PQC Ready · practical transition guidance
What is a cryptographic bill of materials?
Use a CBOM to describe cryptographic components and dependencies, while keeping discovery coverage, provenance and unknowns explicit.
Published and reviewed 15 September 2026 · PQC Ready, a brand of SDTC Solutions Ltd
The purpose of a CBOM
A cryptographic bill of materials (CBOM) is a structured inventory of cryptographic assets and their relationships. It can describe algorithms, protocols, certificates and other cryptographic dependencies. It complements a software bill of materials rather than replacing all asset and service context.
Record enough context to act
For each observation, identify the asset and its cryptographic role, the supporting evidence, the observation date and the relevant implementation details. Link it to an owner and business service in the wider inventory.
Distinguish what a tool directly observed from what a software package or supplier document suggests. A library containing an algorithm is not proof that every application using that library invokes it.
Preserve the gaps
A CBOM can be syntactically valid and still incomplete. Unknown configuration, inaccessible firmware and unobserved internal services remain evidence gaps. Coverage should describe the scope and method used.
Incoming CBOMs need validation and reconciliation with other evidence. Do not turn a supplier-provided list into a verified enterprise baseline merely by importing it.
Use it throughout the transition
Compare the baseline against planned changes, identify owners and refresh observations after deployment. Retain versions so changes can be explained. A maintained inventory helps reveal new dependencies and expired assumptions after the first migration wave.
Continue exploring
- PQCEMM: enterprise post-quantum maturity
- Cryptographic discovery and inventory
- Crypto-agility: planning for cryptographic change