What is a Cryptographic Bill of Materials (CBOM)?

Post-quantum migration begins with a problem of visibility. Cryptography is buried everywhere, in web servers, databases, VPNs, code-signing pipelines, hardware modules, and third-party libraries, and most organizations have never listed it in one place. You cannot replace what you cannot see, so the first real deliverable of any migration is an inventory. A CBOM is that inventory in a form tools can read, compare, and track over time.

A CBOM records, for each piece of cryptography in use:

• The algorithm and its parameters, such as RSA-2048, ECDSA, or ML-KEM.
• Certificates and their properties, including the signing algorithm and expiry.
• Protocols and versions, such as the TLS version and cipher a service negotiates.
• Where each asset is used, so a finding can be traced to a system.
• Whether it is quantum-vulnerable, which is what turns a plain inventory into a migration plan.

A CBOM is not a bespoke spreadsheet. It is an extension of CycloneDX, an established open standard for bills of materials maintained under OWASP. Emitting the real standard format matters, because it is what a buyer, an auditor, or a government program can eventually ask a supplier to hand over, and what other security tools can ingest without translation.

In the United States, the June 2026 OMB memorandum on executing the post-quantum migration names an automated cryptographic inventory, populated into a CBOM, as the foundation of the migration plan. Executive Order 14412 directs CISA to publish the minimum elements a CBOM must contain. In other words, the CBOM is moving from a good idea to an expected artifact, first for federal agencies and their contractors, and then, as questionnaires follow the money, for their suppliers.

A complete CBOM comes from two directions. External discovery finds the internet-facing endpoints and tests what cryptography they actually negotiate. Internal discovery, run inside your own network, reaches the systems that never touch the public internet. LatticeScan produces a CycloneDX CBOM from an external scan, and its self-hosted scanner adds the internal half, so the two combine into one inventory.