https://compliancereference.com 2026-10-27T20:26:37.045Z daily 1 https://compliancereference.com/sections/provenance-custody 2026-10-16T19:41:37.588Z weekly 0.5 https://compliancereference.com/sections/vendor-and-supplier-risk 2026-10-27T20:26:37.045Z weekly 0.5 https://compliancereference.com/sections/compliance-frameworks 2026-10-22T18:51:44.797Z weekly 0.5 https://compliancereference.com/sections/cve-remediation-workflows 2026-09-26T06:10:27.941Z weekly 0.5 https://compliancereference.com/sections/sbom-audit-evidence 2026-09-15T23:48:51.067Z weekly 0.5 https://compliancereference.com/sections/security 2026-10-26T19:36:13.020Z weekly 0.5 https://compliancereference.com/sections/features 2026-09-09T17:01:43.448Z weekly 0.5 https://compliancereference.com/authors/marcus-tillford 2026-10-27T20:26:37.045Z weekly 0.4 https://compliancereference.com/authors/renata-osei-bonsu 2026-10-27T20:26:37.045Z weekly 0.4 https://compliancereference.com/authors/dmitri-vasilchenko 2026-10-27T20:26:37.045Z weekly 0.4 https://compliancereference.com/authors/priya-subramaniam 2026-10-27T20:26:37.045Z weekly 0.4 https://compliancereference.com/posts/qualifying-toolchain-vendors-on-architecture-resolved-dependency-guarantees https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/0dcb8c2b-de29-489a-b81c-3af2f8478e7f.jpeg 2026-10-27T20:26:37.045Z monthly 0.7 https://compliancereference.com/posts/prohibited-license-policy-enforcement-in-ci-pipelines https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/0f8937d4-1653-4621-a7ce-f1e612e82206.jpeg 2026-10-26T19:36:13.020Z monthly 0.7 https://compliancereference.com/posts/approved-dependency-allow-lists-as-machine-readable-policy https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/65ff8a2c-2354-4678-92f2-1464e70f2326.jpeg 2026-10-25T19:55:49.817Z monthly 0.7 https://compliancereference.com/posts/auditing-cross-architecture-toolchain-provenance-as-a-supplier-control-requireme https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/2a4721ee-1f41-44fb-ade5-81f3a585c687.jpeg 2026-10-24T19:00:38.102Z monthly 0.7 https://compliancereference.com/posts/iso-27001-2022-annex-a-controls-satisfied-by-sbom-programs https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/833a5ccc-f9e7-48ad-880b-9bf3dcb4addd.jpeg 2026-10-22T18:51:44.797Z monthly 0.7 https://compliancereference.com/posts/cmmc-2-0-level-2-supply-chain-practice-evidence-requirements https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/8599fc94-bba7-4ded-bce9-b074fac44681.jpeg 2026-10-21T18:36:27.400Z monthly 0.7 https://compliancereference.com/posts/fedramp-continuous-monitoring-sbom-requirements https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/a19e7896-331b-48a3-b976-63027c1a2a05.jpeg 2026-10-20T19:41:42.840Z monthly 0.7 https://compliancereference.com/posts/pci-dss-4-0-software-supply-chain-requirements-for-payment-systems https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/b272ce1c-fca1-4b85-aa39-555340c12c2b.jpeg 2026-10-18T19:15:56.670Z monthly 0.7 https://compliancereference.com/posts/cis-software-supply-chain-security-guide-alignment https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/03b2a793-3a47-48d3-95ed-d52fd89d5e77.jpeg 2026-10-17T20:36:03.863Z monthly 0.7 https://compliancereference.com/posts/third-party-component-provenance-in-software-acquisition-due-diligence https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/9580b920-8ee1-435b-a6b6-4ed1dbb8fa45.jpeg 2026-10-16T19:41:37.588Z monthly 0.7 https://compliancereference.com/posts/reproducible-build-verification-as-a-provenance-control https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/2ad086c6-d125-424a-9e78-25dc179598b7.jpeg 2026-10-14T20:56:30.034Z monthly 0.7 https://compliancereference.com/posts/artifact-registry-immutability-as-a-chain-of-custody-requirement https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/273099a5-7d46-41ba-b9a7-8e3753b746f4.jpeg 2026-10-13T19:57:11.915Z monthly 0.7 https://compliancereference.com/posts/build-environment-provenance-and-environment-drift-risk https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/f4ce5d8b-73c7-4716-a845-b334ad1e170a.jpeg 2026-10-12T19:31:40.095Z monthly 0.7 https://compliancereference.com/posts/nist-sp-800-218-ssdf-mapping-to-reproducible-build-controls https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/742689a8-3885-4a0b-a76e-0ce04205a22a.jpeg 2026-10-10T19:21:30.435Z monthly 0.7 https://compliancereference.com/posts/soc-2-common-criteria-coverage-by-reproducible-build-programs https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/4ba5c220-388a-427b-8413-3984328c7c56.jpeg 2026-10-09T20:00:09.493Z monthly 0.7 https://compliancereference.com/posts/license-compliance-risk-in-sbom-disclosed-dependencies https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/d0f7e688-d9ae-4a7f-b25b-b4aa30a06f71.jpeg 2026-10-08T19:20:25.565Z monthly 0.7 https://compliancereference.com/posts/vendor-sbom-validation-after-a-supply-chain-incident https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/751e1cac-f469-43b3-9038-033e87630ded.jpeg 2026-10-07T20:41:34.408Z monthly 0.7 https://compliancereference.com/posts/evaluating-supplier-reproducible-build-claims-in-procurement