SBOMs enable which practice in supply chain risk management?

• A. Enforcing password changes every 90 days.
• B. Blocking all external network access by default.
• C. Identifying all components and known vulnerabilities.
• D. Encrypting source code at rest.

Answer: (C)

SBOMs support supply chain risk management by providing a clear inventory of what makes up the software—every component, library, and dependency, along with versions and origins. With that visibility, security teams can map each component to known vulnerabilities in public databases (such as CVEs) and track which products include those at-risk components. This makes it possible to identify all components and their known vulnerabilities across a software portfolio and prioritize remediation.

For example, if a specific library version has a CVE, the SBOM lets you quickly see whether that exact library is used in your software, enabling you to assess exposure and plan patches or replacements.

The other options describe controls unrelated to SBOMs: enforcing password changes, blocking external network access, and encrypting source code at rest are different security measures focused on authentication, network security, and data protection, not on cataloging software components and their vulnerabilities.