SCITT vs SBOM.
Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.
When to lead with SCITT.
Audience. supply-chain integrity, transparency, trust · IETF.
Shape. receipt · brass roll edge + brass corner seal.
Where it lives in the record. The SCITT cite-anchor pins next to every artifact in ATTESTATION.json. See the SCITT brief for the field-level mapping.
When to lead with SBOM.
Audience. software bill of materials · NTIA + CISA.
Shape. crate · brass manifest header.
Where it lives in the record. The SBOM cite-anchor pins next to every artifact in ATTESTATION.json. See the SBOM brief for the field-level mapping.
Both at once.
Planisphere's evidence record is multi-control by construction. SCITT and SBOM are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.
The requirement list is open — add any standard the regulator names. See the full compliance-control register.