Join our Newsletter — 33% off our NHI Course
Foundations & NHI Taxonomy

@Component

← Back to Glossary
By NHI Mgmt Group Updated November 3, 2026 Domain: Foundations & NHI Taxonomy

@Component is a Spring stereotype annotation that marks a class as a managed bean candidate. When component scanning finds it, Spring creates and manages the object in the application context, and other stereotypes are specialisations of the same underlying mechanism.

What @Component Means in Spring

@Component is part of Spring’s stereotype model: it marks a class as a managed bean candidate so component scanning can discover it and register it in the application context. That makes the class part of the container’s dependency graph rather than an ordinary Java object created manually by the application.

How Component Scanning Uses It

When Spring scans configured packages, it looks for stereotype annotations and turns matched classes into beans. @Component is the base stereotype, while other annotations such as @Service, @Repository, and @Controller are specialised forms that exist to communicate intent more clearly without changing the underlying bean registration mechanism.

That distinction matters because the annotation is about container management, not business logic. A class annotated with @Component may still be simple or complex, but its lifecycle, instantiation, and dependency injection are now controlled by Spring rather than by direct constructor calls or manual factory code.

Why It Matters for Application Design

@Component is often the smallest unit of Spring-managed structure, so it shapes how code is assembled, tested, and reasoned about. Once a class is container-managed, dependencies can be injected consistently, cross-cutting concerns can be applied through the framework, and object creation becomes a governed part of application startup instead of scattered across the codebase.

That also means placement and package structure matter. If component scanning does not reach a class, Spring will not create it as a bean, and any downstream injection points that expect it can fail at runtime or during context initialisation.

Common Misunderstandings

A frequent mistake is treating @Component as a generic “make this class available” flag. In practice, it only works within Spring’s scanning and configuration model, so the annotation is effective only when the application context is set up to discover it. Another common misunderstanding is assuming that all stereotype annotations are materially different; most of the time they differ mainly in semantic clarity, not in the core bean-registration mechanism.

Another subtle point is that @Component does not by itself define scope, transactionality, persistence behaviour, or web exposure. Those concerns come from other annotations, framework conventions, or explicit configuration layered on top of the bean lifecycle that @Component enables.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
NIST SP 800-53 Rev 5IA-5 — Authenticator ManagementCovers how Spring-managed components depend on controlled secret and credential handling.
Recommendation — Apply IA-5 to manage any credentials or tokens injected into Spring-managed components.
NIST CSF 2.0PR.AA-01 — Identity Management, Authentication, and Access ControlSupports how managed beans participate in controlled application access and trust boundaries.
Recommendation — Define access and trust boundaries for application components under PR.AA-01.
ISO/IEC 27001:2022A.8.9 — Configuration managementApplies because component scanning and bean registration are configuration-driven application behaviour.
Recommendation — Control Spring component registration through disciplined configuration management.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org