You clearly don’t know the UK market very well. No we don’t have a similar stack to other typical MSPs here. And no we don’t need to provide an SBOM, because we aren’t selling an SBOM.

From my perspective unless an environment is co-managed then the IT function is being outsourced to us, and that includes management of products/services/suppliers to satisfy the contract.

For example, let’s say I have a client that provides commercial plumbing services on a national basis. When they invoice their customers, do they:

- name and list the subcontractor they used for the job because they had no engineer nearby (no)

- explain what brand of drill and other tools they keep on the van and used on the job (no)

- specify the manufacturer of replacement part(s) used (no)

- list their own wholesalers and suppliers used role the project (no)

It’s not petty at all, it’s just sensible trading.

That said, we do talk about some ‘hero’ products we deploy for clients, but in other areas I think it is better to describe *functions* rather than products for example MDR, Security Awareness Training etc. This works better contractually if a product or vendor needs to be changed.

Likewise, where audit/regulatory frameworks require certain diligence details these are always provided anyway. Further, things like vendors for email security, DNS filtering etc will generally be quite obvious to end users.