Security · Flashcard
What must the software bill of materials a manufacturer draws up cover, at minimum?
- AAt least the top-level dependencies of the product, in a commonly used machine-readable format
- BEvery transitive dependency of the product, resolved to an exact version and hash
- COnly the components with a known CVE at the time the product is placed on the market
- DOnly the components the manufacturer did not write itself and cannot patch directly
Why this is the answer
The floor is deliberately reachable: identify and document vulnerabilities and components, including by drawing up an SBOM in a commonly used, machine-readable format covering at the very least the top-level dependencies. Deeper transitive coverage is better practice and often necessary to answer a real incident, but the requirement sets the minimum rather than the ideal.
Official docs