CBOMs and Federal Procurement: Preparing a Cryptographic Inventory
US Executive Order 14028 made software supply-chain transparency a procurement concern, and OMB M-23-02 requires federal agencies to inventory their quantum-vulnerable cryptography as part of the post-quantum migration. A Cryptographic Bill of Materials (CBOM) is the machine-readable form of that inventory.
A CBOM works like a Software Bill of Materials (SBOM) but specifically inventories algorithms, key lengths, certificates, and cryptographic configuration. CycloneDX 1.6 added first-class support for cryptographic assets, making it the natural interchange format.
Why compliance auditors use CipherMap:
- Audit Automation: Manually combing thousands of repository files for cryptographic usage is slow and error-prone. One scan produces the inventory.
- CycloneDX 1.6 Conformance: CipherMap emits real
cryptoProperties, with algorithm identity grounded per detection rule — undetermined fields are omitted, never invented. One generator backscbom,scan --format cbom, the auditor bundle, and the air-gapped vault, so the outputs cannot drift apart. - Offline Scanning: Sensitive source code cannot leave secure networks. CipherMap is a compiled binary that scans locally, and
--offlinedisables all network egress — OSV lookups and telemetry included — for isolated environments.
Cryptographic inventory requirements are spreading from national-security systems into ordinary procurement conversations. Producing a CBOM from a scan, rather than by hand, is the difference between an afternoon and a quarter.