What we assessModel provenance and integrityOpen-source modelsDependencies and package securityDataset provenanceSBOM and AIBOMDependency pinningCI/CD controls