CBOM: a bill of materials for your cryptography, and what it has to do with PCI

Software teams learned during the supply-chain years that "what are we running?" deserves a machine-readable answer, and the SBOM became normal. The same question is now being asked about cryptography, by PCI assessors, by regulators planning the post-quantum transition, and by anyone who has tried to answer "where do we still use RSA?" from memory. The machine-readable answer is the CBOM, the cryptographic bill of materials, standardized in CycloneDX 1.6.

What a CBOM contains

A CBOM is an inventory document in which each entry is a cryptographic asset: an algorithm, a protocol, a key, or a certificate, with structured properties. For an algorithm, that includes its family and parameters, where it is used, what it is used for, and a field the next decade will make important: its NIST quantum security level. Classical public-key algorithms such as RSA and elliptic-curve schemes sit at level 0, meaning a sufficiently large quantum computer breaks them. Post-quantum schemes like ML-KEM and hybrids like X25519MLKEM768 carry real levels. Symmetric ciphers and hashes are labeled on their own terms, since "post-quantum" claims for them mean something different and vaguer.

Because the format is standard, a CBOM is diffable, auditable, and toolable. Two CBOMs from two quarters show exactly what changed. That is the property a compliance inventory has always been missing.

The PCI connection

PCI DSS v4.0.1 requirement 12.3.3, mandatory since March 31, 2025 for ROC and SAQ D entities, requires a documented inventory of all cipher suites and protocols in use, with purpose and location, reviewed at least annually, alongside monitoring of cryptographic developments and a plan for responding to them. Requirement 4.2.1.1 adds an inventory of trusted keys and certificates protecting cardholder data in transit.

A CBOM is that inventory, in a form that satisfies the letter of the requirement and fixes its practical failure, staleness. The annual review becomes: regenerate, diff, explain the diff. The trend-monitoring obligation becomes legible too, because quantum exposure is a field in the document rather than a paragraph someone rewrites each year.

The same document starts your post-quantum migration

Every post-quantum mandate, from CNSA 2.0 acquisition timelines for national security systems to the federal procurement rules now being written for contractors, begins with the same instruction: inventory your cryptography. NIST's transition guidance phases out today's classical public-key algorithms over the coming decade, and data that must stay confidential for years is already exposed to harvest-now, decrypt-later collection. A quantum-classified CBOM produced for this year's PCI assessment is, unchanged, the baseline document for that migration. One artifact, two obligations.

Producing one without a project

Our free scanner emits a CycloneDX 1.6 CBOM from your code and configuration, with quantum classification on every finding and a plain-language summary in the terminal. It runs inside your environment and uploads nothing.

For assessments, we convert your scanner output plus a short guided questionnaire into a signed report mapped to 12.3.3 and 4.2.1.1. The report states its scope and method on its face, labels scanned findings and attested answers separately, and carries a signature your assessor can verify with our open-source offline verifier, no account, no trust in us required. That verification property is the point: an inventory someone can check beats an inventory someone must believe.

Free scanner at scrutari.ai/pci. Signed report, $990, within one business day of complete inputs.