SBOM Roles: Produce, Distribute, and Consume

An SBOM is a machine-readable inventory of the software components and relationships contained in a specific product release. Its value depends on accurate generation, appropriate distribution, and effective use in security, compliance, and maintenance activities.

These activities are referred to as Produce, Distribute, and Consume. Responsibility may be distributed across organizations, teams, and automated tools throughout the software supply chain.

The following sections describe the steps in more detail, and provide links to additional resources for each role.

1

ProduceCreate an SBOM that describes a software product and its components.

↓

2

DistributeMake the SBOM available to the people and systems responsible for using it.

↓

3

ConsumeUse the information to assess risk, vulnerabilities, licenses, and dependencies.