---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Explore

# Exploring Software Bill of Materials {#ariaid-title1}

* Release version: Australia
* 
* Updated April 3, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Exploring Software Bill of Materials

The Software Bill of Materials (SBOM) functionality in ServiceNow enables organizations to upload, view, and analyze SBOM files to gain visibility into the third-party and open-source components used in their applications.
This capability helps identify risks such as vulnerabilities, license compliance issues, and component integrity concerns associated with open-source software.
Customers can upload SBOM files manually or via API and review component inventories, licensing details, and vulnerability exposure within the SBOM Workspace.
Show full answer Show less  

## Key Features

* **Component Inventory and Licensing:** View detailed inventories of software components, including transitive dependencies and licensing information. Build and maintain a database of proprietary and open-source licenses for compliance management.
* **Vulnerability and Risk Assessment:** Assess exposure to vulnerabilities and license risks. Automatically create application vulnerable items (AVITs) for components with known vulnerabilities and remediate them through Application Vulnerability Response workflows.
* **Standards Support:** Supports SBOM files in CycloneDX (XML and JSON) and SPDX formats, enabling broad compatibility with industry standards.
* **Integrated Intelligence:** Integrates with OSV.dev and Deps.dev APIs to provide up-to-date vulnerability intelligence, component version tracking, and identification of stale or abandoned components classified as non-compliant.
* **Visualization and Reporting:** Provides reports, dashboards, and data visualizations in the SBOM Workspace to monitor license compliance and risk exposure effectively.
* **Security Operations Integration:** Leverages Vulnerability Response and Application Vulnerability Response applications and Common Service Data Model (CSDM) tables to enhance security management processes.

## Key Outcomes

* Gain comprehensive visibility into the software components and open-source libraries used across your applications.
* Identify and mitigate risks related to vulnerabilities and license compliance to reduce potential exposure.
* Ensure compliance with internal and regulatory policies by classifying and managing software licenses linked to components.
* Streamline vulnerability remediation through automated workflows and integration with vulnerability intelligence sources.
* Support continuous integration and deployment cycles by generating and analyzing SBOMs throughout the software development lifecycle.  
Identify the components used in your organization's applications from Software Bill of Materials (SBOM) files you upload into your instance. Understand any risks associated with using open-source software to help you determine your potential exposure, view license compliance, and fix vulnerabilities.

## Software Bill of Materials overview {#vr-sbom-exploring__cf-exploring-parent-overview}

Third-party and open-source components provide you with many advantages for the rapid creation and release of your software projects. However, in some cases, there are risks associated with using publicly accessible components, such
as the following:

* Lack of visibility into component integrity
* Vulnerabilities in the open-source software
* Package Intelligence for open-source software
* Non-compliant software licenses

{#vr-sbom-exploring__ul_vjg_y4h_scc}

You can upload your software bill of material files via an API or manually. View the files that you import as entities, which are inventories of the third-party component libraries used in your software, including any transitive
dependencies and available licensing information.

For more information about what is included in the software inventories in CycloneDX and SPDX SBOMs, see [CycloneDX - Software Bill of Materials (SBOM)](https://cyclonedx.org/capabilities/sbom/) and [SPDX](https://spdx.dev/).

## Software Bill of Materials users {#vr-sbom-exploring__cf-exploring-parent-users}

{#vr-sbom-exploring__table_jmp_44h_scc__entry__2}

| User | Description |
|-|-|
| Vulnerability managers and analysts | View uploaded software bill of materials files in records, data visualizations, as well as enhanced vulnerability intelligence in the Software Bill of Materials (SBOM) Workspace. Vulnerability managers and analysts use this information to help them determine your software licensing compliance and the potential risk exposure with using open-source software. |
| Users that might include but are not limited to: * Technology or software lawyers * IT managers * Auditors * Software asset managers and teams {#vr-sbom-exploring__ul_qtw_fvz_ddc} | View uploaded proprietary and open-source software licenses for components of your uploaded SBOM files. Build a database of proprietary and open-source software licenses for the components. Review and classify licenses with missing information according to your internal or regulatory policies. Match your components to licenses and determine your overall license compliance and see your potential risk exposure to banned, restricted, or missing licenses. |
[Table 1. Users]

{#vr-sbom-exploring__table_jmp_44h_scc}

## Software Bill of Materials workflow {#vr-sbom-exploring__cf-exploring-parent-workflow}

The SBOM applications enable you to upload files and view details for entities, component inventories, vulnerabilities, and software license information in the Software Bill of Materials (SBOM) Workspace.  
* Upload SBOM files with an API or manually.
* Review the components in the SBOM file you uploaded in the SBOM Workspace.
* Review component license information from uploaded SBOM files and classify them to help you identify your exposure to restricted or banned licenses.
* Assess your risk exposure and create vulnerable items for components that have associated vulnerabilities.
* View reports and dashboards as well as your overall license compliance for uploaded SBOM components on the Home page in the SBOM Workspace.
{#vr-sbom-exploring__cf-exploring-parent-workflow-ol}

## Software Bill of Materials benefits {#vr-sbom-exploring__cf-exploring-parent-benefits}

Three Software Bill of Materials applications enable you to view an accurate inventory of your software components and associated risks:

* Data Model for SBOM
* SBOM Core
* SBOM Response
{#vr-sbom-exploring__ul_ggs_2ph_scc}

