Cryptography Bill of Materials
A CBOM is the list of every piece of cryptography your systems rely on.
A Cryptography Bill of Materials (CBOM) is a cryptographic inventory. It records which algorithms, protocols and certificates are in use, and how they relate to each other. A post-quantum migration starts with this list. You cannot replace an algorithm until you know where it runs. ClaveQ builds one passively from the traffic on your IT and OT networks, so you can see which connections can be trusted.
CycloneDX 1.7 (ECMA-424, 2nd edition) · schema-tested · built without sending a packet.
What goes in a CBOM
Four kinds of CBOM entry, and the dependencies between them.
A software bill of materials lists the components inside an application. A CBOM does the same for cryptography: a security team, an auditor or a migration tool can see exactly what is in use, and what depends on it.
Algorithms
Each algorithm in use, with its family, purpose and security level. ML-KEM-768 for key exchange, say, or AES-256-GCM for encryption.
Protocols
The protocol on each connection, such as TLS 1.3 or SSH, and the cipher suites the two sides actually negotiated, not the ones someone configured.
Certificates
The certificates presented, with their key size, wherever they are visible in the traffic. In practice that means TLS 1.2 and earlier; TLS 1.3 encrypts them.
Relationships
Which connection depends on which algorithm. When an algorithm turns out to be weak, you can trace it back to every connection it affects.
Background
A short history of the CBOM
The CBOM extends an older idea.
- 2021
A US Executive Order puts the software bill of materials (SBOM), a list of the components inside a piece of software, at the centre of US government software security.
- 2022
US federal agencies are directed to inventory their cryptography ahead of post-quantum migration.
- Dec 2022
IBM Research applies the same idea to cryptography and calls it a Cryptography Bill of Materials.
- Apr 2024
The CBOM becomes part of the open CycloneDX standard (version 1.6), which Ecma International publishes as ECMA-424.
- Mar 2025
The NCSC asks UK organisations to complete discovery by 2028.
- Jun 2026
US Executive Order 14412 directs CISA and NIST to publish the minimum elements of a CBOM, due in early 2027.
Sources: EO 14028 ↗ · IBM Research ↗ · CycloneDX 1.6 ↗ · ECMA-424 ↗ · US Public Law 117-260 ↗ · NCSC timeline ↗ · EO 14412 ↗
The standard
One open format, readable by any tool that supports CycloneDX.
Part of an existing standard
CBOM is part of CycloneDX, the bill-of-materials standard that OWASP maintains and Ecma International publishes as ECMA-424. Nothing locks your CBOM to our tools.
Not an NCSC or NIST format
Neither the NCSC nor NIST defines its own CBOM file format. The NCSC publishes the UK's recommended migration timeline; NIST publishes the post-quantum algorithms. A CBOM shows where you stand against both. In the US, Executive Order 14412 directs CISA and NIST to publish minimum CBOM elements, due in early 2027.
Tested against the official schema
We test ClaveQ's CBOM generator against the official CycloneDX 1.7 (ECMA-424) schema on every code change.
How CBOMs are built
Three ways to build a CBOM. Each sees something the others miss.
Most organisations will need more than one. The right mix depends on how much of your estate is software you build, servers you manage, and equipment you cannot install anything on.
| Method | What it sees | What it misses | Best suited to |
|---|---|---|---|
| Code and binary scanning | Cryptographic libraries and calls inside software you build or ship | How it is configured once running; devices whose software you cannot scan | Software and product teams |
| Host agents and configuration inventory | Cryptography on servers and laptops where an agent can be installed | Devices that cannot run an agent, such as PLCs and other control equipment | Managed IT estates |
| Passive network observation (ClaveQ) | The cryptography actually negotiated between devices — including equipment nothing can be installed on — and the traffic that has no encryption at all | Keys and data stored at rest; traffic that is not mirrored to ClaveQ | OT and mixed IT/OT estates |
A CBOM built from the network covers the traffic it observes, and no more. Every ClaveQ scan reports how completely it observed that traffic, so you see the gaps instead of assuming them away.
Using a CBOM
What you do with a CBOM once you have it.
The rest of the migration works from the CBOM, so keep it current rather than filing it.
Decide what to fix first
Sort connections by risk: unencrypted first, then anything exposed to harvest-now-decrypt-later. ClaveQ turns that order into a prioritised plan and re-measures it over time, so you can prove progress.
Press vendors with evidence
Show a supplier exactly which connection uses which algorithm and ask when post-quantum support will arrive. Then write post-quantum requirements into your tenders.
Show auditors and insurers
Discovery is the first step in the NCSC's timeline. A CBOM is your evidence that you have done it. The format is open, so assessors can read it, and the audit trail stays yours.
React when an algorithm is retired
NIST's draft transition plan proposes retiring RSA and elliptic-curve algorithms by 2035. With a CBOM, one search finds every affected connection.
You can also export findings to your security monitoring system (SIEM).
Sources: NCSC timeline ↗ · NIST IR 8547 (draft) ↗
Private beta
We are opening early access to a small number of critical national infrastructure operators.
If you run operational technology in water, energy, healthcare or manufacturing and want an early look, we would like to hear from you.
Required to reply to your enquiry. See our privacy notice.