How do we handle mitigating supply chain software risks when third-party vendors refuse to share their dependency trees?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How do we handle mitigating supply chain software risks when third-party vendors refuse to share their dependency trees?
1 real search · 1 real-search pass
CISA SBOM minimum elements supplier software transparency vendor SBOM refusal compensating controls NIST SSDF SP 800-161Google ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 1 queries…
Searches and sources
ChatGPT1 real searches · gpt-6
CISA SBOM minimum elements supplier software transparency vendor SBOM refusal compensating controls NIST SSDF SP 800-161 Google ↗
- Appendix F of NIST SP 800-161r1-upd1 (November 1, 2024) · tsapps.nist.gov
- Software Security in Supply Chains: Software Bill of Materials (SBOM) · nist.gov
- SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations · csrc.nist.gov
- Software Security in Supply Chains · nist.gov