[{"data":1,"prerenderedAt":608},["ShallowReactive",2],{"blog-\u002Fblog\u002Fcryptographic-inventory-cbom":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":519,"date":520,"description":521,"draft":522,"extension":523,"faqs":524,"findingsSource":7,"geo":543,"howto":7,"howtoTitle":7,"image":7,"industries":545,"keyFindings":7,"meta":547,"modified":548,"navigation":549,"path":550,"pullquote":7,"recommendations":7,"references":551,"related":576,"seo":592,"seoTitle":593,"signposts":7,"slug":594,"stats":595,"stem":598,"tags":599,"tldr":606,"__hash__":607},"blog\u002Fblog\u002Fcryptographic-inventory-cbom.md","How to Build a Cryptographic Inventory and CBOM for Post-Quantum Migration","ArcQubit Team",null,{"type":9,"value":10,"toc":504},"minimark",[11,16,32,38,42,45,51,55,58,98,107,111,114,226,229,233,239,260,263,290,300,304,312,315,349,353,366,371,374,378,381,401,409,413,445,449,452,469,487,491,496],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,24,28,31],"p",{},"A cryptographic inventory is a living record of every place your organization uses cryptography, including the algorithm, protocol, location, owner, and data protected. Build it by combining code, network, certificate, and configuration scans, start with an incomplete version, and store the results in a cryptographic bill of materials (CBOM) ",[21,22,23],"span",{},"1",", ",[21,26,27],{},"4",[21,29,30],{},"5",".",[17,33,34],{},[35,36,37],"em",{},"Last verified: Sep. 30, 2026.",[12,39,41],{"id":40},"what-a-cryptographic-inventory-is","What a cryptographic inventory is",[17,43,44],{},"A cryptographic inventory answers one question: where does our organization depend on public-key cryptography, and which algorithm does each dependency use? It is not the same as an asset list. An asset list tells you a server exists. An inventory tells you that the server negotiates RSA-2048 key exchange, holds an ECDSA certificate that expires in March, and protects data that must stay secret for 15 years.",[17,46,47,48,50],{},"OMB calls a dynamic, continuously updated inventory of all cryptographic assets \"the foundation of the migration plan\" ",[21,49,23],{},". That wording matters. It describes something you keep running, not a report you file once. A snapshot goes stale the day a team deploys a new service or a vendor ships an SDK update.",[12,52,54],{"id":53},"why-the-inventory-comes-first","Why the inventory comes first",[17,56,57],{},"Every major government roadmap starts with discovery, and the reason is practical: you cannot rank, fund, or migrate what you cannot see.",[59,60,61,71,80,88],"ul",{},[62,63,64,68,69,31],"li",{},[65,66,67],"strong",{},"United States:"," OMB's first migration phase, strategy, planning, and discovery, runs 2026 to 2027 and focuses on inventory, starting with high-value assets and high-impact systems ",[21,70,23],{},[62,72,73,76,77,31],{},[65,74,75],{},"United Kingdom:"," The NCSC expects large organizations to complete a discovery exercise by 2028 ",[21,78,79],{},"3",[62,81,82,85,86,31],{},[65,83,84],{},"Canada:"," The federal roadmap makes identification a core phase and advises starting with an initial, incomplete inventory that you improve over time ",[21,87,27],{},[62,89,90,93,94,97],{},[65,91,92],{},"Executive Order 14412:"," Section 5(d) directs CISA, in coordination with NIST, to release public guidance on the minimum elements of a cryptographic bill of materials within 270 days of the order ",[21,95,96],{},"2",". Watch for that publication, because it will show the federal view of what a CBOM should contain.",[17,99,100,101,106],{},"The inventory also decides how well you handle harvest-now-decrypt-later risk. To rank systems by exposure, you need to know which data each cryptographic dependency protects and how long that data must stay confidential. Without that link, prioritization becomes guesswork. ",[102,103,105],"a",{"href":104},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later"," explains how to test data against that