Make the build process automated, repeatable and free of avoidable risk, and know and control the third-party components the build consumes. Streams: Build Process; Software Dependencies.
Partly covered — 75%. The controls beneath it are covered in some of the places your profile required them and not in others.
No single control answers this requirement outright, so the 2 partial mappings your profile required are averaged.
Closing the 9 scopes listed here would move your overall coverage by 6.4 percentage points — exactly, over the same denominator the headline uses.
Counted toward this requirement These produced the number above.
Dependency Composition Scan ● 18 of 18 scopes
Partial mapping · high confidence
What it is Third-party dependencies of the application are resolved and checked against known vulnerability data on every build. Why it matters Most of the code being shipped was not written by the team, and a dependency becomes vulnerable long after it was chosen. Why it maps SB-B: knowing and evaluating the third-party components the build consumes.
Covered everywhere your profile required it.
Vulnerable Dependency Gate ◐ 9 of 18 scopes
Partial mapping · high confidence
What it is A build that pulls in a dependency with a critical, fixable vulnerability is stopped rather than shipped. Why it matters Knowing about a critical, fixable dependency vulnerability and shipping anyway is the ordinary path by which known issues reach production. Why it maps SB-B at higher maturity: a component that violates the dependency policy stops the build.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point Development Java Release Release Gate Development Spring Boot Release Release Gate Development React Release Release Gate Test Java Release Release Gate Test Spring Boot Release Release Gate Test React Release Release Gate
Your profile never required these The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.
SBOM Generated at Build not required
Partial mapping · high confidence
Why it maps The component inventory SB-B expects, produced by the build rather than assembled later.
Build Provenance Attestation not required
Partial mapping · medium confidence
Why it maps SB-A asks for a build process that is defined, repeatable and evidenced; an attestation of how and from what an artefact was built is that evidence.
Artifact Signed at Build not required
Partial mapping · medium confidence
Why it maps SB-A at higher maturity: the build output carries verifiable integrity.
Supporting only, never counted A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.
Automated Dependency Updates ● 9 of 9 scopes
Supporting · medium confidence
Why it maps Keeps the dependency set current, which is how SB-B findings actually get closed.
SBOM Retained per Release not required
Supporting · medium confidence
Why it maps Makes the inventory answerable after the fact, for a release that already shipped.
License Inventory not required
Supporting · low confidence
Why it maps One attribute of the dependency inventory. SB-B is concerned mainly with security risk in components; licence risk rides along.
