ThreatKrusher Emblem
ThreatKrusher Assurance Center
🔍 ⌘K
Assurance Center > Technical & Operational Standards > SBOM & MBOM Guidelines
Search Results
Public Standard Ref: ETP-AC-STD-017 Ver: 1.0.0 Owner: DevSecOps & AI Systems Architecture
⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Software and Model Bill of Materials specifications conforming to Executive Order 14028 supply chain requirements.

eTrepid Software & AI Model Bill of Materials (SBOM / MBOM) Standard

Governing Standard: Executive Order 14028 / NTIA Minimum Elements / CycloneDX

1. Overview and Federal Alignment

In accordance with Executive Order 14028 (Improving the Nation's Cybersecurity) and federal software supply chain guidelines, eTrepid Inc. maintains transparent Software Bill of Materials (SBOM) and Model Bill of Materials (MBOM) practices across its software assets and AI workflows.

2. Software Bill of Materials (SBOM) Standards

2.1 Required Data Formats

eTrepid generates and maintains SBOMs using the industry-standard CycloneDX and SPDX machine-readable formats.

2.2 NTIA Minimum Required Elements

Each generated SBOM record includes:

  • Supplier Name: Entity that created the component.
  • Component Name: Official identifier of the software package.
  • Version String: Precise release identifier.
  • Other Unique Identifiers: Package URL (purl) or Common Platform Enumeration (CPE).
  • Dependency Relationship: Upstream and downstream component linkages.
  • Author of SBOM Data: Designated eTrepid DevSecOps generator.
  • Timestamp: Generation date and build commit SHA.

    • 3. Model Bill of Materials (MBOM) for AI Pipelines

    To ensure auditability across eTrepid AI-assisted systems, each deployed AI workflow is documented with an MBOM tracking:

  • Foundation Model Metadata: Model name, provider (e.g., Azure OpenAI), release date, and model version.
  • Context Grounding Sources: Hash and version of authoritative regulatory documents loaded into RAG vector stores.
  • Guardrail Configuration: Active safety filters, prompt templates, and output validation policies.

    • 4. Supply Chain Vulnerability Management

    SBOM datasets are integrated into automated vulnerability scanners to continuously monitor for newly disclosed Common Vulnerabilities and Exposures (CVEs) in deployed dependencies, ensuring rapid triage and patch deployment.

    ← Previous (Technical & Operational Standards)Secure Software Development (SSDLC)Next (Restricted Companion Summaries) →Corporate SSP Executive Summary