risk.",[12,108,110],{"id":109},"what-to-record","What to record",[17,112,113],{},"Government guidance tells you to build an inventory but does not prescribe a field list. The fields below are ArcQubit's recommendation for an inventory that can drive prioritization and prove progress. Adjust them to your environment.",[115,116,117,130],"table",{},[118,119,120],"thead",{},[121,122,123,127],"tr",{},[124,125,126],"th",{},"Field",[124,128,129],{},"Why it matters",[131,132,133,142,152,160,170,178,186,194,202,210,218],"tbody",{},[121,134,135,139],{},[136,137,138],"td",{},"Asset and location",[136,140,141],{},"System, service, repository, device, or firmware image where the cryptography runs",[121,143,144,147],{},[136,145,146],{},"Algorithm and key size",[136,148,149,150],{},"Tells you whether it is quantum-vulnerable (RSA, Diffie-Hellman, ECDH, ECDSA, DSA) ",[21,151,23],{},[121,153,154,157],{},[136,155,156],{},"Purpose",[136,158,159],{},"Key exchange, digital signature, encryption at rest, or hashing. Purpose decides migration order",[121,161,162,165],{},[136,163,164],{},"Protocol and version",[136,166,167,168],{},"For example TLS 1.2 or 1.3. OMB sets a TLS 1.3 support deadline ",[21,169,23],{},[121,171,172,175],{},[136,173,174],{},"Library or module and version",[136,176,177],{},"Shows whether an update or a rebuild fixes it",[121,179,180,183],{},[136,181,182],{},"Certificate details",[136,184,185],{},"Issuer, expiry, and chain, since certificates and PKI sit on the critical path",[121,187,188,191],{},[136,189,190],{},"Key storage",[136,192,193],{},"Hardware security module, cloud key service, or file on disk",[121,195,196,199],{},[136,197,198],{},"Data protected and shelf life",[136,200,201],{},"Links the finding to harvest-now-decrypt-later exposure",[121,203,204,207],{},[136,205,206],{},"Owner",[136,208,209],{},"A named internal team, or the supplier who has to ship the fix",[121,211,212,215],{},[136,213,214],{},"Post-quantum status",[136,216,217],{},"Vulnerable, hybrid, or post-quantum, so progress is countable",[121,219,220,223],{},[136,221,222],{},"Evidence and last seen",[136,224,225],{},"Which scan found it and when, so you can trust and refresh it",[17,227,228],{},"The \"owner\" field deserves extra care. A large share of your cryptography lives in software, devices, and services someone else built. If the owner is a supplier, your remediation is a vendor conversation, not an engineering ticket. Recording that early keeps supplier-dependent work from surprising you late in the program.",[12,230,232],{"id":231},"how-to-discover-cryptography","How to discover cryptography",[17,234,235,236,238],{},"No single method sees everything, so combine several. OMB names three automated techniques and expects their output to populate a central CBOM ",[21,237,23],{},":",[240,241,242,248,254],"ol",{},[62,243,244,247],{},[65,245,246],{},"Software composition analysis"," on software bills of materials (SBOMs), to find cryptographic libraries and their versions.",[62,249,250,253],{},[65,251,252],{},"Static and dynamic application security testing",", to find cryptographic functions inside your own code.",[62,255,256,259],{},[65,257,258],{},"Network scanners",", to detect the protocols and cipher suites in use.",[17,261,262],{},"Add four more sources that the memo does not name but that any inventory needs:",[240,264,266,272,278,284],{"start":265},4,[62,267,268,271],{},[65,269,270],{},"Certificate and key stores",", including your PKI, to catch certificates and their algorithms.",[62,273,274,277],{},[65,275,276],{},"Infrastructure configuration",", such as cloud key-management settings and TLS policies.",[62,279,280,283],{},[65,281,282],{},"Binary and container image scanning",", for cryptography compiled into software you did not write.",[62,285,286,289],{},[65,287,288],{},"Supplier attestations and questionnaires",", for systems you cannot scan yourself. Treat them as claims to check, not as evidence.",[17,291,292,293,295,296,299],{},"Manual review fills the remaining gaps. OMB notes