PKIMM Compliance Note: A completed CBOM is formal evidence for the PKIMM Training Plan requirement at Level 3. The Mini CBOM Exercise at the end of Unit 3 is specifically designed as a compliance artifact, its output format (asset name, current algorithm, vulnerability status, proposed replacement, priority tier) maps directly to what a PKIMM assessor looks for as evidence of practical training. Keep your completed exercise: it belongs in your PKIMM evidence package.
Unit 3 · Level 2 → Level 3 · Inventory, CBOM & Crypto Agility
What Is a CBOM and
Why It Comes Before Everything Else
Before you can migrate a single algorithm, you need to know what you have. This lesson introduces the Cryptographic Bill of Materials, and explains why it is the first real act of migration, not a preliminary step.
Part 1
The Problem: You Cannot Migrate What You Cannot See
Imagine you are the new manager of a large office building. You are told that every lock in the building needs to be replaced, the old key format is being phased out. Your first question is obvious: How many locks are there? And where are they?
Now imagine trying to replace them without ever answering that question. You might find the front door and the storage room. But what about the server room on the third floor? The side entrance nobody uses? The cabinet that has been locked for eight years because someone lost the key?
This is exactly the position most organizations are in today with their cryptographic infrastructure. They know, in a general sense, that they use encryption. They know they have TLS certificates, and maybe a VPN, and possibly some code-signing setup. But do they know every place a cryptographic algorithm is running? Every certificate, every key exchange protocol, every signing operation?
Almost certainly not. And that gap is the entire reason the CBOM exists.
Unit 3 Core Principle
"You cannot migrate what you cannot see."
Every lesson in Unit 3 flows from this single statement.
This is not a metaphor. It is a practical constraint. The entire post-quantum migration project, for any organization, at any scale, begins with an inventory. Not with algorithm selection, not with vendor evaluation, not with a migration roadmap. With an inventory. The CBOM is that inventory.
⚠ Common Mistake
Many organizations jump straight to asking "which PQC algorithms should we adopt?" before completing an inventory. This creates a plan with no map. You end up purchasing a solution without knowing what problem you are solving, or how big it actually is.
Part 2
What a CBOM Is — The Formal Definition
Let's define the term clearly before we go further.
- CBOM — Cryptographic Bill of Materials
- A structured, machine-readable inventory of every cryptographic asset in a system or organization. It lists which algorithms are in use, where they are deployed, which components depend on them, and how they connect to the rest of the system.
- Formal context: CycloneDX (the primary CBOM standard) defines it as an extension of the Software Bill of Materials (SBOM) concept, specialized for cryptographic assets. The CycloneDX CBOM specification is maintained by OWASP and is the dominant open standard for this format.
A CBOM is not a policy document. It is not a risk assessment. It is not a checklist. It is a structured factual record — the equivalent of a floor plan for your cryptographic infrastructure. What exists, where it lives, what version it is, and who or what depends on it.
The word "bill" here comes from the same tradition as a Bill of Materials in manufacturing, a complete list of every component that goes into a product. If you are building a car, your bill of materials lists every bolt, every wire, every sensor. If you are securing a software system, your CBOM lists every cryptographic component.
Why does this matter right now? Because the post-quantum migration requires you to replace specific components — RSA, ECC, and similar classical algorithms, and you cannot replace what you have not listed. The CBOM is the list.
👇 Click each card to reveal what makes it a cryptographic asset that belongs in a CBOM:
🔒
TLS Certificate
Tap to see why →
Uses RSA or ECC for authentication. Must be replaced with a PQC-compatible cert when CAs begin issuing them. Lifespan and renewal schedule matter.
🔑
SSH Keys
Tap to see why →
Used for server-to-server and admin access. Typically RSA-2048 or ed25519. Quantum-vulnerable (RSA) or partially resistant (ed25519, weakened by Grover's). Each key pair is a CBOM entry.
🔐
VPN Encryption
Tap to see why →
The handshake protocol (IKE/IPsec, WireGuard, OpenVPN) uses specific key exchange and authentication algorithms. These are CBOM entries because each has a different vulnerability profile and migration path.
✍️
Code Signing Cert
Tap to see why →
Signs software releases. Broken by Shor's algorithm. High priority: compromised signing certs allow malicious software to be distributed as trusted. Each cert is a separate CBOM entry with its own expiry and CA chain.
💾
Database Encryption
Tap to see why →
Encryption at rest often uses AES (weakened by Grover's, not broken) but the key wrapping layer may use RSA. The CBOM captures both the symmetric algorithm and the asymmetric key management layer around it.
