What Is a Cryptographic Bill of Materials (CBOM)?
Everyone is being asked for one.
Until recently, most commercial security teams had never been asked for a cryptographic bill of materials. Now it shows up everywhere. Federal agencies have been required to provide an annual inventory of their quantum-vulnerable cryptography under OMB M-23-02 since 2023. Procurement questionnaires now ask vendors for one. Customers in regulated industries ask for it in security reviews. And CycloneDX introduced a standard format in version 1.6, so there is now a concrete answer to “send us your CBOM.”
The predictable result is that most organizations treat the CBOM the way they first treated the SBOM: as a document to produce. Someone runs a tool, exports a file, attaches it to the questionnaire, and meets the requirement.
That meets the requirement. It also throws away most of the value. A CBOM produced once to satisfy a request is a snapshot of a moving target, and the organizations that get the most out of them use them for something else entirely.
What Is a CBOM Good For?
A CBOM describes the cryptography inside a system: which algorithms, keys, certificates, and protocols it uses, and which components they belong to. That sounds like an inventory, and it is. The value is in what an up-to-date one lets you do quickly.
Find Where Cryptography Is Used
Answer “where do we use this?” in an afternoon. Every few years something in cryptography breaks — an algorithm is deprecated, a library has a serious vulnerability, a standard changes. Leadership’s first question is always the same: are we affected, and where? Without a current CBOM, that question kicks off a weeks-long hunt across teams. With one, it is a query.
Measure PQC Migration Progress
Measure whether the migration is actually moving. A single CBOM tells you where you are. Two of them, taken a quarter apart, tell you whether you are getting anywhere. Diffing them shows exactly what changed: which systems moved off RSA, which new services shipped with classical key exchange, which certificates were rotated. That is the only honest progress metric a post-quantum program has, and it is far more persuasive to a board than a count of findings.
Provide Cryptographic Evidence to Auditors and Customers
Give auditors and customers evidence, not assurances. “We are working on post-quantum readiness” is a statement. A current CBOM, in a standard format, tied to named systems, is evidence. It shortens security reviews and makes regulatory reporting an export, not an assembly task.
Support FedRAMP Cryptographic Requirements
Keep pace with FedRAMP’s new rules. FedRAMP’s Consolidated Rules for 2026, mandatory for all stakeholders from January 1, 2027, require cloud providers to document the cryptographic modules used in each service that protects federal customer data, including whether each is validated under NIST’s Cryptographic Module Validation Program. The rule does not name a CBOM, but it describes exactly what one holds. Because CR26 and FedRAMP 20x rely on current, machine-readable evidence rather than an annual assessment, an inventory that goes stale between reviews is a poor fit. A CBOM produced with every scan answers the question on the day it is asked, not on the day it was last exported.
Assess Cryptography in Your Supply Chain
Ask your suppliers the same question. Much of the cryptography in an estate arrived inside someone else’s product. A CBOM from a vendor tells you what you are inheriting before you deploy it, and gives procurement a concrete requirement rather than a checkbox to tick.
What a CBOM Cannot Tell You
The format is useful precisely because it is neutral, and that is also its limit. A CBOM records what is there. It does not tell you what any of it means, and treating it as though it does is where organizations get into trouble.
A CBOM Is Not a Risk Priority List
It is not a priority list. A CBOM lists RSA-2048 on a payment gateway and RSA-2048 on a forgotten test server identically, because, in the format, they are identical. Deciding which matters requires business context the CBOM does not carry.
A CBOM Is Not Proof Cryptography Is Actually in Use
It is not proof of use. A CBOM built from a static scan records what a system contains and is configured to support. As the first post in this series argued, that is not the same as what its connections actually negotiate. A CBOM listing ML-KEM on an endpoint says the capability is present; it does not say a single session has used it.
A CBOM Is Not a Remediation Plan
It is not a remediation plan. Knowing where every classical algorithm lives is necessary and nowhere near sufficient. Who owns each one, what depends on it, and what order they should change in are all outside what the document describes.
A Stale CBOM Can Be Misleading
And a stale one can be worse than none. A CBOM exported in March and attached to a questionnaire in September describes an estate that no longer exists. It is still a confident, well-formatted, standards-compliant document — which is exactly what makes it misleading. What if someone accidentally reintroduces a classical algorithm into the system? A CBOM’s value decays with age, and most organizations have no idea how old theirs is.
How SafeLogic CPM Keeps CBOMs Current and Actionable
SafeLogic CPM treats the CBOM as a byproduct of running the platform, not a separate deliverable. Every scan produces a CycloneDX CBOM for the asset it covered — hosts, CI builds, and GitHub repositories alike, with each repository getting its own. Because they come from the same continuous scanning that drives everything else, the CBOM is as current as the last scan rather than as current as the last time someone was asked for one, and scan history means posture can be compared across points in time rather than reconstructed.
CPM also works in the other direction. SBOMs and CBOMs an organization already has, or receives from suppliers, can be imported and merged onto the same correlated asset records rather than sitting beside them as a parallel inventory.
The gaps described above are the ones CPM fills around the CBOM, not inside it. The same asset records carry business context from the CMDB, so priority is available next to inventory. They carry what passive observation saw on the wire, so you can tell capability apart from actual use. And they feed remediation directly, so a line in the CBOM can become a change request.
Three Questions to Ask About Your CBOM
If your organization has produced a CBOM, or has been asked for one, these are worth asking:
- How old is it, and what would it take to produce a current one tomorrow?
- If a library we depend on were found vulnerable this afternoon, could we find every place it runs using our CBOM — or would we start a hunt?
- Can we compare this quarter’s CBOM to last quarter’s and see what our migration actually changed?
If the answers are “months,” “a hunt,” and “no,” the CBOM is doing the compliance job and none of the others. That is fixable, and it is mostly a matter of producing it continuously rather than on request.
If you would like to talk through how your CBOM could do more of that work, our team is available for a PQC consultation.