that manual approaches alone are often insufficient at federal scale and advises automation \"when feasible and appropriate\" ",[21,294,23],{},", and CISA published a strategy for adopting automated discovery and inventory tools in August 2024 for exactly this reason ",[21,297,298],{},"6",". Automation reduces the effort. It does not remove the need to check what the tools cannot reach.",[12,301,303],{"id":302},"start-with-an-incomplete-inventory","Start with an incomplete inventory",[17,305,306,307,309,310,31],{},"The most common mistake is waiting for a perfect inventory before doing anything else. Canada advises teams \"to not be overwhelmed in completing the discovery and to begin with an initial, incomplete inventory with actions to iteratively improve the data\" ",[21,308,27],{},". The NCSC agrees that early discovery does not require a formal asset register ",[21,311,79],{},[17,313,314],{},"A practical build order:",[240,316,317,323,331,337,343],{},[62,318,319,322],{},[65,320,321],{},"Name an owner."," One person accountable for the inventory, backed by security engineering.",[62,324,325,328,329,31],{},[65,326,327],{},"Set the scope."," Start with high-value and high-impact systems and the data with the longest shelf life. OMB starts there too ",[21,330,23],{},[62,332,333,336],{},[65,334,335],{},"Run the automated scans you can."," Use tools you already own before buying new ones.",[62,338,339,342],{},[65,340,341],{},"Fill gaps with suppliers and manual review."," Ask vendors for post-quantum roadmaps and document what you learn.",[62,344,345,348],{},[65,346,347],{},"Load everything into one record and set a refresh schedule."," A single CBOM beats five spreadsheets.",[12,350,352],{"id":351},"turn-the-inventory-into-a-cbom","Turn the inventory into a CBOM",[17,354,355,356,358,359,362,363,31],{},"A cryptographic bill of materials is a machine-readable inventory of cryptographic assets such as algorithms, keys, certificates, and protocols, plus their relationships to the software that uses them ",[21,357,30],{},". CycloneDX defines the CBOM format and introduced it in version 1.6, released in April 2024 ",[21,360,361],{},"7",". The CycloneDX specification is standardized as ECMA-424 ",[21,364,365],{},"8",[17,367,368,369,31],{},"A CBOM has three advantages over a spreadsheet. Tools can read and compare it, so you can see what changed between scans. It links each cryptographic asset to the software component that uses it. And it can feed dashboards that track migration progress against your deadlines, which OMB expects agencies to do ",[21,370,23],{},[17,372,373],{},"You do not need an existing SBOM or CBOM to begin. If your scans produce the inventory, the CBOM is simply the format you store it in.",[12,375,377],{"id":376},"keep-it-current","Keep it current",[17,379,380],{},"An inventory that is accurate today and stale in six months has failed at its job. Three habits keep it alive:",[59,382,383,389,395],{},[62,384,385,388],{},[65,386,387],{},"New systems enter the inventory before launch."," Make cryptographic review part of your release or procurement gate.",[62,390,391,394],{},[65,392,393],{},"Rescan on change."," New deployments, vendor updates, and infrastructure changes all introduce cryptography.",[62,396,397,400],{},[65,398,399],{},"Track the trend."," Report the share of assets that are vulnerable, hybrid, or post-quantum. A falling vulnerable share is the clearest proof of progress.",[17,402,403,404,408],{},"A current inventory is also the foundation of crypto-agility. You cannot swap an algorithm you cannot find. ",[102,405,407],{"href":406},"\u002Fblog\u002Fcrypto-agility","Crypto-Agility"," explains how to make the swap easy once you know where to look.",[12,410,412],{"id":411},"common-mistakes","Common mistakes",[59,414,415,421,427,433,439],{},[62,416,417,420],{},[65,418,419],{},"Treating a certificate list as the inventory."," Certificates are one slice. Libraries, protocols, firmware, and hardcoded algorithms sit outside