What Is It?
A Cryptography Bill of Materials (CBOM) is a structured inventory of all cryptographic assets used in a software application, system, or infrastructure environment. Modeled on the Software Bill of Materials (SBOM), a CBOM lists algorithms, key sizes, protocols, certificates, cryptographic libraries, and their dependencies along with where they appear and what data they protect.
The CBOM is the prerequisite for every post-quantum readiness program. You cannot prioritize, plan, or execute a migration without first knowing what cryptography you have and where it is used. Organizations without a CBOM are operating with incomplete exposure data.
A CBOM entry typically includes: algorithm name and version, key size, protocol or mechanism it appears in, system or component that uses it, data classification of what it protects, and a vulnerability assessment against quantum attacks.
Why Does It Matter?
Most organizations do not have a complete picture of their cryptographic exposure. Algorithms appear in TLS configurations, code-signing workflows, database encryption at rest, hardware security modules, vendor-supplied software, embedded firmware, container images, and dozens of other locations. Many cryptographic uses are invisible to application developers because they are buried inside third-party libraries or managed infrastructure.
Without a CBOM, organizations cannot determine which systems are at harvest-now-decrypt-later risk, which vendor dependencies are blocking migration, or where to focus scarce engineering resources. Migration planning built on incomplete data produces incomplete results.
OMB M-23-02 (December 2022) explicitly requires federal agencies to inventory all quantum-vulnerable cryptographic systems as the first step of their migration programs. CISA's PQC migration guidance echoes this requirement. The CBOM is not an internal best practice; it is a documented government and regulatory prerequisite.
How It Works
A CBOM is produced through a combination of scanning, monitoring, and auditing techniques, applied systematically across all system categories.
Static analysis
Scanning source code and compiled binaries for calls to cryptographic libraries and hardcoded algorithm parameters. Identifies cryptographic usage at build time.
Dynamic analysis
Monitoring network traffic, API calls, and runtime behavior to identify cryptographic operations in actual use. Catches algorithms used by dependencies that static analysis may miss.
Dependency scanning
Tracing third-party libraries and their transitive cryptographic dependencies. Many cryptographic vulnerabilities live several layers deep in the dependency graph.
Configuration audits
Reviewing TLS cipher suite configurations, certificate authority hierarchies, key management system settings, and HSM configurations.
Hardware inventories
Identifying cryptographic operations in firmware, secure enclaves, TPMs, and hardware-based key storage. These often represent the hardest migrations because of long device lifetimes.
Enterprise Impact
The CBOM is not a one-time artifact. Cryptographic usage changes as software evolves, dependencies are updated, and infrastructure is modified. A living CBOM requires integration into ongoing development and operations.
Integration with SBOM processes
Cryptographic components should be tracked alongside other software dependencies. CycloneDX has extended the SBOM format to include cryptographic asset tracking (CBOM).
CI/CD integration
Cryptographic scanning should run on every build, not only during periodic audits. New algorithm introductions should trigger review.
Vendor transparency
Suppliers should be required to provide CBOMs for their software and hardware. Purchasing contracts should require disclosure of cryptographic algorithms used.
Risk classification
Each CBOM entry should be classified by algorithm vulnerability to quantum attack, data sensitivity, data retention period, and migration complexity. This classification drives the migration roadmap.
NIST Guidance
Multiple standards bodies have formalized cryptographic inventory requirements.
NIST IR 8547 (draft)
Discusses cryptographic inventories as a prerequisite for post-quantum migration planning in federal systems.
OMB M-23-02
Directs federal agencies to inventory all quantum-vulnerable cryptographic systems as the first migration step.
CISA PQC Guidance
Recommends beginning with a complete inventory of quantum-vulnerable cryptography before any migration activity.
CycloneDX CBOM
An open specification extending SBOM to cover cryptographic asset tracking, including algorithm, key size, and protocol metadata.