CBOM & PROCUREMENT STARTER DECK · CYCLONEDX v1.6ECMA-424 STANDARD · SELF-ASSESSMENT

CycloneDX v1.6 CBOM Guide & PQC Audit RFP Kit

Developer-focused CycloneDX v1.6 schema reference and quick RFP starter kit. For full enterprise GRC audit scoping estimators and regulatory mandate matrices, visit our dedicated sister publication qdayaudits.com.

Close-up macro view of integrated circuit traces representing cryptographic hardware modules

Important Scope Note: Self-Assessment Resources Only

Q-Day Check publishes technical scanners, CycloneDX CBOM schemas, and procurement templates, and does not perform, sign off, or certify cryptographic security audits. Direct partner RFQ routing on this page is currently paused while we finalise formal referral agreements with accredited cryptography consultancies. Use the free vendor-neutral RFP template below to solicit proposals directly from qualified assessors.

Regulatory & Standards Transition Deadlines

Framework / Standard	Key Milestone	Audit & Engineering Requirement
NSA CNSA 2.0 (National Security Systems)	1 January 2027	New NSS acquisitions must support CNSA 2.0 quantum-resistant algorithms (ML-KEM-1024, ML-DSA-87, LMS/XMSS firmware signatures). Exclusive use across NSS targeted by 2030-2033.
NIST IR 8547 (Federal & Commercial Baseline)	2030 Deprecation / 2035 Disallowance	Classical 112-bit asymmetric algorithms (RSA-2048, ECDSA P-256, Ed25519, DH) scheduled for deprecation in 2030 and full disallowance after 2035.
US OMB Memorandum M-23-02	Annual Inventory Cycle	Requires federal agencies and covered contractors to maintain annual prioritised inventories of High Value Assets using quantum-vulnerable cryptography.
EU Digital Operational Resilience Act (DORA Art. 9)	Active (From January 2025)	Financial entities must maintain cryptographic key-lifecycle policies and crypto-agility controls commensurate with emerging cryptographic threats.

OWASP CycloneDX v1.6 CBOM Schema Reference

Traditional Software Asset Inventories (SBOMs) list library versions (such as openssl-3.5.0) without recording whether an application actually invokes quantum-vulnerable RSA-2048 or post-quantum ML-KEM-768 at runtime. CycloneDX v1.6 standardises the cryptoProperties object so internal teams and external assessors share one machine-readable inventory format.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "cryptographic-asset",
      "name": "X25519MLKEM768",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "parameterSetIdentifier": "768",
          "executionEnvironment": "software-plain-ram",
          "nistQuantumSecurityLevel": 3
        },
        "oid": "1.3.6.1.4.1.22554.5.6.1"
      }
    }
  ]
}

Vendor-Neutral PQC Audit RFP Template

Use this scoping template when procuring a formal cryptographic discovery audit from an accredited cybersecurity consultancy. It requires bidders to prove assessor credentials, SOC 2 / ISO 27001 controls, and professional indemnity coverage up front.

REQUEST FOR PROPOSAL (RFP): POST-QUANTUM CRYPTOGRAPHY INVENTORY & MIGRATION ASSESSMENT

1. OBJECTIVE & SCOPE
[Organisation Name] seeks proposals from accredited cryptographic security consultancies to:
(a) Generate an OWASP CycloneDX v1.6 Cryptographic Asset Inventory (CBOM) across external TLS endpoints, internal mTLS meshes, SSH bastions, code-signing pipelines, and PKCS#11 HSMs.
(b) Identify all quantum-vulnerable public-key dependencies (RSA, DH, ECDH, ECDSA, Ed25519) mapped against data retention horizons (Mosca X + Y > Z analysis).
(c) Deliver a phased remediation roadmap aligned with NIST FIPS 203/204/205, NIST IR 8547 (2030 deprecation), and NSA CNSA 2.0 where applicable.

2. MANDATORY ASSESSOR QUALIFICATIONS
Responding firms must provide verifiable evidence of:
- Named cryptographic engineers signing the final assessment report;
- Current ISO/IEC 27001 or SOC 2 Type II attestation for handling client architecture data;
- Professional indemnity and cyber liability insurance certificates;
- Two anonymised sample CBOM deliverables and reference engagements.

3. DELIVERABLES
- Machine-readable CycloneDX v1.6 CBOM JSON inventory;
- Hybrid TLS 1.3 (X25519MLKEM768) middlebox/MTU readiness test report;
- PKI & HSM hardware upgrade schedule with vendor FIPS 140-3 validation milestones;
- Executive board briefing and 24-month engineering backlog.

Reviewed by Callum Reid, Principal Infrastructure & Cryptography Editor

Reviews OWASP CycloneDX CBOM specifications and federal post-quantum transition advisories.

Last reviewed: 2026-11-01

Reviewed every 3 months

AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.

Verified Primary Sources

OWASP CycloneDX v1.6 CBOM (Cryptographic Asset Inventory) Capability (OWASP / ECMA-424 Standard, CycloneDX v1.6+)
NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) FAQ (U.S. National Security Agency, January 2027 NSS Milestone)
NIST IR 8547: Transition to Post-Quantum Cryptography Standards (NIST, November 2024)

Get Notified When CBOM Tooling & CNSA 2.0 Guidance Updates

PQC & Hybrid TLS Readiness Briefings

Store your email for quarterly updates on open-source CBOM scanners and NIST/NSA transition milestones. No emails are sent yet.