them.",[62,422,423,426],{},[65,424,425],{},"Ignoring supplier-owned cryptography."," Your migration finishes when your vendors finish. Record who owns each finding.",[62,428,429,432],{},[65,430,431],{},"Scanning once."," A one-time scan produces a report, not an inventory.",[62,434,435,438],{},[65,436,437],{},"Skipping the owner field."," A finding with no owner never gets fixed.",[62,440,441,444],{},[65,442,443],{},"Recording the algorithm but not the data."," Without the data and its shelf life, you cannot prioritize.",[12,446,448],{"id":447},"what-done-looks-like","What done looks like",[17,450,451],{},"Your inventory is good enough to act on when each of these is true:",[59,453,454,457,460,463,466],{},[62,455,456],{},"Every high-value and high-impact system is covered.",[62,458,459],{},"Each finding shows algorithm, location, purpose, and an owner, internal or supplier.",[62,461,462],{},"Findings are ranked by data sensitivity, system criticality, and exposure time.",[62,464,465],{},"Scans run on a schedule, and new systems enter before launch.",[62,467,468],{},"The data lives in one structured record, ideally a CBOM.",[17,470,471,472,476,477,481,482,486],{},"Then move to prioritization and pilots with the ",[102,473,475],{"href":474},"\u002Fblog\u002Fpqc-migration-roadmap","Migration Roadmap",", and check your progress with the ",[102,478,480],{"href":479},"\u002Fblog\u002Fquantum-readiness-assessment","Readiness Self-Assessment",". The ",[102,483,485],{"href":484},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines"," article shows which dates apply to you.",[12,488,490],{"id":489},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,492,493],{},[35,494,495],{},"This box describes ArcQubit's own method. Keep it separate from the guidance above.",[17,497,498,499,503],{},"ArcQubit's QuCode is built for the inventory step. It runs read-only scans across all five surfaces, brings in the results of the scanners you already run, and produces a Quantum Exposure Report: a ranked list where each finding names the software, algorithm, location, exposure score, and whether your team or a supplier has to fix it. You do not need an existing CBOM or SBOM to start, because QuCode's own scan builds the inventory. Findings map to NIST FIPS 203, 204, and 205 and export for governance, risk, and compliance tools. QuTrust then keeps the migration roadmap current as work completes. ArcQubit sells QuCode directly as fixed-scope discovery work. ",[102,500,502],{"href":501},"\u002Fcontact","Contact ArcQubit"," to scope a discovery scan.",{"title":505,"searchDepth":506,"depth":506,"links":507},"",2,[508,509,510,511,512,513,514,515,516,517,518],{"id":14,"depth":506,"text":15},{"id":40,"depth":506,"text":41},{"id":53,"depth":506,"text":54},{"id":109,"depth":506,"text":110},{"id":231,"depth":506,"text":232},{"id":302,"depth":506,"text":303},{"id":351,"depth":506,"text":352},{"id":376,"depth":506,"text":377},{"id":411,"depth":506,"text":412},{"id":447,"depth":506,"text":448},{"id":489,"depth":506,"text":490},"Engineering","2026-08-04","How to build a cryptographic inventory and CBOM for post-quantum migration: what to record, how to discover it, and how to keep it current.",false,"md",[525,528,531,534,537,540],{"q":526,"a":527},"What is a cryptographic inventory?","A cryptographic inventory is a continuously updated record of where an organization uses cryptography, including the algorithm, protocol, location, owner, and data protected. OMB calls it the foundation of a post-quantum migration plan and asks agencies to keep it dynamic and current [1].",{"q":529,"a":530},"What is a CBOM?","A cryptographic bill of materials (CBOM) is a machine-readable inventory of cryptographic assets, such as algorithms, keys, certificates, and protocols, and their relationships to software. CycloneDX defines the format, introduced in version 1.6 [7] and standardized as ECMA-424 [8].",{"q":532,"a":533},"Do I need an SBOM before I build a CBOM?","No. An SBOM helps because software