SBOM compliance