CBOM

A Cryptographic Bill of Materials is an inventory of every cryptographic asset in an organisation’s systems: TLS certificates, code signing certificates, cryptographic libraries, key management infrastructure, HSMs, and the algorithms in use across each. A CBOM is the necessary precondition for any post-quantum cryptography migration — you cannot migrate what you cannot inventory. For organisations with decades of PKI debt, CBOM discovery is a 6-12 month engagement before any migration work begins. The concept is analogous to SBOM (Software Bill of Materials) but scoped specifically to cryptographic components.