# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-INV-001
title: Produce and keep an SBOM for every release
finding:
  title: Releases have no record of the components they contain
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [sbom, inventory]
description: |
  Each release produces a software bill of materials (SBOM) in a standard format, listing every component and version, generated from the actual build. It is stored with the release artifact for at least as long as the release is supported.
rationale: |
  When a vulnerability or a malicious package is announced, the SBOM answers "are we affected, and where?" for every version in the field, including old ones no longer in the repository.
impact: |
  Build pipelines need an extra step and storage.
audit:
  manual: |
    1. Pick a recent release and retrieve its SBOM.
    2. Check it uses a standard format, includes transitive dependencies and matches the shipped artifact.
  checks:
    - id: postmortem
      engine: postmortem
      description: "an SBOM step in the pipelines; storage with releases is by hand"
      spec:
        command: postmortem harden --json
        control: CB-DEP-INV-001
        coverage: partial
remediation:
  manual: |
    1. Add SBOM generation to the release build.
    2. Store it with the release artifact.
references:
  - title: The Minimum Elements For a Software Bill of Materials (SBOM)
    url: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
    publisher: NTIA
    kind: standard
    accessed: 2026-10-16
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-8
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-4
    relation: related
related_controls:
  - id: CB-DEP-INV-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16