https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/161a33a0-dfbd-4587-a04e-cedfebe4178e.png 2026-10-05T19:35:55.806Z monthly 0.7 https://compliancereference.com/posts/sbom-requests-in-enterprise-software-vendor-questionnaires https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/83caa2ff-7f7e-4464-88c5-2b70ddb8bb0a.jpeg 2026-10-04T20:34:42.964Z monthly 0.7 https://compliancereference.com/posts/oss-dependency-risk-assessment-for-regulated-industries https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/19ce7752-86eb-4b9b-b4e8-b4b22fe97e64.jpeg 2026-10-03T19:09:43.895Z monthly 0.7 https://compliancereference.com/posts/multi-architecture-toolchain-supplier-risk-considerations https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/2c75c279-7a5e-4f68-aa92-186b0c12f181.jpeg 2026-10-02T19:30:40.091Z monthly 0.7 https://compliancereference.com/posts/sigstore-and-transparency-logs-in-compliance-contexts https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/00a725b1-52df-4bd5-8526-e5f66d9a1882.jpeg 2026-10-01T18:40:48.582Z monthly 0.7 https://compliancereference.com/posts/in-toto-attestations-as-regulatory-evidence https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/1dd7078a-1ce5-4c09-9700-d37397b222a1.jpeg 2026-09-30T16:26:14.653Z monthly 0.7 https://compliancereference.com/posts/slsa-framework-levels-and-their-compliance-implications https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/4f3ed7cf-b984-4ea2-b3e2-d415ed224513.jpeg 2026-09-29T06:55:39.570Z monthly 0.7 https://compliancereference.com/posts/hash-pinning-as-an-audit-chain-of-custody-mechanism https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/e7ca0585-871f-43ea-b933-e48c14051589.jpeg 2026-09-27T05:06:18.490Z monthly 0.7 https://compliancereference.com/posts/cve-remediation-evidence-requirements-under-cmmc-2-0 https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/f59ed590-2f71-4667-8168-a98cbd30698d.jpeg 2026-09-26T06:10:27.941Z monthly 0.7 https://compliancereference.com/posts/multi-team-cve-remediation-coordination-in-large-enterprises https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/f0bdf6b9-f320-4991-9070-d2ed7c3ac6a1.jpeg 2026-09-25T00:59:41.412Z monthly 0.7 https://compliancereference.com/posts/false-positive-cve-management-and-auditor-justification https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/cf2ef1b9-497f-43ca-9e4c-b9cc425e4a1f.jpeg 2026-09-24T00:15:22.103Z monthly 0.7 https://compliancereference.com/posts/cve-triage-process-for-compliance-teams-without-developer-access https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/6ee64440-a5b3-4380-87b3-d0c7690ed3a2.jpeg 2026-09-20T19:13:48.961Z monthly 0.7 https://compliancereference.com/posts/corrected-sbom-signing-and-distribution-after-remediation https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/02b67e12-5bb2-49e3-a7b4-0be3ec144e46.jpeg 2026-09-18T19:45:23.425Z monthly 0.7 https://compliancereference.com/posts/patch-sla-compliance-tracking-for-critical-cves https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/dfda1d0c-9dee-4194-8d6a-01a7f9e46b7e.jpeg 2026-09-17T18:39:52.291Z monthly 0.7 https://compliancereference.com/posts/pinned-dependency-tracing-in-sbom-queries https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/0ae5babb-e933-4ed3-926d-d43039cd1537.jpeg 2026-09-16T18:50:44.266Z monthly 0.7 https://compliancereference.com/posts/handling-sbom-gaps-for-proprietary-and-closed-source-components https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/da26f8a2-6a4f-4da6-beff-4204603cfc9f.png 2026-09-15T23:48:51.067Z monthly 0.7 https://compliancereference.com/posts/sbom-submission-requirements-under-fda-medical-device-guidance https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/75e084d5-ad20-489b-9de6-c52eca3f0b5b.jpeg 2026-09-15T23:03:31.300Z monthly 0.7 https://compliancereference.com/posts/sbom-attestation-acceptance-in-enterprise-procurement https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/68f935ba-9f6e-4288-9342-68d4066471ae.jpeg 2026-09-15T22:33:37.458Z monthly 0.7 https://compliancereference.com/posts/sbom-evidence-packages-for-soc-2-type-ii-auditors https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/d86a1d08-d448-4ddb-911e-f3261f1b47cb.jpeg 2026-09-13T03:02:36.591Z monthly 0.7 https://compliancereference.com/posts/continuous-sbom-generation-vs-point-in-time-snapshots https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/3d8e6812-5a7c-42ab-b6ea-dac88f7dfba0.jpeg 2026-09-12T03:41:53.538Z monthly 0.7 https://compliancereference.com/posts/eo-14028-sbom-minimum-element-requirements https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/660e81c9-cb46-4a07-98de-40cc576c9aa1.jpeg 2026-09-11T03:52:17.971Z monthly 0.7 https://compliancereference.com/posts/spdx-vs-cyclonedx-for-fedramp-auditors https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/9f2e57c7-822a-4d03-a7d1-43b8b9031619.jpeg 2026-09-10T02:16:33.811Z monthly 0.7 https://compliancereference.com/posts/software-supply-chain-risk-in-third-party-dependency-policies https://mcxtywzsmeezbwapdahq.supabase.co/storage/v1/object/public/canvas-images/bf99d458-afee-43f2-b192-9a081215c918/canvas/4f58b114-a15b-46ad-becd-fb0c59378b21/generated/ed660357-d0cf-45d8-a1ad-1539e248dc3f.png 2026-09-09T17:01:43.448Z monthly 0.7