What you’ll be able to do
- Describe an SBOM as provenance evidence for components, not as a control that makes ShopCart secure.
- Place a finding on a four-step ladder: inventory, exploitation evidence, exposure, business context.
- Use CISA KEV as one input, including the possibility that a finding is absent from the catalog.
- Write a deferral or compensating control with an owner and a review date when CVSS alone would overstate urgency.
An SBOM records what shipped. It does not secure it
When the ShopCart build emits a software bill of materials, Maya has a formal inventory of components and relationships. That inventory can show that fictional leftpad-lite was in the image. It does not patch leftpad-lite, and it does not prove the webhook check from the first lesson. NIST’s Executive Order 14028 FAQ maps subsection 4e(vii), “Provide a software bill of materials (SBOM) for each product,” to SSDF task PS.3.2. In SP 800-218 Version 1.1, PS.3.2 is to collect, safeguard, maintain, and share provenance data for all components of each software release, for example in an SBOM. Provenance here is origin of components. The evidence lesson uses the same word for origin of a log. Both mean you can say where it came from and what you do not have.
A03’s prevention list says to generate and manage SBOMs centrally, track transitive dependencies, and watch CVE, NVD, and OSV. Those are monitoring habits. Owning an SBOM file is not a mitigating control for a vulnerable component. SSDF is also not, by itself, a complete EO attestation.
Four steps before you call it an emergency
S2 already queues vulnerabilities with separate columns for severity, exploitation evidence, exposure, and impact. This lesson uses the same habit on a component. Step one: the inventory hit. The SBOM or lockfile shows the component in a build you actually ship. Step two: exploitation evidence. CISA’s Known Exploited Vulnerabilities catalog is the authoritative list of vulnerabilities exploited in the wild. Inclusion needs a CVE ID, reliable evidence of active exploitation, and a clear remediation action. Organizations should use the catalog as an input to prioritization, not as the only input. Step three: exposure. Is the component on an internet-facing path, behind authentication, or in a job that cannot reach it? Step four: business context. Data class, uptime, and the change window.
Absence from KEV is not a promise of safety. A CVSS-like score is not the priority. Two findings with the same “High” label can differ because one is being exploited on an exposed service and the other is not reachable. Say which input you used. Do not invent a real CVE or a KEV row.
| Step | Question | ShopCart example |
|---|---|---|
| Inventory | Is it in a build we ship? | SBOM lists the component under shopcart-api |
| Exploitation evidence | Is there reliable in-the-wild use, including KEV? | Not listed. Say so. |
| Exposure | Who can reach the code path? | Offline batch job, not internet-facing |
| Business | What does the calendar and the data allow? | Month-end freeze in two days |
Worked deferral: a synthetic finding, not a real CVE
The case is synthetic. Finding-ID FINDING-SYNTH-2026-0042. Teaching alias CVE-SYNTH-2026-0042. That alias is not an NVD record and not a KEV listing. A simulated scanner label says 7.5 High. KEV search for the alias is empty because the alias is not real. Exposure: the library is used only in an offline batch job, not in the public API, and not in a privileged container. Business: a month-end freeze starts in two days, and the available fix is a major version bump.
Maya does not open an emergency change because the label says High. She also does not delete the row. She writes: inventory confirmed on the SBOM; no KEV and no other in-the-wild evidence in hand; exposure limited to the offline job; defer the major bump until after the freeze; compensating control is deny egress from that job except to the known batch destination; owner is Devon; review date is the first business day after the freeze; watch the real OSV and NVD feeds for the actual component, not for the synthetic alias. The vulnerability lab, “Patch the right thing first,” practices a different queue. Use these same four questions there.
CHECK YOUR JUDGMENT