are required to view vulnerability details associated with SBOM components:
- SBOM Response (sn_sbom_resp)
- Vulnerability Response (sn_vul)