Sonatype • Application security
Sonatype SBOM Manager handles the SBOM lifecycle for SPDX and CycloneDX formats with expanded license detection across 13 ecosystems, integrated container scanning, legal review workflows, and compliance alignment to NIST SSDF, EO 14028, DORA, NIS2, and the Australian ISM. Automated attribution reports cut manual effort by up to 30x.
Merito sells Sonatype SBOM Manager and operates the SBOM ingestion, license review workflow design, container scanning integration, and compliance evidence generation that turn SBOM data into a working governance program.
What it is
Sonatype SBOM Manager handles the SBOM lifecycle (generate, validate, store, distribute) for the SPDX and CycloneDX formats. The platform tracks SBOM inventory across the customer's software portfolio, performs audits against compliance frameworks, runs legal review workflows, and maintains version history with full traceability. Programs responding to executive-order software supply chain expectations or PCI 4.0 software inventory requirements use SBOM Manager as the audit-evidence path.
Expanded license detection covers 13 ecosystems and includes both declared (metadata) and observed (source-file) licenses. The dual detection catches license discrepancies between what the package manager declares and what the source code actually contains, which legal review processes need to identify. Integrated container scanning extends coverage to OS-level packages inside container images alongside application code, addressing the long-tail OSS components that ship in containers but get missed by application-only SBOM tools.
Compliance alignment matters for federal agencies and regulated programs. SBOM Manager aligns to NIST SSDF, Executive Order 14028, DORA, NIS2, the Australian ISM, and CISA's 2025 SBOM minimum elements (Component Hash, License Information, Tool Name, Generation Context). Automated attribution reports cut manual compliance effort by up to 30x. Programs adopting SBOM Manager pair it with Sonatype Lifecycle (where component data flows in from the SCA platform) or run it standalone consuming SBOMs from external scanners.
Ideal use cases
What it is best at
Covers both declared (metadata) and observed (source-file) licenses. Catches license discrepancies between package-manager declarations and actual source code that legal review processes need to identify.
Captures OS-level packages inside container images alongside application code. Addresses the long-tail OSS components that ship in containers but get missed by application-only SBOM tools.
Reviewers assess license obligations, make license selections, and track progress inside the platform. Legal teams stop running parallel spreadsheets for license compliance.
NIST SSDF, EO 14028, DORA, NIS2, Australian ISM, and CISA's 2025 SBOM minimum elements. Federal and regulated programs get evidence packages auditors recognize.
Automated attribution reports cut manual effort dramatically. Compliance teams stop manually compiling open-source attribution lists at audit time.
Core capabilities
How SBOM Manager handles the full SBOM workflow.
SPDX and CycloneDX support
Industry-standard SBOM formats for upstream and downstream supply-chain handoffs.
SBOM ingestion and validation
Imports SBOMs from external scanners and validates against the customer's policy.
Version history and traceability
Full traceability across SBOM revisions for audit evidence.
Distribution workflow
SBOMs distributed to customers, regulators, and downstream consumers as required.
How SBOM Manager identifies open-source license posture.
13-ecosystem coverage
Detection across major language and container ecosystems.
Declared (metadata) license detection
License information from package metadata.
Observed (source-file) license detection
License information from source-file scanning. Catches discrepancies between declared and actual.
How SBOM Manager extends coverage to containers.
OS-level package capture
OS packages inside container images get included in the SBOM alongside application code.
Multi-layer container support
Coverage extends across container image layers.
Application plus OS unified view
Single SBOM covers both application dependencies and OS packages for full container visibility.
How SBOM Manager supports legal and compliance teams.
Legal review workflow
Reviewers assess license obligations, make selections, and track progress inside the platform.
Compliance framework mapping
Findings map to NIST SSDF, EO 14028, DORA, NIS2, Australian ISM, CISA 2025 minimum elements.
Automated attribution reports
30x reduction in manual attribution-report effort for compliance audit cycles.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Sonatype SBOM Manager (standalone)
SBOM lifecycle platform with license detection, container scanning, legal review workflow, and compliance framework alignment.
Best for: Programs needing SBOM lifecycle without other Sonatype products.
SBOM Manager bundled with Nexus One Platform
Bundled with Repository Pro, Lifecycle, and Guide under unified platform license.
Best for: Programs consolidating multiple Sonatype products.
Merito services
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
Deployment, SBOM ingestion configuration, legal review workflow design, container scanning integration, and compliance framework mapping.
Explore service02SBOM program scoping aligned to NIST SSDF, EO 14028, DORA, NIS2, and other regulatory frameworks.
Explore service03SBOM Manager integration into CI/CD pipelines and SBOM distribution workflows.
Explore service04Named engineer, priority SLAs, and release-window coverage for SBOM Manager in production.
Explore service05Long-term run support including SBOM ingestion maintenance, legal review workflow operations, and compliance framework updates.
Explore service06Role-based training for compliance leaders, legal teams, and AppSec engineers using SBOM Manager output.
Explore serviceSBOM Manager licensing
SBOM lifecycle is generation plus validation plus storage plus distribution plus legal review plus compliance mapping. Buy SBOM Manager through Merito and get the workflow design, framework mapping, and ingestion configuration together.
Merito point of view
Programs running point-solution SBOM generators end up with SBOMs they cannot manage. The lifecycle problem (validate, store, distribute, audit, attribution-report) is what regulated programs actually need solved. SBOM Manager addresses the lifecycle rather than just the generation surface. Programs that adopt SBOM Manager get audit-ready compliance evidence aligned to NIST SSDF, EO 14028, DORA, NIS2, and the Australian ISM.
Legal review workflow is the differentiator that matters. Legal teams running open-source compliance reviews stop maintaining parallel spreadsheets. The 30x reduction in attribution-report effort directly addresses compliance audit-cycle pain. Customers comparing SBOM Manager against point-solution SBOM generators weight the legal-review workflow heavily.
SBOM Manager assumes SBOMs already exist or need to be generated. Programs without an SCA tool feeding component data into SBOM Manager get less value. Merito's standard rollout pairs SBOM Manager with the customer's Lifecycle deployment so component data flows in automatically. Programs running other SCA tools can ingest SBOMs from those tools, but the integration depth is best with Lifecycle.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your SBOM lifecycle posture, compliance scope, and legal review workflow. A Merito Sonatype specialist follows up within one business day.
Compliance alignment
Federal agencies and regulated programs get evidence packages auditors recognize.
Legal review workflow
Legal teams assess license obligations, make selections, and track progress inside the platform. 30x reduction in attribution-report effort.
Next step
An SBOM Manager engagement with Merito starts with the compliance scope, then SBOM ingestion, then legal review workflow design. Programs in NIST SSDF, EO 14028, DORA, or NIS2 scope see the most direct value.