Enum ComplianceLevel 

#[non_exhaustive]
pub enum ComplianceLevel {
    Minimum,
    Standard,
    NtiaMinimum,
    CraPhase1,
    CraPhase2,
    FdaMedicalDevice,
    NistSsdf,
    Eo14028,
    Cnsa2,
    NistPqc,
    BsiTr03183_2,
    CraOssSteward,
    EuccSubstantial,
    EuAiAct,
    BsiSbomForAi,
    Cisa2026,
    PciDss632,
    Fsct,
    Comprehensive,
}

Compliance level/profile

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Minimum

Minimum viable SBOM (basic identification)

Standard

Standard compliance (recommended fields)

NtiaMinimum

NTIA Minimum Elements compliance

CraPhase1

EU CRA Phase 1 — Art. 14 reporting obligations (apply from 11 Sep 2026)

CraPhase2

EU CRA Phase 2 — full application of the regulation (from 11 Dec 2027)

FdaMedicalDevice

FDA Medical Device SBOM requirements

NistSsdf

NIST SP 800-218 Secure Software Development Framework

Eo14028

Executive Order 14028 Section 4 — Enhancing Software Supply Chain Security

Cnsa2

NSA CNSA 2.0 — Commercial National Security Algorithm Suite 2.0

NistPqc

NIST PQC Readiness — Post-Quantum Cryptography migration (IR 8547 + FIPS 203/204/205)

BsiTr03183_2

BSI TR-03183-2 v2.1.0 (German national CRA-aligned SBOM technical guideline, 2025-08-20). Free, ENISA-cited; stricter than NTIA on eligible formats (CycloneDX 1.6+ / SPDX 3.0.1+) and hashes (SHA-512).

CraOssSteward

CRA Article 24 — Open-source software steward profile (lighter obligations than CraPhase1/2). SBOM, vulnerability handling process, and CVD policy are still required; manufacturer email, EU DoC, and conformity-assessment-module gating are NOT.

EuccSubstantial

EUCC Substantial assurance level (Reg. (EU) 2024/482) — reference-only profile for Annex IV products. Verifies that the SBOM/sidecar carries a Common-Criteria Protection-Profile reference, Target-of-Evaluation reference, ITSEF identifier, and a valid-until date. Does not perform a Common-Criteria evaluation itself.

EuAiAct

EU AI Act (Regulation (EU) 2024/1689) Annex IV technical-documentation READINESS. Maps the Annex IV documentation obligations for high-risk AI systems onto the AI-BOM metadata sbom-tools already parses (model card, training-data characteristics, validation/testing metrics, limitations, energy disclosure). This is a documentation-readiness assessment, not a legal-conformity guarantee, and does not classify a system as high-risk. Returns N/A for SBOMs with no ML-model or dataset metadata.

BsiSbomForAi

BSI/G7 “SBOM for AI — Minimum Elements” (final joint G7 guidance, May 2026) READINESS. Scores an AI-BOM element-by-element against the seven clusters (Metadata, System-Level, Models, Datasets, Infrastructure, Security, plus the document-author elements) of the BSI/G7 minimum-elements guidance, using the AI-BOM metadata sbom-tools already parses (model card, training-data characteristics, weight hashes with NIST-approved algorithms, dataset provenance). This is a minimum-elements readiness assessment, not a legal-conformity guarantee. Returns N/A for SBOMs with no ML-model or dataset metadata.

Cisa2026

“2026 Minimum Elements for a Software Bill of Materials (SBOM)” v2.1 (CISA/NSA/FBI + 15 international partners, July 29, 2026) — the finalized successor to the NTIA 2021 Minimum Elements. Adds SBOM author signature, generation context, tool name/version, SBOM version, component hashes + algorithms, and licenses to the 2021 data-field floor; renames Supplier Name to Component Producer. Non-binding joint guidance (it creates no regulatory requirements).

PciDss632

PCI DSS v4.0.1 Requirement 6.3.2 — inventory of bespoke and custom software and incorporated third-party components, maintained to facilitate vulnerability and patch management (required in assessments since 31 March 2025). PCI DSS prescribes no SBOM format; a parseable CycloneDX/SPDX document is the industry-consensus evidence, so no format gate applies. Companion controls 6.3.1 and 11.3.1.1 are covered where the SBOM embeds vulnerability data.

Fsct

CISA “Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)”, Third Edition (2024-09-03, published 2024-10-15). Community-consensus baseline-attribute guidance with three maturity tiers mapped onto severities: Minimum Expected → Error, Recommended Practice → Warning, Aspirational Goal → Info. Non-regulatory; Error here means “fails the Minimum Expected tier”, not a legal violation.

Comprehensive

Comprehensive compliance (all recommended fields)

Implementations

impl ComplianceLevel

pub const fn name(&self) -> &'static str

Get human-readable name

pub const fn short_name(&self) -> &'static str

Get compact tab label (max ~8 chars) for terminal display.

pub const fn description(&self) -> &'static str

Get description of what this level checks

pub const fn all() -> &'static [Self]

Get all compliance levels

pub const fn is_cra(&self) -> bool

Whether this level is a CRA check. Includes the lighter Article 24 open-source steward profile, since stewards still operate under the regulation (just with reduced obligations).

pub const fn cra_phase(&self) -> Option<CraPhase>

Get CRA phase, if applicable

Trait Implementations

impl Clone for ComplianceLevel

fn clone(&self) -> ComplianceLevel

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ComplianceLevel

impl Debug for ComplianceLevel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ComplianceLevel

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ComplianceLevel

impl PartialEq for ComplianceLevel

fn eq(&self, other: &ComplianceLevel) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ComplianceLevel

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ComplianceLevel