Generate and steer: the two levels

This is the most expensive misunderstanding in the field, and the page that conditions everything else. Many organisations buy a platform without reliable generation, or generate thousands of SBOMs that nobody aggregates.

The diagram

┌─────────────────────────────────────────────────────────────────┐
│  LEVEL 1 — APPLICATION / TEAM                   « GENERATE »     │
│                                                                  │
│  Where?   In the CI/CD chain, at every build                     │
│  Who?     The development team, DevSecOps                        │
│  What?    Produce a faithful inventory of THIS artefact          │
│  Tools    Syft · Trivy · Grype · cdxgen · osv-scanner ·          │
│           native Maven, Gradle, npm, .NET, Cargo plugins         │
│  Output   A signed CycloneDX or SPDX file, tied to the artefact  │
│  Grain    1 SBOM = 1 artefact = 1 build                          │
│  Time     Instant, frozen, immutable                             │
└──────────────────────────────┬──────────────────────────────────┘
                               │  automated ingestion (API)
                               ▼
┌─────────────────────────────────────────────────────────────────┐
│  LEVEL 2 — ORGANISATION / PORTFOLIO             « STEER »        │
│                                                                  │
│  Where?   In a central platform, continuously                    │
│  Who?     CISO, PSIRT, Compliance, Product management            │
│  What?    Aggregate, retain, correlate daily, decide             │
│  Tools    OWASP Dependency-Track · Snyk · FOSSA ·                │
│           Black Duck · Mend · Sonatype · JFrog Xray              │
│  Output   Portfolio view, targeted alerts, VEX, reports,         │
│           items for the technical file and for authorities       │
│  Grain    N products × M versions × K components                 │
│  Time     Continuous, historised, re-evaluated daily             │
└─────────────────────────────────────────────────────────────────┘

The six differences

	Application level — generate	Organisation level — steer
Question asked	“What is inside this artefact?”	“Which of your products contain this component?”
Trigger	A build	A newly published vulnerability
Owner	Product team	PSIRT, CISO, Compliance
Frequency	Every publishable build	Daily re-evaluation of the estate
Output	A file	A dashboard, alerts, reports, an API
Without it	No data: nothing is possible	Thousands of unusable files

What each level demonstrates under the CRA

Requirement	Level that covers it
Annex I, Part II, point 1 — component inventory	Generation
Annex VII — SBOM in the technical documentation	Generation (+ archiving)
Annex I, Part II, point 2 — address vulnerabilities without delay	Steering
Annex I, Part II, point 3 — regular tests and reviews	Both
Annex I, Part II, point 4 — publish advisories	Steering
Art. 14 — report within 24 h knowing the affected scope	Steering
Answering an authority request about an old version	Steering (+ archiving)

The CRA requires both. Point 1 mandates the inventory; points 2, 3, 4 and 7 mandate a continuous process, which a file sitting next to an artefact cannot demonstrate.

The classic mistake, named

“You put a scanner in CI, you are compliant.”

No. A scanner in CI tells you what is wrong now, here, in this build. It does not tell you:

• which versions already shipped to customers contain the vulnerable component;
• what has become vulnerable since the last build, without any code changing;
• what affected scope to declare in a 24-hour early warning;
• what version 4.2.1 shipped in 2028 contained, when an authority asks in 2033.

The mirror mistake also exists: buying a platform without reliable generation. The platform then displays misleading coverage, fed by partial SBOMs produced by hand.

The message by audience

For Legal. Level 1 produces the item in the technical documentation. Level 2 produces the evidence of the continuous process. Without the first, the file is incomplete; without the second, you can neither answer an authority nor meet a 24-hour deadline.

For Cyber. Do not confuse the scanner with the platform. These are not two competing products: they are a chain, and the missing link is almost always the second.

For leadership. Two budget lines, two owners, two timelines. Level 1 is deployed team by team, gradually. Level 2 is a cross-cutting platform that must exist before SBOMs pile up with nowhere to go.

Deployment order

1. Choose the pivot format and pin the toolchain per product family.
2. Deploy the steering platform, even minimally, before generalising generation.
3. Generalise generation, publishing systematically to the platform.
4. Turn on continuous monitoring once coverage is meaningful.
5. Add blocking policies, in warning mode first, then blocking.

Deploying in that order avoids the most common situation: teams that have diligently generated SBOMs for eighteen months, while nobody can answer the question that matters.