Skip to main content
ciphermap.io
OMB M-23-02 · NSA CNSA 2.0 · NIST IR 8547 / FIPS 203–205·SCIF & Air-Gap Ready (0 Bytes Uploaded)

Pass your OMB M-23-02 & CNSA 2.0 Post-Quantum audit in minutes—not a 6-month, $250k consulting engagement.

Generate a composite-signed CycloneDX 1.6 CBOM across 12 source languages, Java JARs, X.509/JKS/PKCS#12 keystores, and native binaries in 232ms—and stage compiler-verified FIPS 203–205 (ML-KEM / ML-DSA) upgrades 100% offline.

Signed CycloneDX 1.6 CBOMEd25519 + ML-DSA-65 (.pqc.sig)
100% Offline · SCIF-Safe0 bytes uploaded · Works with Snyk/Semgrep
Under $5k Card Threshold$4,999/yr Auditor · 100% Fleet credit
Primary Path · 25-Min Federal & Defense Engineering Briefing

Walk through a live air-gapped scan and signed CycloneDX 1.6 CBOM package, map your OMB M-23-02 / CNSA 2.0 obligations, and scope a 30-day multi-repo pilot.

No source code shared · Instant calendar hold (.ics / Google Calendar) · Direct engineering desk

Self-Serve Air-Gapped EvaluationSHA-256 Verified

Test on your own enclave first (macOS, Linux, Windows):

Includes signed native binary + sample vulnerable repo + pre-generated CycloneDX 1.6 CBOM & verification keys.

Download Free Signed CLI (.zip)
Instant $4,999/yr Card Checkout →$4,999/yr 2-Page Order Form →
Request 7-Day Pro Trial Key →
Interactive Terminal Proof (0:46 · 0 Bytes Uploaded)
Watch Full Product Tour (1:53)
ciphermap scan /enclave/repo --offline --cbom cbom-cyclonedx-1.6.json --sign-reportRetina Vector · 0ms
Open /demo Page
pkg/kem/handshake.go
PQC-PRE-001 · Pre-FIPS Draft -> FIPS 203

Upgrades AI-imported pre-FIPS kyber768 draft to stdlib ML-KEM-768 + X25519 hybrid

IDE Before → After Verified AST Diff (Go)100% Deterministic · Zero Cloud LLM
17 func EstablishSessionKey(peerPub []byte) ([]byte, []byte, error) {
18- pk, err := kyber768.Scheme().UnmarshalBinaryPublicKey(peerPub)
19- ct, shared, err := kyber768.Scheme().Encapsulate(pk)
18+ ek, err := mlkem.NewEncapsulationKey768(peerPub[:mlkem.EncapsulationKeySize768])
19+ shared, ct := ek.Encapsulate() // NIST FIPS 203 + X25519 hybrid envelope
20 return ct, deriveHybridHKDF(shared, peerPub), err
✓ Compiler + Unit Tests + Sandbox Witness: PASS (0 broken files)
0 broken edits retained
Offline CLI Execution
0 Bytes Uploaded · 218ms · Go 1.25
$ ciphermap scan ./payments-core --offline --no-telemetry && ciphermap cbom ./payments-core --offline -o cbom.cdx.json⏎ ENTER
[██████████] 100% · Verified in 218ms · Go 1.25LIVE
[offline] 0 bytes uploaded · Go AST + X.509 + PKCS#12 + ELF engine
CRITICAL PQC-PRE-001 pkg/kem/handshake.go:18 Pre-FIPS kyber768 draft import
VERIFIED ML-KEM-768 go test ./pkg/kem/... PASS (218ms · 0 broken files)
SIGNED cbom.cdx.json + cbom.cdx.json.pqc.sig (Ed25519 + ML-DSA-65)
Boardroom Deliverable PreviewZero-Egress Local Attestation

CNSA 2.0 / FIPS 203–205 Readiness

CycloneDX 1.6 CBOM · X.509 / PKCS#12 / JAR / ELF Mapped

Crypto Assets Mapped
31 keys, certs & binaries
Post-Quantum Posture
ML-KEM-768 + ML-DSA-65 Ready
Composite Signature: Ed25519 + ML-DSA-65 (.pqc.sig) VERIFIEDAuditor-Ready
100% vector DOM stage · Click any language pill above or watch recorded terminal runs (0:46 · 0 Bytes Uploaded)

Federal & Defense Regulatory Timeline

Why Prime Contractors, CMMC Enclaves & Federal Agencies Are Automating CBOM Generation Now

Manual spreadsheets cannot track cryptographic primitives embedded inside compiled JARs, PKCS#12/JKS keystores, or transitive native binaries. CipherMap produces deterministic, composite-signed evidence in a single offline pass.

