Target architecture

The end-to-end picture

Code repositories
     │
     ▼
CI/CD chain ──► SBOM generation ──► validation ──► signing
     │                                               │
     │                                               ▼
     │                                       Artefact registry
     │                                       (artefact + SBOM + signature)
     ▼                                               │
Steering platform ◄──────────── ingestion ───────────┘
     ▲                  │
     │                  ├──► policy engine ──────► CI (blocking)
     │                  ├──► targeted alerts ────► ticketing tool
     │                  ├──► dashboards ─────────► leadership
     │                  └──► exports ────────────► technical documentation
     │
Vulnerability sources
 EUVD · OSV · NVD · vendor advisories · confirmed-exploitation catalogues

Evidence vault (10-year archive, immutable, indexed)
     ▲
     └── signed SBOMs · VEX · technical files · declarations · registers

ENISA single reporting platform ◄── 24 h / 72 h warnings, reports
Customer portal ◄── SBOMs · security advisories (CSAF) · VEX

The flows, one by one

Flow	From → to	Protocol	Frequency	Owner
SBOM publication	CI → platform	API	Every publishable build	Product team
Vulnerability ingestion	Sources → platform	Feeds and API	Daily	CISO
Policy decision	Platform → CI	API	Every build	CISO
Alert	Platform → tickets	API	On event	PSIRT
Evidence export	Platform → vault	Signed export	Every shipped version	Compliance
Reporting	PSIRT → ENISA platform	Dedicated interface	On event	PSIRT + Legal
Customer publication	Platform → portal	CSAF export	Every advisory	PSIRT

Control points

Point	Condition to pass	Who can override
Publishable build	Valid SBOM, score above threshold, signature present	Nobody — a technical prerequisite
Promotion to production	No critical exploitable vulnerability without a VEX; no denied licence	CISO (vulnerabilities), Legal (licences), via a dated waiver
Placing on the market	Legal checklist complete	Legal, in a formal review

Sovereignty and data location

Three questions to settle explicitly and document:

Where are your SBOMs hosted? They describe the composition of your products; aggregated, they are sensitive information.
What data leaves the Union? A hosted platform outside Europe implies a transfer, with the contractual and, where relevant, regulatory consequences that follow.
What happens if the platform is unavailable? Should builds fail? The degraded mode must be defined, tested, and its maximum acceptable duration set.

A robust answer keeps everything with evidential value in the internal evidence vault, independently of the platform. The platform is a working tool; the vault is the company’s memory.

Three scenarios by maturity

Minimal — open tooling, zero software cost

Open generator in CI, self-hosted steering platform, evidence vault on existing object storage in immutable mode, manual reporting with templates.

For whom: a limited portfolio, mostly default-category products, a small security team. Cost: essentially operations and engineering time. Limits: little file-content licence detection, no reachability analysis, correlation to refine.

Intermediate — hybrid

Open generation, open steering platform, complemented by a commercial product on the licence and intellectual property side, which is where the gap between open and commercial offerings is widest.

For whom: a diverse portfolio, customer requirements on licence compliance.

Complete — enterprise platform

Integrated commercial platform, reachability analysis, file-hash detection, integration with the artefact registry, customer portal.

For whom: important or critical products, a large installed base, strong contractual requirements, a staffed PSIRT.

The choice follows the grid in Selection criteria. The recommendation is to start with the minimal scenario: it validates the processes, reveals the real needs, and provides a factual baseline for any later evaluation.