What is the SBOM and its significance in Annex B supply chain risk management?

• A. SBOM lists components and dependencies; helps identify vulnerabilities and licensing.
• B. SBOM is a network architecture diagram.
• C. SBOM is a threat intelligence feed.
• D. SBOM is a database of user credentials.

Answer: (A)

An SBOM (Software Bill of Materials) is a documented list of every software component, library, and dependency included in a product, with details like version numbers and suppliers. In Annex B supply chain risk management, this visibility is essential because it lets you see exactly what software is in use, where it comes from, and how parts relate to one another. With an SBOM, you can map each component to known security vulnerabilities and licensing terms, enabling timely patching, license compliance, and risk prioritization. It also aids vendor risk management by confirming which third‑party components are present and tracing them to their origin, which is crucial for incident response and remediation. In short, the SBOM provides a practical, auditable inventory of software that makes supply chain risk actionable. It’s not a network diagram, a threat intelligence feed, or a credentials database.