Free scorecard · 18 questions · about 4 minutes
Could you answer for your SBOM
without looking?
Eighteen questions about how it is made, trusted, watched, and defended. Four minutes if you know your process, and a graded report with a prioritised plan at the end.
If some answers would need looking up, that is worth knowing too.
No sign-up to start; your answers stay in your browser until you choose to save your report.
The scorecard
Eighteen questions, one at a time
Choose the answer closest to where you are today. Selecting an answer moves you to the next question, and you can go back at any point.
Before we start · 1 of 2
0 of 18 answered
When is your next regulatory submission?
What it measures
Four disciplines, one grade
Creating an SBOM is the easy part. Whether it would get you notified about a vulnerability, and whether it would satisfy the reviewer reading it, depends on the discipline around it. The scorecard grades all four.
- Generate.
- Does your SBOM cover what actually ships? An SBOM is only useful if it describes what actually ships, all of it, as built.
- Trust.
- Could a vulnerability database actually match your components? Every component needs an identifier a vulnerability database can match. A small error here and the vulnerability exists, the database knows about it, and you are never told. The same identifiers decide what a reviewer’s own tools find when they check your submission.
- Watch.
- Is anything actually monitoring it? An SBOM nobody monitors is a photograph, not a smoke alarm.
- Prove.
- Would it hold up in front of a reviewer? At submission time the SBOM stops being an engineering artefact and becomes evidence.
Not sure whether Section 524B applies to your device? Start with Is my device a cyber device? and come back when you know.
The report
What you get
- A grade, not a score dump.
- One overall grade with a score out of 100, and a separate grade for each of the four disciplines.
- What is already working.
- The strengths worth keeping, so a low grade in one discipline does not read as starting from zero.
- A prioritised plan.
- Each gap ordered by priority with a suggested horizon, and submission blockers marked as exactly that.
- A private link.
- Your report arrives by email as a private link you can return to or share with your team.
“These are the checks I run when a manufacturer asks me to look at their SBOM before a submission. The same gaps come up every time. This scorecard is those checks, written down.”