The manufacturer generates and keeps updated a software bill of materials, a nested inventory of the software components, their relationships and associated information, merging supplier SBOM data under its proactive management of component life cycle impacts so products stay sustainable under internal quality systems and external regulation. The SBOM is updated and provided to the HDO throughout the product life cycle for operational security planning and awareness; the HDO manages vulnerabilities proactively using it together with input from sources such as ISAOs and CERTs; it can be produced and ingested in machine-readable formats such as SPDX and CycloneDX; and the Vulnerability Exploitability eXchange concept can accompany it to judge the impact of vulnerabilities, with generation and ingestion automated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.