Supply Chain Sbom

Workflow

1. Gather artifacts — package.json, go.mod, Cargo.toml, Dockerfile, pipeline configs, lock files.
2. Evaluate each domain — Use checklist.md for criteria.
3. Document evidence — What was observed; what was not found.
4. Assess readiness — Per domain; severity for gaps.
5. Produce findings — Include in federal-checklist, gitops-audit, or review-score output.

Mandatory Rules

• REQUIRED: Every finding cites observable evidence or states "Evidence not found."
• REQUIRED: Map to NIST SA-12 (Supply Chain), SI-7 (Software Integrity) where applicable.
• REQUIRED: Reference DoD Play 7 (Meaningful DevSecOps Pipeline) for remediation.
• FORBIDDEN: Claim compliance; use "readiness," "gap," "partial."

References

• DoD Enterprise DevSecOps Fundamentals v2.5 — Play 7
• NIST 800-53 SA-12 — Supply Chain Risk Management
• NIST 800-53 SI-7 — Software, Firmware, and Information Integrity
• SLSA Framework — Supply chain Levels for Software Artifacts
• contexts/federal-compliance-criteria.md — DoD DevSecOps, supply chain