Software bill of materials (SBOM)
A structured list of every code library and package a piece of software depends on, used in software supply chain security to trace exposure when a vulnerability is discovered in a shared dependency; the direct conceptual ancestor of the AI bill of materials.
Defined in 3 GAGE programs, which carry 4 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
An itemized, machine-readable inventory of every component and dependency inside a piece of software, required of federal software vendors in the United States under Executive Order 14028 (2021). Functions as a lineage map for software supply chains specifically, and is vulnerable to the identical name-versus-verification gap this topic teaches unless each listed dependency also records how it was pinned and verified, not just what it is called.
A documented inventory of a software product's components, recommended as a transparency practice under Executive Order 14028's software supply chain security directive.
An itemized, typically signed record of every software component
A structured list of every code library and package a piece of software depends on, used in software supply chain security to trace exposure when a vulnerability is discovered in a shared dependency; the direct conceptual ancestor of the AI bill of materials.
Where it is taught
The exact lessons this term appears in. The first 7 topics of every program are free with a free account.
- Datasheets and the AI bill of materials: the paperwork that travels with the data · Feeding the Machines, Certified AI Data Governance Professional (CADGP)
- Your lineage map under attack: the red team finds the gap you papered over · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
- Security and Red-Teaming: Adversarial Attacks, Prompt Injection, Supply Chain · Technical Credibility Deep Dive, The AI Lobbyist: Certified AI Policy Strategist
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.