This is the map of the whole journey. Each step links to a detailed guide, but the shape is simple: every version page is a workbench titled "Get this version submission-ready", and it walks you through the steps in order.
1. Import an SBOM
Upload a CycloneDX, SPDX or CSV file from the project's SBOMs tab, or push it automatically from your CI pipeline. The import parses components, inherits metadata from the previous version, validates against FDA rules, and scans for vulnerabilities. See Import your first SBOM.
2. Fill missing component data
Click Run enrichment on the version workbench. Threat Detective fills gaps in licence, supplier, and end-of-support data from external sources such as the CPE database and endoflife.date. These are the fields FDA reviewers expect to see populated.
3. Triage vulnerabilities
Work through the findings with Start triage queue. Critical and high severity findings need a decision before the version can be released; low and medium findings can be addressed in post-market and don't block release. Each decision is recorded with an audit trail and feeds your VEX exports (VEX is the standard format for stating each vulnerability's status).
4. Release the version
When the workbench steps are green, mark the version as Released. Released SBOMs are treated as immutable evidence: they can't be silently replaced, which is exactly what you want for a submission record.
5. Export your submission package
From the workbench or the project's Reports tab, download the submission package: six PDF exhibits covering SBOM analysis, inventory, vulnerability risk assessment, mitigation plans, support status and supply-chain risk, in one ZIP. Machine-readable exports (CycloneDX, SPDX, OpenVEX, CycloneDX VEX, CSV) are available alongside.
6. Keep watch after release
Released versions are re-scanned automatically as new advisories land, and decisions come back for review when circumstances change (for example, when a vulnerability is added to CISA's KEV catalogue, the US list of vulnerabilities known to be exploited in the wild). The released workbench's Mark as reviewed checkpoint records your post-market surveillance reviews.
That's the loop: import, enrich, triage, release, export, monitor. Everything else in this help centre is detail on one of those six steps.