Inventory the cryptographic assets
Record algorithms, protocols, certificates, and related cryptographic material precisely enough to act on.
Five-minute path
What is a CBOM?
A Cryptographic Bill of Materials is a machine-readable inventory of algorithms, protocols, certificates, keys, and the relationships that connect them to software.
Connect assets to software
Use dependsOn to show actual usage and provides to show a capability an implementation offers. They are not interchangeable.
Keep it alive
A useful CBOM changes with releases, dependencies, certificates, and configurations. Treat it as maintained inventory, not audit paperwork.
Use it for migration
Trace classical public-key algorithms to affected products and services, then prioritize post-quantum migration work with context.
Critical distinction
CBOM is not SBOM with a new label.
An SBOM tells you which software components are present. A CBOM describes cryptographic assets and how systems depend on or provide them. Both can complement each other inside CycloneDX.
Inspect an exampleNew to the vocabulary? Open the glossary for plain-language definitions.