📧
Email Encryption (S/MIME)
Tap to see why →
S/MIME certificates use RSA or ECC. Often forgotten because "it just works." These are CBOM entries, and if your organization retains encrypted email archives, those messages are a Harvest Now Decrypt Later target.
🏛️
Root CA Certificate
Tap to see why →
The trust anchor for your entire PKI chain. If you operate an internal CA, its root certificate is the most critical CBOM entry, migration must happen here first, and it has the longest lead time of any cryptographic asset.
📱
Mobile App Auth Tokens
Tap to see why →
JWT tokens, OAuth flows, and app signing all use asymmetric algorithms. Mobile apps are particularly hard to update: CBOM entries here need priority attention because the migration lead time is long.
You've revealed 0 of 8 assets.
Part 3
SBOM vs. CBOM: Two Related Concepts
If you have been following software supply chain security over the past few years, you may have heard of the SBOM — the Software Bill of Materials. The U.S. Executive Order on Improving the Nation's Cybersecurity (May 2021) made SBOMs a requirement for federal software procurement, and the concept spread rapidly from there.
A CBOM is a specialized extension of the SBOM concept. Understanding the difference clarifies what a CBOM actually covers.
| Dimension | SBOM Software Bill of Materials |
CBOM Cryptographic Bill of Materials |
|---|---|---|
| What it inventories | All software components, libraries, dependencies, and their versions | Cryptographic algorithms, keys, certificates, protocols, and libraries that implement them |
| Primary purpose | Vulnerability management across the software supply chain | Identifying quantum-vulnerable cryptography for migration planning |
| Key question it answers | "What software is running, and does any of it have known CVEs?" | "Which cryptographic assets will break under quantum attack, and where exactly are they?" |
| Standard format | SPDX, CycloneDX (software profile) | CycloneDX (cryptography extension) |
| Scope | Often focused on one application or repository | Can span an entire organization, infrastructure, applications, hardware, and third-party services |
| Relationship | A CBOM may be embedded within an SBOM, or stand alone as a separate document. They are complementary, an organization doing serious supply chain security work will have both. | |
📌 Why CycloneDX?
CycloneDX is an open standard maintained by OWASP (the Open Web Application Security Project). It is the dominant format for CBOMs today because it was the first standard to define a dedicated cryptography schema for inventorying algorithms, certificates, and related assets. When you produce or receive a CBOM, it will most likely be in CycloneDX format, as JSON or XML. Lesson 3.2 walks you through a real CycloneDX CBOM structure field by field.
Part 4
Why the CBOM Comes Before Everything Else in Migration
At this point you might be thinking: Is this really so important? Can't we just start replacing the obvious things, certificates, VPN, and figure out the rest as we go?
This is a reasonable instinct, and the answer is: sometimes you can start there. But without a CBOM, you will almost certainly stop too early, miss critical assets, and create a false sense of completion, perhaps the most dangerous outcome in a migration project.
Here are the four reasons the CBOM must come first:
Reason 1 — You Don't Know What You Don't Know
In every organization we have studied, the cryptographic footprint turned out to be significantly larger than the IT team expected. Cryptography is embedded in places people don't think of as "security", build pipelines, internal APIs, legacy monitoring tools, and vendor integrations. Without an inventory, these stay invisible until they become a problem, either during an audit or, worse, during an incident.
✗ Without a CBOM
You replace what you can see. Then you're told you passed a compliance audit. Six months later, an internal tool that hasn't been touched in three years turns out to be using RSA-1024 for authentication. It's been running the entire time.
✓ With a CBOM
You find the forgotten tool during discovery, before migration starts. It gets prioritized or decommissioned based on business value. The migration plan is complete because the picture is complete.
Reason 2 — Prioritization Requires a Complete Picture
Not every cryptographic asset has the same migration urgency. A code-signing certificate used for software you distribute to clients is higher priority than the self-signed cert on an internal server that nobody outside the building can reach. But you can only make this call if you have a list to sort. The CBOM is what makes priority triage possible.
Reason 3 — Migration Surfaces Dependencies
Cryptographic components are rarely standalone. Your TLS certificate is issued by a CA. The CA certificate lives in a trust store. The trust store is controlled by an operating system or browser. When you replace the leaf certificate, you need to know the full chain. The CBOM captures these relationships, and those dependency chains are often where migration efforts stall unexpectedly.
Reason 4 — It Is Required Evidence for PKIMM Level 3
The PQCMM Level 3 requirement is explicit: cryptographic inventory exists and is current. A CBOM is not optional if your organization is targeting Level 3 maturity. It is the primary artifact that a PKIMM assessor looks for as evidence that you have moved from "awareness" to "active management." The CBOM exercise at the end of this unit is a formal compliance artifact for exactly this reason.
