Description
The organization can answer "which projects, builds and deployed systems use package X at version Y?" across all its software within {{ inventory_answer_hours }} hours.
Rationale
During a supply chain incident, the first hours are spent finding where the package is. Without a central inventory, this means asking every team.
Impact
SBOMs or lockfiles must be collected into a searchable place.
Parameters
| Parameter | Baseline | Hardened | Bounds | Description |
|---|---|---|---|---|
inventory_answer_hoursinteger | 24 hours | 4 hours | 1 to 168 | Maximum time to list every use of a package version. |
The value used is your override, else the profile's, else the default. Bounds limit what an override may set.
Audit
- Run an exercise: pick a package and version, and time how long it takes to list every use.
- Check the answer is complete and came within {{ inventory_answer_hours }} hours.
Remediation
- Collect SBOMs and lockfiles of all projects and deployed versions into a searchable inventory.
References
- The Minimum Elements For a Software Bill of Materials (SBOM) NTIA, standard, accessed 2026-10-16
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-8 | related | |
| NIST SP 800-53 Rev. 55.1.1 | IR-4 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-DEP-INV-001Produce and keep an SBOM for every release - related
CB-DEP-IR-001Have a response procedure for compromised dependencies
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |