SLSA v1.0 vs SBOM.
Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.
When to lead with SLSA v1.0.
Audience. supply-chain levels for software artifacts.
Shape. ascending staircase · 3 tiers · brass target rung.
Where it lives in the record. The SLSA v1.0 cite-anchor pins next to every artifact in ATTESTATION.json. See the SLSA v1.0 brief for the field-level mapping.
When to lead with SBOM.
Audience. software bill of materials · NTIA + CISA.
Shape. crate · brass manifest header.
Where it lives in the record. The SBOM cite-anchor pins next to every artifact in ATTESTATION.json. See the SBOM brief for the field-level mapping.
Both at once.
Planisphere's evidence record is multi-control by construction. SLSA v1.0 and SBOM are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.
The requirement list is open — add any standard the regulator names. See the full compliance-control register.