Part 5
What a CBOM Actually Contains
A CBOM is a structured document, typically JSON or XML in practice, but the concepts it captures are not technical. Every entry in a CBOM answers the same five questions about one cryptographic asset:
Click any term card to expand its full definition.
What is it?
+
The asset type and name — e.g., "TLS certificate," "SSH key pair," "code signing certificate." In CycloneDX, this maps to the
type and name fields. Each distinct cryptographic asset gets its own entry.Where does it live?
+
The location — the specific system, service, or application where this asset is deployed. A TLS cert might live on a load balancer; a signing cert might be stored in a hardware security module (HSM) or a file on a build server. Location determines who owns the migration task.
What algorithm does it use?
+
The cryptographic algorithm and key size, e.g., RSA-2048, ECDSA P-256, AES-256-GCM. This is the field that determines quantum vulnerability. RSA and ECC are broken by Shor's algorithm. AES is weakened but not broken by Grover's. This field drives the prioritization tier.
What is its vulnerability status?
+
The quantum risk classification. In this course and in the CBOM exercise, we use three tiers: Broken by Shor's algorithm (RSA, ECC, DH — immediate priority), Weakened by Grover's algorithm (AES-128, SHA-256 — medium-term priority), and Not affected (AES-256, SHA-384, monitor only).
What replaces it?
+
The proposed PQC replacement — e.g., "Replace RSA-2048 with ML-KEM-768 for key exchange" or "Replace ECDSA with ML-DSA-65 for signing." This field completes the entry by pairing the current state with the target state. It makes the CBOM actionable, not just descriptive.
How urgent is migration?
+
The priority tier — Immediate (within 12 months), Medium-term (12–36 months), or Monitor (no action needed now). Priority is determined by the algorithm's vulnerability status, the asset's exposure level, and the sensitivity of the data it protects. Long-lived data always increases priority.
These six fields are the backbone of every CBOM entry. In Lesson 3.2, you will see exactly how they map to the CycloneDX specification fields in a real CBOM document. For now, recognize that the CBOM is not a complex technical artifact, it is a structured answer to six practical questions, asked about every cryptographic asset you own.
📌 CycloneDX and NIST CSWP 39
The CBOM concept is documented in two primary sources: CycloneDX's CBOM capabilities specification (the technical standard for the format) and NIST CSWP 39 — Migration to Post-Quantum Cryptography (the U.S. government migration guidance that formally establishes cryptographic inventory as a prerequisite to migration planning). Both sources agree: inventory first, plan second, migrate third.
Part 6
The CBOM in the Migration Chain
Where does the CBOM sit in the overall post-quantum migration process? The answer is: at the beginning, and it feeds everything that comes after it.
Step 1
Crypto Inventory
(CBOM)
(CBOM)
→
Step 2
Risk & Priority
Triage
Triage
→
Step 3
Crypto Agility
Assessment
Assessment
→
Step 4
Migration
Planning
Planning
→
Step 5
Phased
Execution
Execution
→
Step 6
Continuous
Monitoring
Monitoring
Notice that Step 1 is not "figure out which algorithm is best." It is not "get buy-in from leadership." It is the inventory. Everything downstream, risk triage, agility assessment, migration planning, execution, monitoring, depends on the CBOM being complete and accurate.
This also means that an inaccurate or incomplete CBOM is worse than a delayed one. If your CBOM says you have 12 cryptographic assets and you actually have 47, your migration plan will be scoped for 12. The other 35 remain vulnerable, unplanned, and unbudgeted. A delayed but accurate CBOM at least gives you the real picture before you commit to a plan.
We will return to this chain throughout Unit 3. Lessons 3.3 and 3.4 address Step 3 (crypto agility) and the discovery tooling that makes Steps 1 and 2 practical. Lessons 3.5 and 3.6 show how the migration checklists in your course workbook connect to Steps 4 and 5.
⚡ The Core Message of Unit 3
Unit 3 is the most operational unit in this course. We are past awareness. We are past algorithm explanations. We are doing the work now. The CBOM is the first act of that work. Every other lesson in this unit, agility, tooling, migration checklists, builds directly on having completed it.
🏛️
Persona Perspectives
What This Means for You
The CBOM matters differently depending on your role. Select your persona below.
Persona A — The Motivated Learner
You've built a solid conceptual foundation across Units 0, 1, and 2. You understand why PQC matters and what the standards say. The CBOM is the moment where that understanding becomes a professional skill you can use.
If you are considering roles in security consulting, PKI engineering, or compliance advisory, the ability to produce and read a CBOM is already a differentiator. Most organizations do not have anyone who can do this. The Mini CBOM Exercise at the end of Unit 3 is the closest thing to a portfolio piece this course offers, it demonstrates that you can perform a real discovery and inventory task, not just describe the theory of one.
Your focus in this lesson: Understand the conceptual framework thoroughly. In Lesson 3.2 you will get the hands-on technical depth. This lesson is the "why", make sure it is clear before you move on.
Persona B — The SMB Decision-Maker
You may be wondering whether a 48-person marketing agency really needs to worry about a formal CBOM. Here is the honest answer: probably not a machine-readable CycloneDX document. But the thinking behind the CBOM, what cryptographic assets do we own, where are they, and what happens when the algorithms break, that thinking is non-optional at any size.
The Mini CBOM Exercise uses Meridian Creative Agency, a fictional 48-person marketing agency that is fully remote. That profile was designed specifically for companies at your scale. You will find that even a small organization like that has five or more distinct cryptographic assets that need attention. The exercise will make this concrete in a way that no abstract description can.
Your practical takeaway from this lesson: The CBOM is not bureaucracy, it is the question "do I know what encryption I'm relying on, and is it going to break?" Asked at your scale, you can answer it in an afternoon. We will show you exactly how in Lesson 3.2, including a prompt you can hand directly to your IT vendor or managed service provider.
Persona C — The IT Professional
For you, the CBOM is not a concept to learn, it is a deliverable to produce. The question is not "what is a CBOM?" but "how do I build one for my organization, what tools exist, and how do I get buy-in to prioritize the work?"
This lesson gives you the foundational vocabulary to make that case to your CISO or IT manager. The six fields of a CBOM entry, the relationship to SBOM work your organization may already be doing, the NIST CSWP 39 mandate, these are the building blocks of a business case for investing in cryptographic inventory.
Your immediate application: After Unit 3, you will have a completed CBOM for a fictional organization and a clear framework for applying that same process to your real environment. Lessons 3.4 through 3.6 are specifically designed to bridge from the exercise to the real world, discovery tooling that automates parts of the inventory, and migration checklists that connect your CBOM entries to prioritized action items.
Note on scope: Many organizations first produce a CBOM for a single high-priority system, one application, one network segment, rather than the entire organization at once. That scoped approach is legitimate and recommended. Start where the risk is highest. Expand from there.
Before the Quiz
Key Terms From This Lesson
Every new term in this course is defined on first use and collected here for quick review. Click any card to expand.
CBOM
+
Cryptographic Bill of Materials. A structured inventory of every cryptographic asset in a system or organization, algorithms, keys, certificates, and protocols. The primary tool for post-quantum migration planning.
SBOM
+
Software Bill of Materials. An inventory of all software components and dependencies in an application or system. The CBOM is a specialized extension of this concept, focused on cryptographic components.
CycloneDX
+
The dominant open standard (maintained by OWASP) for both SBOMs and CBOMs. CycloneDX defines the schema for cryptographic asset inventory. CBOMs in CycloneDX format are JSON or XML documents. Used in Lesson 3.2.
NIST CSWP 39
+
NIST Cybersecurity White Paper 39, "Migration to Post-Quantum Cryptography." The U.S. government's formal migration guidance. Establishes cryptographic inventory as the first required step. Lesson 3.3 draws on this document for crypto-agility concepts.
Cryptographic Asset
+
Any component that implements cryptography: a certificate, key pair, signing operation, encryption protocol, or cryptographic library. Each is a discrete entry in a CBOM with its own algorithm, location, vulnerability status, and migration path.
PQCMM Level 3
+
The Post-Quantum Cryptography Maturity Model level that requires a current cryptographic inventory (CBOM) and at least one quantum-safe algorithm deployed in production. The goal of Unit 3. A completed CBOM is the primary Level 3 evidence artifact.
Comprehension Check
3 QuestionsQuestion 1 of 3
An organization's IT director says: "We already know we use TLS and a VPN, do we really need to go through a formal CBOM process before we start migrating?" Which of the following best describes the risk in skipping the inventory?
Question 2 of 3
A developer produces an SBOM for a new application as part of the company's software supply chain policy. A security engineer says: "We still need a separate CBOM." What is the engineer's point?
Question 3 of 3
According to the CBOM framework introduced in this lesson, which of the following correctly describes how to classify an AES-256 database encryption key in the vulnerability status field?