Confirm what was delivered
Match the component identity and version to the installed package, build record and supplier information.
Worked example / Software inventory
Industrial gateway SBOM example
One gateway. Two releases. Follow a component update through the inventory, its dependency relationships and the questions a release review needs to answer.
CycloneDX 1.6 · JSON · Fictional teaching example
PRODUCT RELEASEIndustrial gateway
v1.1.0update-agentVersion changed
Update client
1.0.01.1.0
Component identity stays consistent across the two inventories.
01 / Read the inventory
The version tells only part of the story.
An SBOM ties the released product to its components. Stable references let you follow those components through dependency relationships and compare what changed in the next release.
Component / identifierVersion
02
One component version changes
The update client moves from 1.0.0 to 1.1.0. The API, adapter and recorded dependency relationships stay the same.
02 / Review the change
An updated version needs an updated review.
The inventory records a change in the update client. Whether that change addresses a vulnerability depends on the package identity, the deployed build and the evidence for the fix.
Declared dependencies
gateway
gateway-apiprotocol-adapter
protocol-adapter
update-agent
The product references all three components. The management API also references the protocol adapter.
Revisit relevant findings
Check which findings apply to this component and whether their affected-version and configuration conditions still hold.
Support the treatment decision
Use fix information and applicable verification results to decide the next action. Retain the reasoning with the product release.
03 / Source files
Two files. A change you can inspect.
Download the CycloneDX inventories used on this page. Inspect the product version, component references and dependency entries in a text editor or SBOM tool.
Fictional names and versions illustrate the structure. Package identifiers and delivery coverage need to be completed for a real product.Further reading
Methods, examples and practical questions
Start with your product architecture, software inventory and existing analysis, then develop the security records you need.
Create a product