SBOM

Explanation

SBOM checks that the AI system keeps a complete, up-to-date Software Bill of Materials — a full inventory of every component, model, library, and dependency it relies on — because you cannot secure, patch, or trace the provenance of components you have not catalogued; for a bank this is the backbone of supply-chain integrity, enabling rapid impact assessment when a new vulnerability or compromised dependency is announced. It is measured by SBOM Completeness (metric and calcMethod identically named): the proportion of the system's components that are recorded in a current SBOM. Implement it by automatically generating the SBOM during each build, reconciling it against what is actually deployed, and flagging any component that is missing from or stale in the inventory; log the SBOM version, generation date, and per-component coverage so completeness is verifiable. Operate it as a continuous, pipeline-integrated process refreshed on every build and dependency change. The threshold requires 100% of components to have a current SBOM entry: any component missing from the SBOM, or any SBOM that has gone stale, is a breach that must be alerted on and corrected before deployment proceeds, in line with this control's Immediate priority.