What's the difference between SBOM and C-SCRM?

SBOM (software bill of materials · NTIA + CISA) and C-SCRM (supply-chain risk · NIST SP 800-161r1) are distinct cite-anchors. Planisphere's evidence record maps both controls for evaluator review; sufficiency remains evaluator-specific.

Do I need both SBOM and C-SCRM in my record?

If both apply to your tool deployment, yes — and the record maps both controls in one artifact at no extra cost.

Comparison · register 09

SBOM vs C-SCRM.

Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.

Scope an AI workflow review SBOM brief C-SCRM brief

01 ·

When to lead with SBOM.

Use SBOM as the primary anchor when the evaluator is shaped this way.

Audience. software bill of materials · NTIA + CISA.

Shape. crate · brass manifest header.

Where it lives in the record. The SBOM cite-anchor pins next to every artifact in ATTESTATION.json. See the SBOM brief for the field-level mapping.

02 ·

When to lead with C-SCRM.

Use C-SCRM as the primary anchor when the evaluator is shaped this way.

Audience. supply-chain risk · NIST SP 800-161r1.

Shape. linked chain · 3 rings · brass middle link.

Where it lives in the record. The C-SCRM cite-anchor pins next to every artifact in ATTESTATION.json. See the C-SCRM brief for the field-level mapping.

03 ·

Both at once.

The evidence record maps both anchors for review — you don't have to pick.

Planisphere's evidence record is multi-control by construction. SBOM and C-SCRM are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.

The requirement list is open — add any standard the regulator names. See the full compliance-control register.

Compare AI options for compliance