What is a CBOM, and what should yours show?

A CBOM, short for cryptographic bill of materials, is a structured record of the cryptography your systems use: which algorithms, keys and certificates, where each one is used, and what depends on it. Like a software bill of materials, which lists the components inside an application, it’s written in a format other tools can read, so it can travel with a system instead of sitting in a spreadsheet.

Interest in CBOMs has grown with the move to quantum-safe encryption, because that move starts with knowing exactly where today’s methods are used. A CBOM is how that knowledge gets written down, kept current and shared.

What a CBOM records

The open CycloneDX standard describes the cryptographic assets in a system as algorithms, keys, certificates and their relationships to software components. In practice, each entry names the method in use, its strength, the service that relies on it, and how it connects to everything else.

The connections matter most. A certificate on its own says little. A certificate linked to the payment service, and to every system that trusts it, tells you what a change would touch, which is the question every change board asks first.

How a CBOM differs from an inventory

The two words are often used interchangeably, and the overlap is real. A cryptographic inventory is the act and the result of finding what’s in use. A CBOM is a structured, portable form of that result, designed to be exchanged between tools, teams and, increasingly, suppliers and customers.

That portability is the point. A CBOM can be produced for one application and handed to the team that runs it, attached to a release, or shared with an auditor, and each of them reads the same facts in the same shape.

Why organizations are building them now

Most organizations can’t yet say where they rely on cryptography. In the 2026 Entrust and Ponemon Institute study, limited visibility into where cryptography is used was the top barrier to quantum readiness for the second year running. Without that picture, there’s nothing to plan against.

A CBOM also answers practical questions long before quantum computers matter: which services still use a method due for retirement, which certificates share a key, and which teams own what. Those answers pay for the effort on their own.

What turns a CBOM into evidence

A list of objects is where the work starts. To support decisions and audits, each entry also needs a few things the raw scan doesn’t carry:

• Source and date. Where each fact came from and when it was observed, so it can be checked and repeated.
• Application and owner. The service the cryptography protects, and the team that can change it.
• Declared gaps. The hosts that weren’t reached and the sources that weren’t connected, recorded in the CBOM itself.
• A signature. Signing the file makes later changes detectable, though a signature doesn’t prove the record is complete; what a signed evidence record proves explains the limits.

With those in place, a CBOM stops being an inventory export and becomes something a risk owner, an engineer and an auditor can all rely on.

Keeping it current

A CBOM is a snapshot, and systems change every week. Produce it from the same collection that tracks changes, refresh it on a schedule, and keep earlier versions so you can show how the picture moved. The value is in the history as much as the latest copy.

Who uses a CBOM, and for what

A good CBOM serves several readers at once, which is much of its value:

• Security teams use it to see where weak or retiring methods are in use, and to plan the move to quantum-safe encryption.
• Engineering teams use it to understand what a change will touch before they make it.
• Procurement and supplier management can ask vendors for one, to understand the cryptography inside the products they buy.
• Auditors and assessors use it as evidence of what was in use, when, and what wasn’t checked.

Because each reader works from the same record, conversations between them get shorter. Nobody has to translate a scanner export into a risk report or an audit answer by hand.

Questions to ask of a CBOM

• Does it use an open format other tools can read?
• Does each entry say where it was found and when?
• Is every entry tied to an application and an owner?
• Does it declare what couldn’t be seen, in the file itself?
• Is it signed, and do you know whose key signed it?

Where Arcrix™ helps

Arcrix™ by QTrino Labs builds the record from the environments you connect, across AWS, Microsoft Azure, Google Cloud and on-premises systems. It ties each finding to its application and owner, and exports a signed CBOM with its gaps declared, so your auditors and partners can follow it.