software component

No definition is given in NIST SP 800-171r3. The term is attested in use at 3 citations in that document; a definition is pending curation.

Increment 2: attested in 800-171r3 without a glossary definition.

A discrete, self-contained unit of executable code — such as a library, module, middleware, or framework — that provides a defined function or set of functions within a larger system. It is distinguished from the system as a whole by its bounded scope, its independently addressable identity (origin, version, license, known vulnerabilities), and its composability with other such units. In security, compliance, and supply-chain risk management, the field uses the expression to identify the tractable units that must be inventoried (e.g., in a Software Bill of Materials), assessed for provenance and vulnerability, and governed across the software development lifecycle.

DR-088 backfill from the noun definition column

A discrete, identifiable unit of executable code — such as a library, module, driver, application, or package — that forms one layer of a larger system stack alongside hardware and firmware. In security and compliance frameworks (e.g., NIST SP 800-53, SP 800-161, and EO 14028 supply-chain guidance), it is used as a **compositional** inventory concept: practitioners enumerate software components as distinct, trackable artifacts that can individually carry vulnerabilities, provenance obligations, and integrity requirements. The term gains operational weight in contexts such as Software Bills of Materials (SBOMs), supply-chain risk management, and system-component inventories, where each software component must be identified, attributed to a supplier, and continuously monitored.

Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.