CBOM Profiles
a neutral methodology for cryptography bills of materials

A CBOM profile is a constrained, use-case-specific specification of what a Cryptography Bill of Materials should contain, how its fields are interpreted, and what validation rules apply. Our methodology describes how to define one — independently of any single base standard.

Profiles are designed to map onto existing BOM standards such as CycloneDX and SPDX rather than compete with them. The PKIC output is intended to become the reference any industry consults when creating a CBOM profile for a particular use case.

The methodology documentation sets out the approach in full and applies it to an ordinary example: an nginx web server, its CBOM expressed in CycloneDX 1.7, checked against a small product-independent profile. One CBOM conforms and one does not, and you can run the check yourself.

It covers the vocabulary the methodology rests on, how a profile is written and validated, how the same profile maps onto CycloneDX and SPDX, how cryptographic weakness is communicated alongside a CBOM rather than inside one, what happens to older CBOM files, and how profiles are governed over time. Start with the introduction, the model, the profile itself, or the interactive conformance check.

Almost every jurisdiction now requires organisations to hold a cryptographic inventory. Almost none of them says what that inventory should look like.

India's CERT-In guidelines are the exception that proves the rule — they name the CBOM outright. Everywhere else the obligation is stated and the format is left open. A neutral CBOM profile is what turns "keep an inventory" into something producers and consumers can actually exchange and verify. The reference register is the evidence base for that argument.