What Is a CBOM - and Why Your Auditor Will Ask for One
· Compliance · 5 min read
The new compliance baseline
If you've heard of a Software Bill of Materials (SBOM), think of a Cryptographic Bill of Materials (CBOM) as its cryptography-specific counterpart. It's a structured inventory of every cryptographic asset in your organization - certificates, keys, algorithms, protocols, and their configurations.
Why does it matter now? Because regulators are starting to require it.
What a CBOM includes
A complete CBOM catalogs:
| Asset Type | Examples |
|---|---|
| TLS Certificates | RSA-2048 certs on web servers, load balancers, APIs |
| Signing Keys | Code signing, document signing, JWT signing keys |
| Key Exchange | ECDHE, DHE, RSA key exchange in TLS handshakes |
| Symmetric Encryption | AES-128, AES-256, ChaCha20 usage |
| Hash Functions | SHA-1 (deprecated), SHA-256, SHA-384 in use |
| Protocols | TLS 1.0/1.1 (legacy), TLS 1.2, TLS 1.3 deployment |
| Certificate Authorities | Internal CAs, external CAs, trust chains |
For each asset, the CBOM records:
- Location (which server, service, or application)
- Algorithm and key length (RSA-2048, ECDSA P-256, etc.)
- Quantum vulnerability status (safe, vulnerable, or unknown)
- Expiration date and renewal status
- Business owner and criticality rating
Which frameworks require it?
Several regulatory frameworks now explicitly or implicitly require cryptographic inventory:
- NIST SP 800-208 - Approves stateful hash-based signature schemes (XMSS, LMS) for quantum-resistant code signing
- NSM-10 (2022) - National Security Memorandum directing federal agencies to inventory cryptographic systems and prepare for PQC migration
- RBI CSCRF (India) - Requires banks to maintain cryptographic asset registers
- MAS TRM (Singapore) - Technology risk management guidelines include cryptographic controls assessment
- ENISA PQC Recommendations (EU) - European guidance for PQC migration begins with cryptographic discovery
The manual approach doesn't scale
Traditional audit firms send consultants who spend weeks manually cataloging certificates and configurations. This approach has three fatal flaws:
- Point-in-time snapshot. By the time the report is delivered, your infrastructure has changed.
- Incomplete coverage. Manual audits miss internal services, CI/CD pipelines, vendor integrations, and hardcoded crypto.
- Cost. A specialized cryptographic audit from a major consulting firm can run $150K–$400K+ for a mid-size enterprise.
Automated CBOM generation
Platforms like Qypher use scanners and agents to discover and catalog cryptographic assets on a schedule across your infrastructure - external endpoints, internal services, cloud resources, CI/CD pipelines, and source code.
The result is a living CBOM that updates in real-time as your infrastructure changes, with each asset scored for quantum vulnerability and mapped to relevant compliance frameworks.
See what a scan finds on your public domains. Run a free scan →