What Is a Cryptographic Bill of Materials (CBOM) and Why Does It Matter?
A CBOM is a structured inventory of every cryptographic asset in your organisation. It is the foundation for post-quantum migration planning — and without it, you cannot know what you need to change or in what order.
A Cryptographic Bill of Materials (CBOM) is a structured, machine-readable inventory of all cryptographic assets in an organisation's technology estate. It records every algorithm, certificate, key, protocol, library, and cryptographic dependency — along with the systems and data those assets protect.
The concept is modelled on the Software Bill of Materials (SBOM), which catalogues software components and their dependencies. The CBOM applies the same principle to cryptography: you cannot manage what you cannot see, and you cannot migrate what you have not inventoried.
For post-quantum migration, the CBOM serves three critical functions. First, it provides a complete picture of quantum-vulnerable cryptographic assets — RSA, ECC, DH, and DSA implementations that will be broken by a cryptographically relevant quantum computer. Second, it maps those assets to the data and systems they protect, enabling risk-based prioritisation. Third, it creates a baseline against which migration progress can be tracked and compliance demonstrated.
Building a CBOM is not a one-time exercise. Cryptographic assets change as software is updated, certificates are renewed, and new systems are deployed. A living CBOM, maintained through continuous monitoring, provides the ongoing visibility needed to manage quantum risk as the threat landscape evolves.
Regulatory frameworks are beginning to require CBOM-equivalent documentation. NIST SP 800-208, the UAE National Cybersecurity Strategy, and emerging financial sector guidance from SAMA and CBUAE all point toward cryptographic inventory as a baseline expectation for regulated organisations. The CBOM is not just a migration planning tool — it is becoming a compliance artefact.
Organisations that invest in CBOM development now will have a significant advantage when regulatory requirements crystallise and when migration timelines compress. Those that wait will face the dual pressure of an incomplete inventory and an accelerating deadline.