Home / CBOM · Cryptographic inventory
CBOM · Cryptography Bill of Materials
Nobody migrates what they do not know they have
The CBOM, short for Cryptography Bill of Materials, is an organization's cryptographic inventory: the structured list of every certificate, key, algorithm, protocol and library in use, with the system that depends on each one and the data it protects. It is the first step NIST, CISA and the European Union require before touching a single algorithm, and the one Cyte's Notyfind builds and maintains automatically.
In one sentence: the CBOM is to cryptography what the SBOM is to software. It answers in minutes the question no bank wants to ask itself during an incident: if this algorithm falls, where am I using it?
From SBOM to CBOM
The SBOM (Software Bill of Materials) taught the industry to list every software component with its version, so that it can tell within hours whether a vulnerability like Log4Shell affects the organization. The CBOM applies the same discipline to cryptography: which algorithms, with which parameters, in which certificates and keys, backed by which libraries and used by which systems.
In 2024 the CycloneDX 1.6 standard, published as ECMA-424, adopted the CBOM as an official format. Since then a cryptographic inventory can be exported, audited and exchanged between tools with a common schema, instead of living in spreadsheets that go stale the day they are finished.
What a complete CBOM contains
Algorithms and parameters
RSA, ECC, AES, SHA, ML-KEM, ML-DSA: each with key size, mode of operation and primitive, classified by its classical and quantum resistance.
Certificates
Issuer, chain, signature algorithm, expiry date and the system that presents it. Including internal ones, self-signed ones, and the ones nobody remembers issuing.
Keys
Where they live (HSM, keystore, file, code), who holds them, when they were last rotated and what uses them.
Protocols
TLS, SSH and IPsec versions and the cipher suites negotiated on every service, port and load balancer.
Libraries and dependencies
OpenSSL, Bouncy Castle, in-house libraries and the ones that arrive transitively in repositories and CI/CD pipelines.
Business context
Which application depends on the asset, what data it protects, how long that data must stay confidential and which regulatory deadline it crosses first.
Where cryptography hides
Cryptography is almost never where the org chart says it is. A serious CBOM is built with automatic discovery across every layer, not with surveys sent to teams.
- Internal network: TLS services by domain and IP-port range, keystores, databases, firewalls, load balancers and VPNs.
- Cloud: web services, appliances, secret stores and provider-managed keys.
- Code and pipelines: static analysis of repositories (GitHub, GitLab or any other) and of the dependencies resolved in CI/CD.
- Legacy systems: COBOL, AS/400 and mainframe, where cryptography was usually embedded twenty years ago and nobody has looked at it since.
- OT environments and devices: ATMs, terminals and field equipment with factory keys.
- Signed or encrypted documents and files exchanged with customers, regulators and partners.
Who requires it
The cryptographic inventory went from good practice to explicit requirement. These are the references auditors and regulators cite today.
- NIST IR 8547 and the joint CISA, NSA and NIST guide "Quantum-Readiness: Migration to Post-Quantum Cryptography" (2023): the inventory is the first step of any migration plan.
- United States, OMB memorandum M-23-02: mandatory annual cryptographic inventory for federal agencies.
- European Union, coordinated roadmap for the post-quantum transition (2025): inventories and national plans by 2026.
- PCI DSS 4.0, requirement 12.3.3: documented inventory of cipher suites and protocols in use, reviewed periodically.
- ISO/IEC 27001:2022, control 8.24: key lifecycle management and use of cryptography, which an auditor checks against the inventory.
- Financial superintendencies and central banks across the region, which already ask for the post-quantum plan during supervisory visits.
From the first key discovered to the migration path
The five stages of the CBOM
A CBOM does not end with the list. Its value lies in what it lets you decide: what to migrate first, what can wait and what can be solved in hybrid mode without touching the application. These are the five stages Notyfind runs on a real infrastructure, which you can watch live on our home page.
01 / DISCOVERY
Complete inventory
Certificates, keys, algorithms, sizes and protocols, discovered by domain, IP-port range, key stores and static analysis of your repositories and CI/CD pipelines.
02 / RISK
Risk classification
Every asset is labeled critical (already weak against classical computers), medium (vulnerable to a quantum computer) or low (robust today, migratable in the medium term).
03 / EXPORT
Standard format
Exportable in CycloneDX v1.6 (ECMA-424), the CBOM standard. Your inventory is yours and works outside our tools.
04 / CLOCK
Regulatory clock
How many of your assets cross the NIST IR 8547 deadlines, RSA and ECC obsolescence in 2030 and the ban in 2035, and which ones cross first.
05 / PLAN
Migration path
What gets migrated first, what can wait and what can be solved in hybrid mode without touching the application.
