MCM-62 — Open Source License Compliance & SBOM Deliverable

← Back to Legal & Compliance Readiness overview

As Engineering Lead,
I want an automatically generated, current Software Bill of Materials and a clean open-source license audit,
so that MCM can hand a customer or their security team a compliant SBOM on request, and no shipped module carries an incompatible open-source license obligation.

Acceptance Criteria

• A Software Bill of Materials (CycloneDX or SPDX format) can be generated for every deployable module — discovery, finops, governance, secops, orchestration, observability, and the AI assistant — covering all direct and transitive dependencies.
• Every dependency's license is classified as approved, restricted, or prohibited against a documented license policy; no prohibited license (e.g., copyleft terms incompatible with proprietary distribution) is present in a shipped build.
• Any restricted-license dependency has a documented exception approved by Legal Counsel before release.
• The SBOM is regenerated and reviewed as part of every release, not produced ad hoc only when a customer asks for it.
• Required attribution notices for included open-source components are compiled and available to ship alongside the product.

Technical Design

This builds on the SBOM checklist already underway: the audit runs against every module's actual dependency tree at release time, flags anything outside the approved license list, and produces the CycloneDX/SPDX artifact used both as an internal release gate and as the document handed to a customer's security team on request.