After an AI supply-chain tabletop, the county begins inventorying AI components with SBOM and MBOM practices. What control objective is that?
Select an answer to reveal the explanation.
Short Explanation
SBOMs and MBOMs are the packing list for software and models—so you know what you shipped. Matching SBOM data to CVE feeds for daily patch planning is a follow-up task, not the inventorying objective itself.
Full Explanation
After an AI supply-chain tabletop, inventorying components with SBOM and MBOM practices implements a concrete control objective: municipalities need authoritative lists of software libraries, containers, and model artifacts so vulnerability, licensing, and provenance tracking can scale. Software bills of materials cover code dependencies; model bills of materials cover weights, tokenizers, and related artifacts. Together they turn tabletop lessons into operational visibility across county AI services rather than one-off tribal knowledge. Assessments should treat SBOM/MBOM adoption as the measurable outcome of the exercise—not commemorative or facilities follow-ups.
Correlating SBOM data with CVE feeds to guide daily civic AI patch planning work describes a downstream task, not the control objective itself. Checking build attestations to verify trusted sources of the new civic AI model release and enforcing signed deployed model artifacts to block tampering in new civic AI delivery chains both describe adjacent supply-chain controls, not the SBOM/MBOM inventorying objective — they are separate practices, not evidence that the county is doing something else entirely.
Exam caveat: checking build attestations without tying them to SBOM/MBOM inventories still leaves blind spots—completeness and continuous generation in CI matter as much as the initial spreadsheet. Operational check: enable SBOM generation on every civic AI build, store MBOM entries for production models with hashes and licenses, map critical CVEs to inventoried packages within an agreed SLA, and sample-audit that tabletop action items closed with living inventories rather than static slides.