Tool

CycloneDX

An OWASP standard for software bills of materials (SBOMs) and related supply-chain inventory formats.

cyclonedx.org

Where it helps

• Govern Dependencies

  Makes dependency graphs machine-readable so inherited risk is visible.

• Evidence by Default

  SBOMs attach to releases as default evidence of what shipped.

• Govern the Factory and the Product Separately

  Captures component composition of build outputs the factory ships.