Discover, manage and report on cryptography in preparation for quantum safe systems and applications
A Cryptography Bill of Materials (CBOM) describes cryptographic assets and their dependencies. Discovering, managing, and reporting on cryptographic assets is necessary as the first step on the migration journey to quantum-safe systems and applications. Cryptography is typically buried deep within components used to compose and build systems and applications. As part of an agile cryptographic approach, organizations should seek to understand what cryptographic assets they are using and facilitate the assessment of the risk posture to provide a starting point for mitigation.
CycloneDX supports embedding cryptographic assets into existing SBOM or HBOMs. Leveraging this approach has the benefit in that the dependency graph can include all software and hardware components, their dependencies, and which components provide various cryptographic capabilities.
To facilitate cryptographic agility, independent SBOM/HBOM and CBOM may be leveraged and optionally specify the configuration made to enable or disable cryptographic features and functions.
BOMs demonstrating CBOM capabilities can be found at https://github.com/CycloneDX/bom-examples
