How to Share SBOMs: Formats, Distribution Channels, and Emerging Standards

NTIA's SBOM Sharing Models

The NTIA published guidance on SBOM sharing and exchange that defines three distribution models. The first model is embedded SBOMs — where the SBOM is included directly within the software artifact (as an OCI attestation for container images, as a manifest file in a package, or as a build artifact alongside the binary). The second model is hosted SBOMs — where the software producer hosts SBOMs on a web-accessible endpoint (often called a Software Transparency Center) and consumers access them via URL. The third model is on-request SBOMs — where SBOMs are not publicly available but can be provided to customers or regulators upon formal request within a defined SLA.

Software Transparency Centers

Several large software vendors have established Software Transparency Centers — dedicated web portals where customers can download SBOMs for products they have licensed. Microsoft, Cisco, and several other enterprise software vendors have launched these portals in response to federal procurement requirements. A Software Transparency Center provides a sustainable, scalable model for distributing SBOMs to large customer bases without manual handling of each request.

Confidentiality and Partial SBOMs

Some organizations resist public SBOM sharing due to concerns about exposing their technology stack to competitors or attackers. The NTIA and CISA guidance acknowledges this concern and allows for SBOMs to be provided under NDA to customers rather than published publicly. Partial SBOMs — disclosing component names and versions without the dependency graph structure — are sometimes offered as a compromise. However, partial SBOMs significantly limit downstream security use cases, as the dependency graph is required for accurate impact analysis.

Machine Consumption at Scale

As SBOM sharing scales, the format for exchange matters. The SBOM exchange ecosystem is converging on CycloneDX JSON as the interchange format for most machine-to-machine SBOM exchange, due to its compact size, well-documented schema, and strong tooling support. SPDX remains preferred in some federal contexts. Organizations building SBOM sharing infrastructure should plan to support both formats to maximize compatibility with downstream consumers.