OMB M-23-02 · ACTIVE NOW

Annual Federal Cryptographic Inventory & High-Value Asset Reporting

Requires automated, reproducible inventory of vulnerable public-key cryptography across federal systems and supplier software deliveries—replacing manual spreadsheets.

✓ Automated offline via ciphermap cbom --offline
NSA CNSA 2.0 · JAN 1, 2027 GATE

National Security Systems (NSS) Software & Firmware Exclusivity

Commercial off-the-shelf (COTS) software and firmware upgrades delivered to NSS enclaves must transition from classical RSA/ECDSA to CNSA 2.0 post-quantum algorithms.

✓ Automated offline via ciphermap cbom --offline
NIST IR 8547 & FIPS 203–205 · STANDARDIZED

ML-KEM, ML-DSA & SLH-DSA Production Transition

Deprecates classical 112-bit/128-bit asymmetric primitives on a fixed schedule and standardizes FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).

✓ Automated offline via ciphermap cbom --offline

Composite-Signed CycloneDX 1.6 CBOM (.json + .pqc.sig)

Machine-readable cryptographic bill of materials covering algorithms, key sizes, OIDs, certificate chains, and exact file:line locations, signed offline with Ed25519 + ML-DSA-65.

SCIF & Classified Enclave Zero-Egress Architecture

Single statically linked native binary. Enforces --offline at the OS process boundary with zero telemetry, zero cloud APIs, and zero source code leaving your network.

Deep Binary, Keystore & Archive Inspection

Inspects 12 source languages plus compiled Java .jar/.war archives, X.509 PEM/DER certificates, PKCS#12/JKS keystores, and native ELF/Mach-O/PE symbols in one pass.

Under-$5,000 Micro-Purchase Onboarding ($4,999/yr)

Start immediately on a $4,999/yr Standalone Auditor seat (under standard $5,000 corporate/government card limits, 100% credited toward an annual Fleet license within 30 days).

VERIFIED US FEDERAL & ENTERPRISE PQC MANDATE TIMELINE

NSA CNSA 2.0, OMB M-23-02, Public Law 117-260 & NIST IR 8547 Cutoffs

Waiting for 2030 is a procurement trap. Automated CBOM discovery under OMB M-23-02 is active right now, and the January 1, 2027 NSA CNSA 2.0 acquisition gate blocks non-compliant software from federal and defense supply chains.

2025–2026ACTIVE NOW

OMB M-23-02 · Public Law 117-260 · NSA CNSA 2.0 Phase 1

Mandatory Automated Cryptographic Discovery, CBOM Inventory & CNSA 2.0 Phase 1

Federal agencies, defense industrial base contractors, and regulated suppliers must maintain automated cryptographic inventories (CBOM) of quantum-vulnerable systems. Under NSA CNSA 2.0 Phase 1, Software & Firmware Signing (LMS/XMSS, ML-DSA), Web Browsers/Cloud (ML-KEM-1024 hybrid TLS), and Networking Equipment (2026) must Support & Prefer CNSA 2.0 algorithms.

  • Automated annual CBOM inventory across High-Value Assets (OMB M-23-02 & Public Law 117-260)
  • Software & Firmware Signing: Support & Prefer LMS/XMSS and ML-DSA (FIPS 204)
  • Web/Cloud TLS & Networking (2026): Support & Prefer ML-KEM-1024 (FIPS 203) hybrid key establishment
January 1, 2027IMMEDIATE ENTERPRISE BLOCKER

NSA CNSA 2.0 Acquisition Gate

All New NSS & Federal Supply-Chain Acquisitions Must Be CNSA 2.0 Compliant by Default

Starting January 1, 2027, all new COTS software and system acquisitions for National Security Systems (NSS) and federal/defense supply chains must ship CNSA 2.0 compliant cryptography by default unless a formal waiver is granted.

  • Vendor CBOM attestation required prior to procurement approval
  • ML-KEM-1024, ML-DSA-87 / ML-DSA-65, and SHA-384/SHA-512 enforcement
  • Elimination of uninventoried RSA-2048, ECDSA P-256, and legacy PKCS#12/JKS keystores in shipped artifacts
December 31, 2030DEPRECATION CUTOFF

NIST IR 8547 & CNSA 2.0 Exclusive Use / Deprecation Cutoff

Classical RSA-2048, ECDH & ECDSA Deprecated Across HVAs; Exclusive CNSA 2.0 Enforcement

Under NIST IR 8547 and NSA CNSA 2.0, classical 112-bit security public-key algorithms (RSA-2048, ECDH, ECDSA) are officially deprecated across Federal High-Value Assets and disallowed for CNSA 2.0 Software/Firmware Signing and Networking.

