CycloneDX Attestations
Compliance-as-code: an attestation that requirements of a standard are met, backed by claims and evidence.
Spec focus
declarations[], standards, claims, evidence
Graph labels
BomDocument, Standard, Requirement, Attestation, Claim, Evidence
Lifecycle
post-build
Mapping. definitions.standards and declarations are split into Standard, Requirement, Attestation, Claim, and Evidence nodes.
Extension. Evidence can point at a Component, Task, or CryptoAsset already in other BOMs — attestations are not an island.
Documents
HarborPulse SSDF / SCVS Attestation
urn:uuid:7a2e1c90-aa11-4b33-9d01-cdxa0010
Subject — · v1 · 2026-03-22T12:00:00Z
Open in graphNeighborhood
Drag to pan · scroll to zoom · 5 nodes · 4 edges
Select a node to inspect CycloneDX properties.
Sample Cypher
All BOM documents
Every CycloneDX document in the Atlas graph, with its type.
Attestation coverage
Claims, the requirements they satisfy, and supporting evidence.
Components shared across BOM types
Inventory that appears in more than one BOM variety — the knowledge-graph payoff.
Knowledge concept overlay
How CycloneDX instances map onto the Atlas ontology.
Graph size by label
How many Atlas nodes exist for each CycloneDX class.
Neighborhood of HarborPulse API
One- and two-hop context around the application component.
Claims, evidence, and conformance against named standards.