SBOM vs SLSA v1.0.
Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.
When to lead with SBOM.
Audience. software bill of materials · NTIA + CISA.
Shape. crate · brass manifest header.
Where it lives in the record. The SBOM cite-anchor pins next to every artifact in ATTESTATION.json. See the SBOM brief for the field-level mapping.
When to lead with SLSA v1.0.
Audience. supply-chain levels for software artifacts.
Shape. ascending staircase · 3 tiers · brass target rung.
Where it lives in the record. The SLSA v1.0 cite-anchor pins next to every artifact in ATTESTATION.json. See the SLSA v1.0 brief for the field-level mapping.
Both at once.
Planisphere's evidence record is multi-control by construction. SBOM and SLSA v1.0 are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.
The requirement list is open — add any standard the regulator names. See the full compliance-control register.