AI BOM and Model Supply Chain Policy
Organisational policy that defines the treatment of AI models, datasets, MCP servers/tools, embedded prompts and AI providers as an auditable supply chain — AI BOM generation per build in a standardised format (CycloneDX 1.6 ml-bom), version pinning, a list of approved providers and response to upstream incidents, complementing Policy 10 (dependencies) and Policy 11 (SBOM), proportionate to the criticality level (L1, L2, L3).
Dependencies, SBOM and SCA Requirements Catalogue
Canonical catalogue of security requirements for the management of third-party dependencies (DEP-001 to DEP-010), with applicability by risk level and acceptance criteria for SBOM, SCA, library governance and update policies.
SBOM (Software Bill of Materials) Policy
Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).