Component Health

SBOM component quality: PURL coverage, hash integrity, supplier attribution, license completeness.


Short name	Health
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Health

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for Health.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Health and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CH-NTIA-ID` Unique Component Identifiers	Components should carry a package URL so they can be uniquely referenced and correlated across tools and databases (NTIA Minimum Elements - unique identifiers; PURL spec)	Scan
`CH-NTIA-COMP` Name and Version Completeness	Every component entry should state both its name and its version, the two baseline NTIA data fields for describing a component (NTIA Minimum Elements - component name, version of the component)	Scan
`CH-NTIA-SUP` Supplier Attribution	Each component should name its supplier, the party that creates, defines and identifies the component (NTIA Minimum Elements - supplier name)	Scan
`CH-CDX-HASH` Integrity Hashes	Components should include cryptographic hashes of their artefacts so consumers can verify integrity, per the hashes field of the CycloneDX component model and SPDX package checksums (CycloneDX spec - component.hashes; SPDX - PackageChecksum)	Scan
`CH-SPDX-LIC` Licence Completeness	Components should declare licence information so downstream legal obligations can be evaluated, per SPDX licence expression fields and the CycloneDX licenses element (SPDX spec - PackageLicenseDeclared; CycloneDX - component.licenses)	Scan
`CH-NTIA-DEP` Dependency Relationships	The SBOM should characterise the relationships between components, not merely list them, so transitive exposure can be analysed (NTIA Minimum Elements - dependency relationship)	Scan
`CH-NTIA-AUTH` SBOM Author and Timestamp	The SBOM itself must record who created it and when, the NTIA author-of-SBOM-data and timestamp elements (NTIA Minimum Elements - author of SBOM data, timestamp)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CH-01`	PURL Coverage
`CH-02`	Cryptographic Hash Integrity
`CH-03`	Supplier Attribution
`CH-04`	License Completeness
`CH-05`	Version Pinning
`CH-06`	Namespace Presence
`CH-07`	Dependency Relationship Completeness
`CH-08`	Component Author / Maintainer Field

Policy templates

Written for Health:

SBOM Quality and Component Identity Policy
Component Dependency Relationship Completeness Policy
SBOM Generation Tooling Governance Policy

And 22 from the standard set, adapted to Health.