  • RSA-2048, Diffie-Hellman, ECDH, and ECDSA deprecated under NIST IR 8547
  • Exclusive CNSA 2.0 post-quantum enforcement for Software/Firmware Signing & Networking
  • Zero tolerance for legacy TLS 1.2 static RSA or SHA-1/MD5 signature chains
December 31, 2031 – 2035COMPLETE DISALLOWANCE

NIST IR 8547 & NSM-10 Complete Disallowance

Legacy Quantum-Vulnerable Public-Key Cryptography Completely Disallowed

By 2031–2035 under NIST IR 8547 and National Security Memorandum 10 (NSM-10), legacy quantum-vulnerable public-key cryptography is completely disallowed across all federal, defense, and critical-infrastructure systems.

  • Complete disallowance of classical-only RSA, ECDSA, and ECDH under NIST IR 8547 (2035 cutoff)
  • Full CNSA 2.0 exclusive post-quantum posture across all NSS niches by 2031–2033
  • Continuous signed CycloneDX 1.6 CBOM & OpenVEX 0.2.0 regression gates enforced in CI/CD
ROI & ENGINEERING TIME CALCULATOR · US NATIONAL AVERAGE BENCHMARK

Estimate Your Monthly Manual Triage Cost vs. Automated Local Remediation

Application Security & Senior Software Engineers average $160,000/yr (~$80/hr) in the US before benefits, and multi-repository external PQC readiness assessments typically run $15,000–$75,000+ for static spreadsheets that never fix a single line of code.

25 repos

Scale from a single flagship service (1 repo) to a 250-repo enterprise fleet.

1 repo ($4,999 Sprint)250 repos
3 engineers

Anchored at $160,000/yr (~$80/hr · $13,333/mo) per engineer.

1 engineer20 engineers
450 findings

Includes deprecated RSA/ECDSA/SHA-1 call sites, JKS/PKCS#12 certs, and SQLi/XSS/path sinks.

50 findings5,000 findings
CipherMap Deterministic Savings Benchmark

At 232ms median local repo scan (verified across 832 benchmark repos with 0 crashes), CipherMap inventories all 25 repositories in ~5.8s and verifies fixes via T0/T1 compile-and-test sandboxed autofixes.

Monthly Engineering Bleed

$6,480/mo

~81 hrs/mo manual triage (@ $80/hr)

CipherMap Net Annual Savings

$130,261/yr

Includes avoiding ~$62,500 external audit

Recommended Flat-Rate License Tier

Team Fleet (Up to 25 Repos)

$9,999/yr

$4,999 Sprint 100% credited in 30 days

Zero Hidden Fees / 100% All-Inclusive Enterprise Pledge

$0

per-developer seat tax

Unlimited developer & CI/CD runner commits inside your licensed repository tier.

$0

token/Byte-upload fees

100% local deterministic AST & bytecode engine—zero cloud token metering or per-line surcharges.

$0

mandatory professional services tax

White-glove CI/CD, GitHub Actions, and local MCP setup included with annual fleet plans.

Start with a 7-Day Free Pro Trial (100 CLI scans) or $4,999 Single-Repo Sprint
Explore Founding Partner Offer
UNFAKABLE TECHNICAL CASE STUDY & PROOF WALL

Four Verifiable Engineering Proofs You Can Audit Offline in Under 3 Minutes

No slideware, no cloud uploads, and no unverified AI patches. Every claim below is reproducible on your own workstation before you spend a dollar.

PROOF 01 · ZERO EXFILTRATION0 bytes of source code ever leave your machine

Air-Gapped Zero-Exfiltration Guarantee

Compiled as a standalone CGO_ENABLED=0 static binary running with --offline --no-telemetry. Verify zero outbound sockets yourself under strace, Little Snitch, or inside an air-gapped VPC runner.

  • CGO_ENABLED=0 static binary with SHA-256 checksums
  • --offline --no-telemetry enforced at runtime
  • 0 bytes of source code ever leave your machine
CGO_ENABLED=0 · ciphermap scan . --offline --no-telemetry
PROOF 02 · DETERMINISTIC SCALE232ms median scan time across 832 repositories · 0 parser crashes

Speed & Scale Proof

Benchmarked across 832 real-world multi-language repositories (Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift) with 232ms median local scan latency and 0 parser crashes.

  • Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift
  • Deep bytecode & keystore inspection (.jar, .war, .whl, JKS, PKCS#12, X.509)
  • Deterministic AST + call-graph reachability without LLM token variability
232ms median scan · 832 benchmark repos · 0 parser crashes
PROOF 03 · COMPILER-VERIFIED AUTOFIXT0/T1 broken-build isolation + 100% automatic rollback

Gate 1–4 Compile & Test Sandbox Proof

Every AST autofix is verified against your actual compiler/test suite inside an isolated worktree. T0/T1 broken-build isolation ensures that if a single unit test fails, CipherMap triggers a 100% automatic rollback.

  • T0/T1 broken-build isolation before any patch is proposed
  • 100% automatic rollback if a single test fails
  • Zero uncompiled regex replacements or hallucinated imports
Gate 1 AST → Gate 2 Build → Gate 3 Test Suite → Gate 4 Diff Sign-Off
PROOF 04 · DUAL-SIGNED EVIDENCEEd25519 + ML-DSA-65 (FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM

Cryptographically Signed Audit Evidence

Every run emits a dual-signed (Ed25519 + ML-DSA-65 FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM archival bundle ready for PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B assessors.

  • Dual-signed with classical Ed25519 and post-quantum ML-DSA-65 (FIPS 204)
  • CycloneDX 1.6 CBOM + CISA IBOM with file:line provenance
  • Mapped to PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B
Ed25519 + ML-DSA-65 (FIPS 204) · CycloneDX 1.6 CBOM + CISA IBOM
2-Minute Reproducible CLI Walkthrough (No Slides)

From Local Discovery to Signed CycloneDX 1.6 CBOM + Sandboxed Autofix

Download Offline Eval Pack (.zip)Inspect 832-Repo Benchmark Evidence
[00:00]Offline · 0 Bytes Sent

Step 1 — Air-Gapped Local Discovery (232ms Median)

$ ciphermap preflight . --offline --no-telemetry

Scans source, compiled .jar/.whl archives, X.509 certificates, and JKS/PKCS#12 keystores locally with 0 bytes uploaded.

[00:55]Offline · 0 Bytes Sent

Step 2 — Gate 1–4 Compile & Test Sandboxed Autofix

$ ciphermap fix . --verify-sandbox --offline

Applies deterministic AST migrations (e.g., RSA-2048/SHA-1 to ML-KEM/ML-DSA or parameterized SQL sinks) with T0/T1 broken-build isolation and 100% automatic rollback if any test fails.

[01:45]Offline · 0 Bytes Sent

Step 3 — Dual-Signed CycloneDX 1.6 CBOM + CISA IBOM

$ ciphermap report --format cyclonedx-1.6 --offline

Produces the Ed25519 + ML-DSA-65 (FIPS 204) signed audit binder for PCI-DSS 4.0, CNSA 2.0, SOC 2, CMMC 2.0, and FDA Section 524B assessors.

Federal, Defense & Air-Gapped Deployment FAQ

Can CipherMap run inside an air-gapped SCIF, Classified Enclave, or AWS GovCloud runner?

Yes. CipherMap ships as a self-contained native binary for Linux (x86_64/ARM64), macOS, and Windows. Passing --offline enforces zero network socket creation at runtime, and license leases verify offline using embedded Ed25519 + ML-DSA-65 public keys.

How does CipherMap complement existing SAST or SCA tools like Snyk, Semgrep, or GitHub Advanced Security?

General SAST/SCA scanners focus on CVEs in open-source dependencies. CipherMap is a dedicated cryptographic inventory and post-quantum transition engine that inspects source ASTs, X.509/PKCS#12/JKS keystores, JARs, and native binaries to emit a composite-signed CycloneDX 1.6 CBOM.

How fast can we generate our first signed CycloneDX 1.6 CBOM for a prime contractor or agency data call?

Under 5 minutes. Download the free SHA-256-verified Evaluation Pack (.zip) to run locally right now, or schedule a 25-minute live 1-on-1 engineering session to walk through your repository architecture and 30-day pilot deliverables.

Ready for Your Agency or Prime Contractor Data Call?

Book a 25-minute live engineering session or download the signed offline CLI now.

Download Free Signed CLI (.zip)
© 2026 CipherMap (Ciphermap Technologies LLC)100% Local Zero-Egress ExecutionPrivacyTermsSecurity