composition analysis can read it to find cryptographic libraries [1]. But you can build the inventory from code, network, certificate, and configuration scans, then store the result as a CBOM.",{"q":535,"a":536},"Can automated tools find all my cryptography?","No. Automation reduces effort, and OMB advises using it when feasible [1]. Tools cannot see systems they cannot reach, such as some embedded devices and supplier-controlled services. Combine automated scans with manual review and supplier evidence.",{"q":538,"a":539},"How often should I update the inventory?","Continuously, or on a fixed schedule with a rule that new systems enter before launch. OMB describes the inventory as dynamic and continuously updated [1]. A one-time snapshot goes stale as systems and vendor software change.",{"q":541,"a":542},"Who should own the inventory?","Name one accountable owner, typically the PQC technical lead working with security engineering. OMB's plan requirements include a governance section that names roles for the migration [1].",[544],"global",[546],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fcryptographic-inventory-cbom",[552,555,558,561,564,567,570,573],{"label":553,"url":554},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":556,"url":557},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":559,"url":560},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":562,"url":563},"Canadian Centre for Cyber Security, \"Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),\" Communications Security Establishment Canada, Jun. 2025","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Froadmap-migration-post-quantum-cryptography-government-canada-itsm40001",{"label":565,"url":566},"CycloneDX, \"Cryptography Bill of Materials (CBOM),\" OWASP CycloneDX","https:\u002F\u002Fcyclonedx.org\u002Fcapabilities\u002Fcbom\u002F",{"label":568,"url":569},"Cybersecurity and Infrastructure Security Agency, \"Strategy for Migrating to Automated Post-Quantum Cryptography Discovery and Inventory Tools,\" CISA, Aug. 15, 2024","https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fstrategy-migrating-automated-post-quantum-cryptography-discovery-and-inventory-tools",{"label":571,"url":572},"CycloneDX, \"CycloneDX v1.6 Released, Advances Software Supply Chain Security with Cryptographic Bill of Materials and Attestations,\" OWASP CycloneDX, Apr. 2024","https:\u002F\u002Fcyclonedx.org\u002Fnews\u002Fcyclonedx-v1.6-released\u002F",{"label":574,"url":575},"Ecma International, \"ECMA-424: CycloneDX Bill of materials specification,\" 2nd edition, Dec. 2025","https:\u002F\u002Fecma-international.org\u002Fpublications-and-standards\u002Fstandards\u002Fecma-424\u002F",[577,580,581,583,584,585,586,589],{"label":578,"url":579},"PQC Migration Hub: The Complete Guide","\u002Fpqc-migration",{"label":475,"url":474},{"label":582,"url":406},"Crypto Agility",{"label":105,"url":104},{"label":480,"url":479},{"label":485,"url":484},{"label":587,"url":588},"The Seven Places Quantum-Vulnerable Cryptography Hides","\u002Fblog\u002Fseven-places-quantum-crypto-hides",{"label":590,"url":591},"Running Your PQC Migration From One Dashboard","\u002Fwhitepapers\u002Fpqc-migration-one-dashboard",{"title":5,"description":521},"Cryptographic Inventory and CBOM Guide","cryptographic-inventory-cbom",[596,597],"CycloneDX introduced the cryptographic bill of materials format in version 1.6, released in April 2024 (OWASP CycloneDX, 2024).","The NCSC expects large organizations to complete a discovery exercise by 2028 (NCSC, 2025).","blog\u002Fcryptographic-inventory-cbom",[600,601,602,603,604,605],"cryptographic inventory","CBOM","cryptographic bill of materials","cryptographic discovery","PQC migration","how-to","A cryptographic inventory is a living record of every place your organization uses cryptography, built by combining code, network, certificate and configuration scans and stored in a cryptographic bill of materials (CBOM).","pWSSew2YcByITDv2Tg_DYwas_5DdP8VDWNSDYzotXA4",1792182884091]