For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498).
{#vr-sbom-exploring__table_mmp_44h_scc__entry__3}

| Benefit | Application | Supported versions |
|-|-|-|
| This application provides the tables used to store SBOM data. This application is required. It includes the tables, ACLs, and roles that are required to read SBOM data. | Data Model for SBOM | v4.0, v3.0, v2.0 |
| This application is required. It Includes the API required to upload SBOM documents and the business logic required to parse and import the data from those documents into your instance. You can view an inventory of your software components in the SBOM Workspace, but you cannot view the data visualizations on the landing page. Upload, parse, and process your software bill of materials files in CycloneDX and SPDX standards. Refer to the Supported versions column for the supported file formats and versions for these products. View bill of materials (BOM) entities and an inventory of your software components. A BOM entity is the root level component in an SBOM file. For example, for a CycloneDX SBOM, the component listed in the metadata is considered the BOM entity. | SBOM Core | v6.0, v5.0, v4.0 Starting with version 4.0, SBOM Core supports: * XML and JSON versions 1.0 through 1.6 of CycloneDX. * JSON versions 2.2 through 2.3 of SPDX. {#vr-sbom-exploring__ul_prw_k5h_scc} |
| * SBOM Response is required if you want access to the features and data visualizations on the landing page in the SBOM Workspace. * SBOM Response requires the Vulnerability Response application. * View your component inventory and assess your risk exposure in the SBOM Workspace. Set up rules to create application vulnerable items (AVITs) automatically and remediate them with the Application Vulnerability Response workflow. * View component license information that is uploaded with your SBOM files in the [License administration module](https://servicenow-prod.fluidtopics.net/~74gpKsuLSTHjEuQ5YT0cw "Classify licenses and resolve (match) them to components, or create licenses in the License administration module in the SBOM workspace. Classifying and matching licenses to your components permits you determine your license compliance for the proprietary, open-source, and vendor-supplied software components you upload in your SBOM files."). Classify and resolve (match) the components you upload in your Application Vulnerability Response files to licenses so you can see the state of your over-all license compliance. * Starting with version 4.0 of Application Vulnerability Response Response, you can view components that are identified as stale or abandoned as 'Non-compliant' in the Policy as Code Engine (PaCE) interface that is available in the SBOM Workspace. * The OSV.dev and Deps.dev integrations are included when you install SBOM Response. * OSV.dev is an open-source API that provides vulnerability intelligence information for a given version of a package or library. * Deps.dev is an open-source API that provides a version list for a given package or library and identifies components that are in Stale and Abandoned states. {#vr-sbom-exploring__vr-sbom-intro_ul_jkl_l2r_5zb} See [Configuring the Deps.dev, OSV.dev, and PaCE integrations for Software Bill of Materials](https://servicenow-prod.fluidtopics.net/pT6RGXKjAqqpjOdiID8GCg "You can edit some of the parameters for the Deps.dev and OSV.dev integrations. There are also two code trigger versions of these integrations that are used strictly for internal workflows, and you should not initiate these integrations on-demand. Additionally, you can activate a scheduled job to create policies using Policy as Code Engine (PaCE).") for more information. See [Integrating PaCE with other applications](https://www.servicenow.com/docs/access?context=pace-integrate-other-apps&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US) for more information about PaCE and PaCE policies. {#vr-sbom-exploring__ul_icf_tyn_zcc} | SBOM Response | v6.0, v5.0, v4.0 |
| Generate and upload Software Bill of Materials (SBOM) files for software throughout its continuous integration and continuous deployment development cycles. | SBOM Response | * Data Model for SBOM: v1.4 and later. * SBOM Core: v3.0 and later. * SBOM Response: v4.0 and later. {#vr-sbom-exploring__ul_ofv_yth_scc} |
[Table 2. SBOM benefits]

{#vr-sbom-exploring__table_mmp_44h_scc}

## Vulnerability Response applications and CSDM tables {#vr-sbom-exploring__id_ilk_113_q2c}

The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications. See [Vulnerability Response applications and CSDM tables](https://servicenow-prod.fluidtopics.net/CZ4qzzPgaYYJ6UkJzQAHiQ "The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications.") for more information.

## What to explore next {#vr-sbom-exploring__cf-exploring-parent-links}

To learn more about configuring and using Software Bill of Materials, see:

* [Exploring supported applications for Software Bill of Materials](https://servicenow-prod.fluidtopics.net/Ixb5xjvwYl3N0fnXCX7hww "Third-party vulnerability intelligence and other integrations with the Software Bill of Materials applications can enhance the data of your uploaded files.")
* [Configuring Software Bill of Materials](https://servicenow-prod.fluidtopics.net/4Jp5KTZVCh5yTQSR2dOMkA "Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading SBOM files.")
* [Uploading and viewing your SBOM files in the SBOM Workspace](https://servicenow-prod.fluidtopics.net/~sEHcDqCTAWr44HbYIeRtw "The SBOM applications enable you to upload files and view details for entities, component inventories, license information and other details in the Software Bill of Materials Workspace.")
* [Viewing reports and dashboards in the Software Bill of Materials workspace](https://servicenow-prod.fluidtopics.net/y_jtoeqbUC6WVIUzom44GQ "Vulnerability analysts view uploaded software bill of materials files in records, data visualizations, as well as enhanced vulnerability intelligence in the Software Bill of Materials (SBOM) Workspace.")
{#vr-sbom-exploring__ul_nmp_44h_scc}