K07 · evidence-bundled critical-infrastructure assurance

Supply-Chain Assurance

Direct answer

Critical-datacenter supply-chain assurance requires multiple linked inventories and evidence records; no SBOM, signature, supplier statement, or attestation independently proves security or installed state.

Stable record: K07-SCA-INDEX
Claim status: PROJECT TECHNICAL PROPOSAL
Last reviewed: 2026-08-16
Research cutoff: 2026-08-16
Source type: GOVERNED PROJECT KNOWLEDGE
Currentness: Current for release 2.1.0; external sources require periodic revalidation.
Correction state: No unresolved public correction recorded for this release.
Machine record: Static JSON record

Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.

Cyber-physical supply-chain record families

SBOM

Software Bill of Materials

supplier; component name; version; unique identifier

6 validation expectations · 3 explicit limitations

HBOM/MBOM

Hardware and Manufacturing Bill of Materials

assembly and component identifiers; manufacturer and supplier; part and revision; country or facility where contractually required

5 validation expectations · 3 explicit limitations

FBOM

Firmware Bill of Materials and update chain

device or component identity; firmware version and hash; boot chain; signing identity

5 validation expectations · 3 explicit limitations

AI-BOM/MODEL-BOM

Model and AI-system Bill of Materials

model identifier and hash; base model and adapters; training and evaluation lineage; software and tool dependencies

5 validation expectations · 3 explicit limitations

DATA-BOM

Data provenance, quality, and usage rights

dataset identity; source and acquisition authority; collection and processing dates; transforms

5 validation expectations · 3 explicit limitations

DUE-DILIGENCE-RECORD

Supplier and product due diligence

supplier identity and ownership; product criticality; security and quality history; vulnerability handling

5 validation expectations · 3 explicit limitations

SIGNATURE-AND-ATTESTATION-CHAIN

Cryptographic provenance, custody, and revocation

signer or attester identity; key fingerprint; algorithm and parameters; signed payload hash

5 validation expectations · 2 explicit limitations

DEFECT-REGISTER

Vulnerability, defect, and nonconformance state

affected item; finding identity; severity and consequence; exploitability or failure precondition

5 validation expectations · 3 explicit limitations

DELIVERY-MANIFEST

Configuration and delivery chain of custody

build identity; source commit or release hash; builder and environment; dependencies

4 validation expectations · 3 explicit limitations

RECOVERY-DEPENDENCY-RECORD

Supply-chain recovery and concentration impact

single-source dependencies; replacement lead time; spares and license availability; key and update service dependency

5 validation expectations · 3 explicit limitations

No single BOM is enough

A software inventory cannot describe hardware provenance, firmware state, model lineage, dataset rights, supplier custody, revocation, or recovery concentration. K07 keeps these evidence types separate and connects them through declared relationships.