The SBOM lists every software component incorporated in the device for the HDO's operational security planning and supports the RDMP section; MDS2 does not prescribe a description method but asks the manufacturer to state the one used (ISO/IEC 19770-2 and NISTIR 8060 are examples), and all or part of an SBOM with confidential content may be released under a non-disclosure agreement. Questions: is an SBOM available for the product, and how (table in the form, hyperlink to an online version, NDA) (SBOM-1); does it follow a standard or common method of describing components (SBOM-2), identifying the components (2.1), their developer or manufacturer (2.2), their major version numbers (2.3) and other descriptive elements such as patch tags or software identification tags, per ISO/IEC 19770-2:2015 or SPDX 2.1 (2.4); whether the device offers a command or process to list the software components installed on it (SBOM-3); and whether a process exists for keeping the SBOM up to date (SBOM-4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.