Consumer Workflows
Requesting, ingesting, validating, and leveraging supplier transparency artifacts
Software consumers use transparency artifacts to manage supplier risk, prioritize vulnerabilities, and make informed procurement decisions. These workflows guide effective consumption and utilization of SBOMs and VEX documents.
Core Consumer Workflows
Request from Suppliers
Effectively requesting SBOMs and VEX from vendors through procurement processes, contracts, and ongoing relationships.
Key decisions: Timing of requests, contractual requirements, supplier communication strategies
Ingest and Store
Building infrastructure to receive, validate, and store supplier SBOMs for ongoing access and analysis.
Key decisions: Storage architecture, retention policies, version management
Validate Quality
Assessing received SBOMs for completeness, accuracy, and fitness for intended use before relying on them for security decisions.
Key decisions: Acceptance criteria, rejection procedures, quality feedback loops
Integrate with Tools
Connecting SBOM data to vulnerability scanners, asset management systems, and security workflows for operational value.
Key decisions: Tool selection, integration patterns, automation level
Monitor for Updates
Tracking SBOM and VEX updates from suppliers to maintain current vulnerability status understanding.
Key decisions: Update notification mechanisms, polling vs push, change detection
Assess and Act
Using SBOM and VEX data to make risk-informed decisions about deployment, patching, and supplier relationships.
Key decisions: Risk scoring, prioritization frameworks, action thresholds
Building Consumer Capability
Consumer capability often lags producer capability in organizational maturity. Suppliers face regulatory pressure to generate SBOMs; consumers face less direct mandate to consume them effectively.
This creates asymmetry: suppliers provide SBOMs that consumers cannot fully utilize, wasting the transparency opportunity. Effective consumer capability requires dedicated investment in infrastructure and processes.
Integration is Critical
The value of consumer workflows comes from integration, not collection. Simply requesting and storing SBOMs provides minimal benefit. Value emerges when SBOM data flows into vulnerability management, procurement decisions, and operational security.
Plan integration from the start rather than treating it as future enhancement. Consumer workflows without integration become compliance theater—artifacts collected but unused.
Next Steps
- Begin with Request from Suppliers to build SBOM inventory
- Establish Ingest and Store infrastructure
- Plan Integration with Tools for operational value