SBOM Disclosure in Procurement Tenders: Obligations

Introduction

A Software Bill of Materials (SBOM) is a structured inventory of software components, libraries, dependencies, and related information contained in a software product. It helps purchasers identify software supply-chain risks, vulnerable components, licensing issues, and potential cybersecurity threats.

SBOM disclosure in procurement tenders refers to the requirement that a bidder or supplier provide an SBOM when submitting a tender, delivering software, or maintaining a software system for a public or private procuring entity.

In biotechnology, SBOMs may be important for laboratory information systems, genomic-data platforms, medical devices, clinical-trial software, and connected diagnostic equipment. A vulnerable software dependency in such systems may compromise patient data, research integrity, or operational safety.

The term “SBOM disclosure obligation” is not a single universal legal doctrine. Its enforceability generally depends on procurement rules, cybersecurity regulations, tender conditions, contractual terms, and applicable sector-specific laws.

Legal Framework in India

The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology, has issued technical SBOM guidelines for software supply-chain transparency. The guidelines recommend that government, public-sector, and essential-services organisations include SBOM requirements in software procurement. The 2025 Version 2.0 guidelines further recommend that software supplied to these organisations be accompanied by a complete SBOM.

CERT-In+1

An SBOM generally identifies:

Software components, libraries, and dependencies.

Component supplier and version.

Unique identifiers and dependency relationships.

Relevant licence information.

Information needed to identify vulnerable or unsupported components.

CERT-In recommends machine-readable formats such as SPDX or CycloneDX. It also recommends vulnerability-exploitability information, such as VEX, to help purchasers determine whether a known vulnerability affects the supplied product.

CERT-In

Important legal distinction: CERT-In’s technical guidelines are recommendations, not automatically a universal statutory tender condition. The obligation becomes enforceable when incorporated into a tender, contract, applicable regulatory requirement, or other binding instrument. A tender should clearly specify the SBOM format, required fields, submission time, update frequency, and consequences of non-compliance.

Case Laws

There is no widely recognised Indian reported judgment specifically deciding the legal validity of an SBOM disclosure clause in a procurement tender. However, established tender-law principles are relevant.

1. Toshniwal Enterprises Controls Pvt. Ltd. v. Union of India, Delhi High Court (2017)

The dispute concerned a tender requirement for a detailed, unpriced Bill of Materials (BoM). The tender specified the information bidders had to provide and stated that a bid without the required BoM could be treated as substantively non-responsive. The case illustrates that a procurement authority may require detailed component disclosure and evaluate bids according to the conditions expressly stated in the tender.

Indian Kanoon+1

Although a conventional BoM is not identical to a software SBOM, the principle is relevant: bidders must comply with clearly stated disclosure requirements, and the authority must apply its tender conditions consistently.

2. Shib Shankar Majumder v. Union of India, Calcutta High Court (2024)

The Court considered a tender dispute involving requirements associated with the Central Public Procurement Portal. It noted that a condition referred to in general e-procurement guidance was not an essential condition embedded in the tender document itself. This supports the principle that bidders should be assessed against the actual tender terms rather than an assumed or external requirement.

Indian Kanoon

Applied to SBOM disclosure, an authority should expressly include the requirement in its tender documents instead of relying only on general cybersecurity guidance.

3. Tata Cellular v. Union of India, (1994) 6 SCC 651

The Supreme Court established that judicial review of government tender decisions focuses on legality, fairness, rationality, and the decision-making process—not on substituting the court’s commercial judgment for that of the procuring authority.

DEPARTMENT OF Expenditure

This principle supports reasonable cybersecurity-related disclosure conditions, provided they are transparent, non-arbitrary, and applied consistently.

Procurement Obligations and Consequences

Where an SBOM requirement is expressly included in a tender, the bidder may be required to:

Submit a complete SBOM with the technical bid or at the specified delivery stage.

Disclose third-party and open-source components.

Identify component versions, suppliers, and dependencies.

Confirm the SBOM’s accuracy and completeness.

Provide updated SBOMs when software components change.

Notify the purchaser of newly discovered vulnerabilities and provide relevant VEX information.

Failure to comply may result in rejection of a non-responsive bid, withholding of acceptance or payment, contractual penalties, or termination—provided these consequences are authorised by the tender or contract and applied lawfully.

A procurement authority should also protect legitimate confidential information. SBOM disclosure should be limited to the information necessary for security and procurement purposes, with appropriate controls over access and onward disclosure.

Conclusion

SBOM disclosure in procurement tenders promotes transparency, cybersecurity, and accountability in software supply chains. In biotechnology, it is particularly important for genomic-data platforms, laboratory systems, diagnostic software, and connected medical technologies, where vulnerable dependencies may expose sensitive data or disrupt essential operations.

CERT-In’s guidelines strongly recommend SBOM requirements in government, public-sector, and essential-services software procurement. However, the enforceability of a particular requirement depends on whether it is incorporated into the tender, contract, or applicable regulation.

The tender-law principles reflected in Toshniwal Enterprises Controls, Shib Shankar Majumder, and Tata Cellular support clear, fair, and consistently applied disclosure conditions. A sound procurement framework should specify SBOM content, format, timing, updates, confidentiality, and consequences of non-compliance.