KPIs and Metrics - Dependencies, SBOM and SCA
Scope and purpose
The indicators of this domain assess the capacity of an organisation to know, control and react to the risk introduced by software dependencies. Dependency management is a highly quantifiable domain: the SBOM is a structured artefact, CVEs have normalised CVSS scores, and remediation deadlines are traceable with temporal precision.
The absence of visibility over dependencies is not a neutral position - it is the implicit acceptance of unquantified risk. These indicators turn that risk into actionable data.
The DEP indicators feed the cross-cutting dimensions T-01 (Control coverage), T-03 (Resolution speed) and T-05 (Supply chain).
Denominator and portfolio foundation
The indicators of this domain use as their denominator F-02 - applications with a formal risk classification (Ch. 01, CLA-K01). The percentages are interpretable only in relation to the set of applications classified at the relevant risk level - not in relation to the total portfolio or to ad-hoc subsets.
See kpis-governanca.md - section "Portfolio foundation" - for the SbD-ToE adoptability funnel and the relation between denominators.
Conventions
| Symbol | Meaning |
|---|---|
| ✔ | Mandatory threshold for this level |
| - | Not applicable or not mandatory at this level |
| ↓ | Inverse indicator - a lower value indicates better performance |
Thresholds are cumulative: L3 includes all the obligations of L1 and L2.
Indicator types:
| Code | Meaning |
|---|---|
| Q% | Quantitative, percentage |
| Q# | Quantitative, count |
| Qt | Quantitative, temporal (days) |
Indicator catalogue
| ID | Indicator | Type | L1 | L2 | L3 | Dim. T | Period |
|---|---|---|---|---|---|---|---|
| DEP-K01 | % of applications with an SBOM generated automatically and updated at each release | Q% | ≥ 50% | ≥ 90% | 100% | T-01, T-05 | Per release |
| DEP-K02 | % of critical CVEs (CVSS ≥ 9.0) in direct dependencies mitigated within SLA | Q% | ≥ 70% (SLA: 30d) | ≥ 90% (SLA: 7d) | 100% (SLA: 3d) | T-03 | Continuous |
| DEP-K03 | % of high CVEs (CVSS 7.0–8.9) in direct dependencies mitigated within SLA | Q% | ≥ 60% (SLA: 90d) | ≥ 80% (SLA: 30d) | ≥ 95% (SLA: 15d) | T-03 | Monthly |
| DEP-K04 | # of direct dependencies without an active maintainer (EOL, abandoned ≥ 24 months) in production | Q# ↓ | ≤ 5 | ≤ 2 | = 0 | T-05 | Quarterly |
| DEP-K05 | % of pipelines with automated SCA integrated with a blocking gate for critical CVEs | Q% | ≥ 60% | ≥ 90% | 100% | T-01 | Monthly |
| DEP-K06 | % of dependencies with a licence incompatible with organisational policy active in production | Q% ↓ | - | = 0% | = 0% | T-05 | Quarterly |
| DEP-K07 | % of L3 applications with an SBOM delivered to relevant stakeholders (GRC, procurement, customer) | Q% | - | - | ≥ 80% | T-05 | Per major release |
Complementary definitions
DEP-K02/K03 - Mitigation SLA: the SLA counts from the date of publication of the CVE in NVD/OSV, or from the date of detection by the SCA scanner, whichever is later. Valid mitigation includes: update of the dependency, removal of the dependency, or a formal documented exception with compensation (which suspends the counter but does not close the indicator).
DEP-K04 - Abandoned dependency: a dependency is considered to have no active maintainer when the repository has had no relevant commits for ≥ 24 months AND there is no active long-term support version. Dependencies with an active internal fork are excluded from this count if the fork has a documented patch policy.
DEP-K05 - Blocking gate: the SCA only counts for this indicator if it blocks the pipeline in the event of a critical CVE without a formal exception. SCA in report-only mode does not satisfy this criterion.
DEP-K06 - Incompatible licence: defined by the organisational licensing policy. In the absence of a formal policy, the reference used is incompatibility with strong copyleft licences (GPL v3, AGPL) in the context of proprietary software, or licences without OSI approval in an open-source context.
Collection and instrumentation
| Indicator | Primary source | Reference tools | Automation |
|---|---|---|---|
| DEP-K01 | Build pipeline; release register | Syft, CycloneDX, SPDX tools | Yes |
| DEP-K02/K03 | SCA scanner + NVD/OSV feed | Grype, Trivy, Snyk, Dependabot | Yes |
| DEP-K04 | SCA scanner + repos.github.com / deps.dev | OSS Insight, deps.dev API | Partial |
| DEP-K05 | Pipeline configuration (YAML audit) | Pipeline inspection + SCA results | Partial |
| DEP-K06 | SCA licence scanner | FOSSA, LicenseFinder, Snyk License | Yes |
| DEP-K07 | GRC delivery register / contract | Manual or GRC integration | No |
SLA thresholds per level - summary
| Severity (CVSS) | L1 | L2 | L3 |
|---|---|---|---|
| Critical (≥ 9.0) | 30 days | 7 days | 3 days |
| High (7.0–8.9) | 90 days | 30 days | 15 days |
| Medium (4.0–6.9) | 180 days | 90 days | 45 days |
| Low (< 4.0) | 365 days | 180 days | 90 days |
These thresholds are a baseline reference. Sectoral regulation (DORA, NIS2) may impose shorter deadlines, which prevail.
Cross-references
| Document | Relation |
|---|---|
addon/00-catalogo-requisitos.md | Requirements DEP-001..010 that underpin the indicators |
addon/08-rastreabilidade-vulnerabilidades.md | CVE → application → resolution traceability model |
addon/09-excecoes-e-aceitacao-risco.md | CVEs without resolution within SLA require a formal exception |
Ch. 14 kpis-governanca.md | Cross-cutting dimensions T-01, T-03, T-05 |