Executive summary — A cryptographic bill of materials, or CBOM, is a structured inventory of the cryptography an organisation uses: algorithms, keys, certificates and protocols, and where each is used. This explainer defines the CBOM, explains why it has become important, and shows how it underpins crypto-agility and post-quantum migration. Most organisations cannot answer a simple but critical question: exactly which cryptographic algorithms are in use across their systems, and where? A cryptographic bill of materials sets out to answer it, by inventorying cryptography the way a software bill of materials inventories software components. As the move toward post-quantum cryptography accelerates, that visibility has shifted from useful to essential. You cannot migrate cryptography you cannot see. What a CBOM records A CBOM is a machine-readable inventory of cryptographic assets and their context across applications and infrastructure. Algorithms in use, such as encryption, signing and key-exchange methods. Keys and their properties, including length and purpose. Certificates and the trust chains that support them. Protocols and where each cryptographic asset is used. Why the CBOM matters now For years, cryptography was treated as something that quietly worked in the background. The transition to post-quantum algorithms has changed that, because organisations now need to find and replace vulnerable cryptography on a deadline. NIST has published post-quantum standards and transition guidance pointing to the deprecation of today’s public-key algorithms around 2030. Meeting that timeline requires first knowing where those algorithms live, which is exactly what a CBOM captures. Ready to inventory your cryptography? Talk to eMudhra. CBOM and crypto-agility Crypto-agility is the ability to change cryptographic algorithms with minimal disruption. A CBOM is the foundation of that capability, because it turns an unknown, scattered use of cryptography into a managed inventory. With a current CBOM, an organisation can assess exposure, prioritise what to migrate first, and track progress, rather than discovering vulnerable cryptography by accident. How a CBOM is built and maintained A CBOM is created through cryptographic discovery across code, systems, certificates and network traffic, and it is kept current as the environment changes. Because cryptography is everywhere, the most useful CBOMs are generated and updated through automated discovery rather than manual surveys, so they reflect reality rather than assumptions. Frequently Asked Questions What is a cryptographic bill of materials? A CBOM is a structured, machine-readable inventory of the cryptography an organisation uses, including algorithms, keys, certificates and protocols, and where each is used. How is a CBOM different from an SBOM? A software bill of materials inventories software components. A CBOM focuses specifically on cryptographic assets and how and where they are used. Why is a CBOM important for post-quantum migration? Migration requires finding and replacing vulnerable cryptography. A CBOM provides the visibility needed to locate those algorithms and plan the transition. How is a CBOM created? It is built through cryptographic discovery across code, systems, certificates and traffic, and maintained through automated updates as the environment changes. Build post-quantum readiness with eMudhra eMudhra helps organisations discover and inventory their cryptography as the foundation for crypto-agility and post-quantum migration. Connect with the team to get started. Get started: https://emudhra.com/en/contact-us Tags: Post Quantum Cryptography About the Author eMudhra Limited eMudhra Editorial represents the collective voice of eMudhra, providing expert insights on the latest trends in digital security, cryptographic identities, and digital transformation. Our team of industry specialists curates and delivers thought-provoking content aimed at helping businesses navigate the evolving landscape of cybersecurity and trust services with confidence.