software component
163558·updated Aug 30, 2026A discrete, self-contained unit of executable code — such as a library, module, middleware, or framework — that provides a defined function or set of functions within a larger system. It is distinguished from the system as a whole by its bounded scope, its independently addressable identity (origin, version, license, known vulnerabilities), and its composability with other such units. In security, compliance, and supply-chain risk management, the field uses the expression to identify the tractable units that must be inventoried (e.g., in a Software Bill of Materials), assessed for provenance and vulnerability, and governed across the software development lifecycle.
Source
(i.e., hardware, firmware, and software components) that are critical tothe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Official websites use .gov
- SUPPLY CHAIN SECURITY FOR ENTERPRISE INFRASTRUCTURE_
- NIST SP 800-161 Supply Chain Risk Management Guide | C-SCRM | Petronella
- Software Component definition
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A discrete, identifiable unit of executable code — such as a library, module, driver, application, or package — that forms one layer of a larger system stack alongside hardware and firmware. In security and compliance frameworks (e.g., NIST SP 800-53, SP 800-161, and EO 14028 supply-chain guidance), it is used as a **compositional** inventory concept: practitioners enumerate software components as distinct, trackable artifacts that can individually carry vulnerabilities, provenance obligations, and integrity requirements. The term gains operational weight in contexts such as Software Bills of Materials (SBOMs), supply-chain risk management, and system-component inventories, where each software component must be identified, attributed to a supplier, and continuously monitored.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- software components
- possessive
- software component's
- pluralpossessive
- software components'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 3 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A discrete, self-contained unit of executable code — such as a library, module, middleware, or framework — that provides a defined function or set of functions within a larger system. It is distinguished from the system as a whole by its bounded scope, its independently addressable identity (origin, version, license, known vulnerabilities), and its composability with other such units. In security, compliance, and supply-chain risk management, the field uses the expression to identify the tractable units that must be inventoried (e.g., in a Software Bill of Materials), assessed for provenance and vulnerability, and governed across the software development lifecycle.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A discrete, identifiable unit of executable code — such as a library, module, driver, application, or package — that forms one layer of a larger system stack alongside hardware and firmware. In security and compliance frameworks (e.g., NIST SP 800-53, SP 800-161, and EO 14028 supply-chain guidance), it is used as a **compositional** inventory concept: practitioners enumerate software components as distinct, trackable artifacts that can individually carry vulnerabilities, provenance obligations, and integrity requirements. The term gains operational weight in contexts such as Software Bills of Materials (SBOMs), supply-chain risk management, and system-component inventories, where each software component must be identified, attributed to a supplier, and continuously monitored.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.