Bill of materials

Provenance

by RODMENA

Hardware and software bills of materials, and the evidence packs produced from them.

Provenance records all devices the company holds, who holds them and their state. It also records the components in all releases, deduplicated by package URL across the estate. Security findings are joined to both, and whether an advisory affects us becomes a lookup. Exports are organised by control reference, and their sections state what the register does and does not evidence. All exports are recorded in a hash-chained audit log.