Supply Chain & Software Bill of Materials — Project Plan

1. Overview

Establish visibility and risk-based remediation for software components. Follows: Inventory → Intake → Remediate → Gate → Evidence.

2. Phases

Phase 0 — Charter and Alignment

Confirm pilot system, risk-based timelines, and ownership.

Phase 1 — Inventory

Produce or consume a software bill of materials for the pilot. Inventory vendor and cloud-service authorization status.

Phase 2 — Intake

Establish vulnerability disclosure intake and risk-based prioritization.

Phase 3 — Remediate and Gate

Track at least one finding to closure. Require recorded authorization before new software-as-a-service provisioning.

Phase 4 — Evidence

Emit component and remediation records. Name the supply-chain risk acceptance owner.

3. Success Measures

  • Software bill of materials available for pilot.
  • One risk-based remediation tracked to closure.
  • Vendor authorization status inventoried.
  • New software-as-a-service gated on recorded authorization.
  • Evidence available.
  • Risk acceptance owner named.

4. Immediate Next Actions

  1. Identify the pilot system for software bill of materials.
  2. Inventory vendor authorization status.
  3. Define risk-based timelines and ownership.
  4. Establish the software-as-a-service gating rule.

Project artifact. No internal architectural decision record identifiers.

Back to top