# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-INV-002
title: Know where any package version is used within a set time
finding:
  title: The organization cannot quickly tell which systems use a given package
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [inventory, incident]
description: |
  The organization can answer "which projects, builds and deployed systems use package X at version Y?" across all its software within {{ inventory_answer_hours }} hours.
rationale: |
  During a supply chain incident, the first hours are spent finding where the package is. Without a central inventory, this means asking every team.
impact: |
  SBOMs or lockfiles must be collected into a searchable place.
parameters:
  - name: inventory_answer_hours
    type: integer
    description: Maximum time to list every use of a package version.
    unit: hours
    default: 24
    profile_defaults:
      hardened: 4
    minimum: 1
    maximum: 168
audit:
  manual: |
    1. Run an exercise: pick a package and version, and time how long it takes to list every use.
    2. Check the answer is complete and came within {{ inventory_answer_hours }} hours.
remediation:
  manual: |
    1. Collect SBOMs and lockfiles of all projects and deployed versions into a searchable inventory.
references:
  - title: The Minimum Elements For a Software Bill of Materials (SBOM)
    url: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
    publisher: NTIA
    kind: standard
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-8
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: IR-4
    relation: related
related_controls:
  - id: CB-DEP-INV-001
    type: related
  - id: CB-DEP-IR-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16