docs(fda): component support metadata and the cyber device evidence pack - #16017
Merged
Merged
Conversation
Three changes, covering the cyber device work end to end. The Locations SBOM page gains the supplier and support fields a component now carries, and a section on where those facts come from: what each import format supplies, that unknown is a valid recorded answer rather than a guess, and the order a per-snapshot override, a recorded value and unknown resolve in. An edit made by hand survives a later import, and the support source field is what tells a reviewer which case applies. The SBOM export page gains the supplier and support properties each format emits, and says plainly that a component with an unknown support level emits no property at all, because a consumer reading a support level should be reading a claim somebody made rather than a placeholder. A new page covers the cyber device profile, the three lifecycle metrics, the assessment and the evidence pack. It describes each of the seven elements in our own words with the statute cited, says which nine controls are evidenced from data and which four are the manufacturer's paperwork, and states plainly that DefectDojo records and reports what the manufacturer supplies, does not assess whether a bill of materials is complete or accurate, and does not determine whether a submission satisfies the FDA. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The page sits one level down, so reaching another top-level section takes two levels up rather than one. The sibling link inside this section is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
devGregA
enabled auto-merge
September 21, 2026 13:41
blakeaowens
approved these changes
Sep 21, 2026
Maffooch
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Documents the FDA cyber device work: the component supplier and support metadata, how imports supply it, the properties the SBOM export emits, and the cyber device profile, lifecycle metrics and evidence pack.
Three changes.
Working with SBOMs gains the supplier and support fields a component now carries, and a section on where those facts come from. What each import format supplies, that unknown is a recorded answer rather than a guess, and the order a per snapshot override, a value on the component, and unknown resolve in. An edit made by hand survives a later import of the same component, and the support source field is what tells a reviewer whether a fact was imported or entered.
Exporting SBOMs and VEX gains the supplier and support properties each format emits, and says plainly that a component whose support level is unknown emits no support property at all. A consumer reading a property named support level should be reading a claim somebody made, not a placeholder.
A new page covers the cyber device profile, the three lifecycle metrics, the assessment and the evidence pack. It describes each of the seven elements in our own words with the statute section cited, gives the table of which controls are evidenced from which data, and names the four that are the manufacturer's own paperwork and are answered by hand.
The new page states plainly that DefectDojo records and reports what the manufacturer supplies, does not assess whether a software bill of materials is complete or accurate, and does not determine whether a submission satisfies the FDA.
Documentation only. No code changes.