What is a cryptographic bill of materials (CBOM)?
A cryptographic bill of materials, or CBOM, is a structured inventory of the cryptography inside a system or organisation: which algorithms are used, where, with what key sizes, what they protect, and what depends on them. It does for cryptography what a software bill of materials does for software components. For a quantum-readiness programme, it's usually the first real deliverable.
Why you need one
You can't migrate cryptography you haven't found. In a bank it hides in websites and apps, card systems, ATMs, hardware security modules, payment messaging, links to suppliers, and configuration files nobody has opened in years. A CBOM turns "we use RSA somewhere" into a list you can rank, fund and track. The EU's coordinated roadmap, a set of recommendations to member states, asks them to begin their transition, including cryptographic inventories, by the end of 2026. It isn't a direct legal deadline for every bank, but it shows where expectations are heading.
What goes in a record
| Field | Example |
|---|---|
| Asset and where it lives | Online banking load balancer, data in transit |
| Algorithm and parameters | Elliptic-curve key exchange (X25519), RSA-2048 certificate |
| Job it does | Key agreement, signature, encryption or integrity |
| What it protects, and for how long | Customer session data; account records kept seven years |
| Owner and supplier | Digital channels team; load balancer vendor |
| Dependencies | Internal certificate authority, HSM cluster |
| Confidence | Confirmed by owner, or inferred from a scan |
Is there a standard format?
Yes. CycloneDX, an open standard from the OWASP community that many organisations already use for software bills of materials, includes support for recording cryptographic assets as a CBOM. Using a standard format makes it easier to combine results from scanning tools, supplier statements and manual reviews, and to share inventories with partners.
How CBOMs get built
- Scanning: network scans, code scans and certificate discovery find a lot automatically.
- Supplier statements: vendors describe the cryptography inside their products.
- People: owners confirm records and add what tools can't see, such as how long data must stay secret.
Start with one critical business flow, not the whole bank. A complete inventory of one payment flow teaches more than a shallow scan of everything.
The banking guide's inventory chapter includes a full record template and a worked example.
Common confusions
- "Our CBOM is complete." Coverage depends on discovery methods, access, supplier visibility and record quality. Track what's known to be missing.
- "A CBOM format is a migration plan." A standard format records assets. Business criticality, how long data must stay secret, ownership and dependencies often need adding, or linking from other records.
- "A scan is an inventory." A scan is a starting point. Without owners and business context, you can't prioritise.
- "It's a one-off project." A CBOM needs an owner and regular refreshes, or it goes stale within months.
- "Only RSA matters." Record everything; the inventory also proves which items need no change.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardCryptography Bill of Materials (CBOM)CycloneDX / OWASP
- Government guidanceA Coordinated Implementation Roadmap for the Transition to Post-Quantum CryptographyEuropean Commission / NIS Cooperation Group, 2025