C2.7 Component-level supply chain

Supply-chain instruments [15]

What it requires. For every third party the organization already knows, it also knows the component: a software bill of materials with eleven minimum fields, from author and timestamp through name, version, identifiers and hash to license, dependencies, generating tool and context of generation; a hardware bill of materials with the geography of manufacture; the chain of nth parties behind the supplier. A bill that does not declare itself complete is stored as incomplete, a redacted field and an unknown field are told apart, and every due-diligence question traces to the standard that motivates it.

Where it comes from. The cybersecurity agency's supply-chain instruments [15] are the only source in the set that moves third-party risk from the supplier to the thing it delivered. The minimum elements for a software bill of materials, issued in draft in 2025, name the eleven fields and lay down the rules on known unknowns and on generation context. The hardware framework of 2023 adds standardized naming and manufacturing geography. The vendor questionnaire has ninety-seven questions in eight sections, each traced to a standard.

What it reconciles. Every other source that mentions vendors stops at the contract; this one goes through the firm to the library and the chip. A vulnerability announced in a library is a condition that exists today, and the systems containing the library are the assets, so the bill of materials is what lets C2.2 be written for a supply-chain risk at all. The known-unknowns rule is the identification layer's version of the precision field in C3.2: a record that says how complete it is.