Governing third-party components
Inventory, license and maintenance health, and a policy gate before a dependency ever ships.
Governing the open-source and third-party components you pull in — inventory, health, and a policy gate before anything new gets adopted. Related: The CRA incident-reporting clock · A CRA-grade patch process.
Inventory what you depend on
Every direct and transitive component od the SBOM, in one list — because you can't govern what you can't see.
Check licence and health
Each component's licence, release cadence, and maintainer activity — the signals that tell you if it'll still be maintained next year.
Gate before adoption
A new dependency clears a policy check — licence, maintenance, known vulnerabilities — before it's allowed into the build.
Assign an owner
Each significant component gets an internal owner accountable for watching it — so an upstream problem has someone waiting for it.