Platform overviewCryptographic inventoryCBOMCrypto agilityPQC migrationCI drift control
All solutionsFinancial servicesGovernmentHealthcareSoftware companies
SecurityPricing
GuidesPQC migration guideNIST PQC standardsCryptographic inventoryCompareIntegrations
Start a scanSee the platformSign in

CBOM guide

Cryptographic bill of materials: what a CBOM contains and how to use it

A CBOM makes cryptographic assets portable and machine-readable. Its value depends on discovery quality, preserved relationships, provenance, and the operating process around the file.

Start a scan See pricing

Decision brief

Primary query
cryptographic bill of materials
Best for
Teams that need reviewable cryptographic evidence, ownership, and continuous migration control.
Safety boundary
Evidence supports decisions; it is not proof of implementation safety or compliance.

A cryptographic bill of materials can represent algorithms, keys or key references, certificates, protocols, and related cryptographic material, together with relationships to software components. CycloneDX introduced core CBOM structures in version 1.6 and expanded cryptographic transparency in version 1.7. Producers and consumers should explicitly agree on the version and validation rules.

Generation should capture scope, scanner and rule versions, time, source revision, evidence confidence, and exclusions. A schema-valid CBOM can still omit important assets or include false positives. Pair automated validation with sample-based review and retain a way to navigate from each exported component back to the evidence that caused it to be included.

Capabilities

What the operating model needs to do

01

Asset representation

Describe cryptographic components with normalized names, types, parameters, and relationships.

02

Provenance

Record how, when, where, and with which rules the CBOM was created.

03

Validation

Check schema conformance, identifiers, relationships, duplicates, and evidence coverage.

04

Change analysis

Compare CBOMs across builds to identify added, removed, or modified cryptography.

Workflow

A repeatable path to evidence

Use explicit scope, accountable decisions, and verification gates. Keep unknowns visible so progress is not manufactured by narrowing the denominator.

  1. 1

    Choose the contract

    Select CycloneDX version, output format, naming conventions, and consumer requirements.

  2. 2

    Generate from evidence

    Create cryptographic assets from reviewed source, dependency, configuration, and endpoint observations.

  3. 3

    Validate and sign

    Validate the schema and process; apply organizational artifact integrity controls where required.

  4. 4

    Operationalize

    Store, diff, query, and connect CBOM changes to policy and migration workflows.

Expected deliverables

Artifacts the next team can inspect

  • CBOM consumer contract
  • CycloneDX JSON artifact
  • Provenance and scope metadata
  • Validation and review results
  • Build-to-build change report

Buyer checklist

Questions for a proof of value

  1. 01Which CycloneDX version is produced?
  2. 02Can exported assets be traced to evidence?
  3. 03Are component relationships retained?
  4. 04How are uncertainty and unsupported assets represented?
  5. 05Can the CBOM be regenerated and diffed in CI?

Limits and cautions

What this page does not promise

  • CBOM is sometimes expanded as Cryptography Bill of Materials and sometimes Cryptographic Bill of Materials.
  • A valid CBOM is not a compliance certificate.
  • Do not include private key material in portable inventory artifacts.

Primary sources

Continue evaluating

Related decision pages

PQC migration guide

Post-quantum cryptography migration: an operating roadmap

A practical roadmap for PQC inventory, prioritization, standards tracking, vendor dependencies, interoperability testing, rollout, verification, and drift control.

Read page

CNSA 2.0 guide

CNSA 2.0 planning: inventory, policy, migration evidence, and limits

Use current NSA sources to plan CNSA 2.0-related inventory and migration work while keeping applicability, implementation validation, and compliance decisions with the proper authority.

Read page

NIST PQC standards guide

NIST post-quantum cryptography standards: what migration teams need to track

A current, source-led guide to FIPS 203, FIPS 204, FIPS 205, ongoing NIST work, inventory, implementation testing, and migration governance.

Read page

Cryptographic inventory software

A cryptographic inventory your engineering teams can keep current

Discover cryptographic assets in source, dependencies, configuration, containers, and authorized TLS endpoints. Preserve evidence, ownership, and change history in one inventory.

Read page
Local-first discovery

Start with evidence from one representative repository

Run a scoped scan, inspect every result, export the CBOM, and decide whether the evidence is strong enough to support your operating model.

Create a workspace