A living CBOM, not an annual spreadsheet
An inventory built once a year is out of date the day it is published: every deployment, every renewed certificate and every new dependency changes it. A useful CBOM is continuous, automated and integrated with asset, risk and change management.
That is Notyfind's design: continuous discovery without degrading the performance of the scanned systems, alerts before a certificate expires, automatic renewal, post-quantum included, and CycloneDX export for the SIEM, the GRC platform and the auditor. The inventory is yours: it works outside our tools.
How Cyte builds it
The CBOM is the starting point of the whole Q-Safe scheme: what Notyfind discovers, the suite protects, and the CBOM measures again.
Notyfind®
Continuous discovery of certificates, keys and algorithms across network, cloud and code. CBOM exportable in CycloneDX 1.6 and automatic certificate renewal.
Total transition
Full code and network scanning, CBOM, gaps, roadmap and compliance, with in-house tools and methodology.
Quantum Center of Excellence
Maturity assessment with a CBOM, role-based training and a roadmap toward the NIST standards.
Quantum risk calculator
A first measure of exposure while the full inventory is being built.
Frequently asked questions
What does CBOM stand for?
Cryptography Bill of Materials, also called the cryptographic inventory. It is the structured, machine-readable record of all the cryptography in use in an organization.
How is a CBOM different from a certificate inventory?
The certificate inventory is one part of the CBOM. The CBOM also includes keys, algorithms with their parameters, protocols, libraries, code dependencies and the business context of each asset: which system uses it and what data it protects.
What format does a CBOM use?
The standard is CycloneDX 1.6 (ECMA-424), which defines cryptographic component types and their dependencies. Notyfind exports in that format, so the inventory works with any SIEM, GRC platform or audit tool.
How long does it take to build a CBOM?
The first network and domain inventory comes out in days; the code and legacy-system inventory depends on the size of the repositories and on access to the environments. What matters is that afterwards it maintains itself: discovery is continuous.
Is the CBOM only for post-quantum migration?
No. It prevents outages from expired certificates, answers PCI DSS and ISO 27001 audits, tells you within hours whether a vulnerability in a cryptographic library affects the organization, and lets you rotate keys with judgment. Post-quantum migration is the most urgent reason, not the only one.
Who should own the CBOM?
Usually the information security team, supported by architecture and operations. What does not work is a consulting deliverable nobody updates: the owner must have the tool that keeps it alive.
Related articles
Our articles are published in Spanish.
Cómo desangrar una fintech (2): "los extremos"
Un malware que opera el teléfono del cliente sin que se note, un CFO deepfake que aprueba 25,6 millones de dólares en videollamada y un certificado vencido que apaga una red móvil entera. Segunda entrega de cómo desangrar una fintech: la criptografía de los extremos, no del riel.
¿Por qué CI/CD pipeline dificulta la migración hacia la criptografía post-cuántica?
La deuda técnica en CI/CD pipeline puede impedir la migración hacia la criptografía post-cuántica. Descubra cómo preparar su software para la era Quantum Safe.
Parte 2: El camino hacia la resiliencia poscuántica y la criptoagilidad
Tras nuestra primera entrega sobre la "Radiografía del riesgo cuántico", es momento de continuar con las acciones que deben tomar las organizaciones colombianas para prepararse. No estamos ante un cambio de versión de software, estamos ante
Parte 1: Radiografía del riesgo cuántico en Colombia 2025
Parte 1: Radiografía del riesgo cuántico En los últimos 24 meses, la computación cuántica salió del laboratorio para convertirse en política pública, estándares oficiales y despliegues de criptografía poscuántica (PQC) en productos de consu
Cuando un certificado digital detiene tu operación (y tus vacaciones)
A finales del siglo pasado, los titulares de noticias se inundaron de la posibilidad de un colapso social producto de un bug de computadora que amenazaba con tumbar el sistema financiero, los canales de comunicación, redes de transporte, y
The three pillars of post-quantum security
The cryptography that withstands the quantum computer
post-quantum cryptography replaces the mathematical problems a quantum computer solves quickly, such as factoring large numbers or computing discrete logarithms, with problems that neither classical nor quantum computers can solve, such as lattices and error-correcting codes.
Read the guide → Crypto-agility · cryptographic agilityChanging an algorithm should not be a project
an organization is crypto-agile when the algorithm is a configuration parameter and not a line of code, when it knows where every key and certificate is, and when rotating them is an operational routine with a date on the calendar, not a project with a steering committee.
Read the guide →Receive your organization's first CBOM
An initial network and code scan, with the risk classification and the assets that cross the 2030 deadline first.
