K07 · evidence-bundled critical-infrastructure assurance

Hardware and Manufacturing Bill of Materials

Direct answer

Hardware and Manufacturing Bill of Materials provides bounded component or provenance evidence and must be combined with authenticity, installed-state, vulnerability, custody, and recovery evidence.

Stable record: SCA-K07-002
Claim status: PROJECT TECHNICAL PROPOSAL
Last reviewed: 2026-08-16
Research cutoff: 2026-08-16
Source type: GOVERNED PROJECT KNOWLEDGE
Currentness: Current for release 2.1.0; external sources require periodic revalidation.
Correction state: No unresolved public correction recorded for this release.
Machine record: Static JSON record

Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.

Artifact class

Supply-chain record
Stable ID	`SCA-K07-002`
Artifact type	HBOM/MBOM

Required fields

assembly and component identifiers
manufacturer and supplier
part and revision
country or facility where contractually required
firmware association
criticality
counterfeit and substitution status

Validation expectations

component naming consistency
approved-vendor comparison
substitution review
critical-part traceability
sample physical inspection

Limitations

supplier declarations require verification
does not expose hidden fabrication steps automatically
completeness is contract-specific

Source relationships

CISA Hardware Bill of Materials Framework for Supply Chain Risk Management — Cybersecurity and Infrastructure Security Agency; September 2023 framework; OFFICIAL FRAMEWORK. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.
NIST SP 1326 — Cybersecurity Supply Chain Risk Management Due Diligence Assessment Quick-Start Guide — National Institute of Standards and Technology; Final; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.

Assurance boundary

Inventory, signature, attestation, supplier status, vulnerability status, and installed configuration remain separate evidence properties. This record does not certify a product or prove that a deployed asset matches its declared bill of materials.