Implementing SBOMs

Regardless of the use case, the use of SBOMs always involves three steps and associated roles. Click on the roles to learn about the responsibilities and get step-by-step guides.

1. ProducerThe SBOM must be generated initially. This role is often fulfilled by the organization that has access to the source code or compiles the software.

2. DistributorThe generated SBOM must be provided to the recipients.

3. ConsumerThe consumer must enrich the SBOM with additional information, such as vulnerability data, present the data in an understandable format, and incorporate it into a risk management process.