SBOM and suppliers
SBOM, supplier risk, and post-market monitoring
An SBOM is useful only when it connects to risk decisions, supplier oversight, vulnerability monitoring, and update planning. A list of components is the start; lifecycle control is the evidence story.
Evidence to collect
- Component inventory with version, supplier, license, and device relevance.
- Vulnerability triage rules for exploitability, patient impact, compensating controls, and update urgency.
- Supplier security evidence for critical components, cloud services, firmware, and outsourced software.
- Patch and update process linked to verification, release control, and customer communication.
- Residual risk rationale when a vulnerability is accepted, deferred, or mitigated by another control.
VigilySys helps identify missing links between SBOM items, cyber risks, supplier evidence, mitigation requirements,
and post-market monitoring tasks.