Operational Model
How to integrate software transparency into your organization's operations
The Operational Model provides practical guidance for implementing Software Bills of Materials (SBOMs), Vulnerability Exploitability eXchange (VEX), and Vulnerability Disclosure Reports (VDRs) within your organization. This guide focuses on workflows, processes, and integration strategies rather than content specifications.
While Content Requirements defines what information should be in your transparency artifacts, the Operational Model explains how to produce, distribute, and use those artifacts.
What this guide covers
This guide helps you assess organizational readiness, choose appropriate workflows based on your role and maturity level, understand when to update SBOMs versus VEX documents, integrate transparency practices into existing development and security processes, and progress from manual processes to automated, policy-driven operations.
It applies to software producers generating and distributing SBOMs and VEX documents, software consumers requesting and using transparency artifacts, and security, procurement, development, or operations teams integrating SBOM data into their workflows.
How to navigate this guide
If you're just starting, begin with Getting Started to assess readiness, identify whether you're acting as a producer or consumer, and choose a practical next step. Understanding Core Concepts like SBOM, VEX and Vulnerabilities prevents common mistakes.
For software producers, explore Workflows covering SBOM generation and vulnerability disclosure. Start with Generate SBOMs.
For software consumers, review the Supplier Transparency and Vulnerability Management use cases, which cover supplier requests, SBOM ingestion, data quality and monitoring.
For specific problems, jump directly to Use Cases covering vulnerability management, supplier transparency, license compliance, release management and regulatory compliance.
For improving existing practices, use Maturity Levels and the Maturity Assessment to identify the next operational improvements to prioritize.
For deeper context, combine Core Concepts with the relevant Use Cases to understand how lifecycle, disclosure, and operational trade-offs apply in practice.
Relationship to other resources
This Operational Model complements the Content Requirements which defines required fields and data quality standards, and the Assessment Tool which measures your organization's transparency maturity.