As of release 10.6.1, Compliance Manager supports importing and exporting Cryptography Bill of Materials (CBOM) data in the CycloneDX format.

A Cryptography Bill of Materials (CBOM) is a structured inventory of the cryptographic assets used in an environment. A CBOM can include:

• keys
• certificates
• secrets
• algorithms
• protocols
• cryptographic libraries
• hardware security modules (HSMs)

A CBOM also records relationships between cryptographic assets. For example, it can identify a certificate that contains a public key, a private key stored in an HSM, or a certificate associated with an endpoint.

CBOM helps organizations:

• Improve visibility into cryptographic assets and their usage
• Consolidate cryptographic inventory from multiple sources
• Support compliance and risk assessments
• Exchange inventory data with external tools
• Assess post-quantum cryptography (PQC) readiness

CBOM files use the CycloneDX standard and can be imported and exported in JSON or XML format. CycloneDX defines how bill-of-materials information is represented, while CBOM defines the cryptographic information that is captured. A related format, Software Bill of Materials (SBOM), is used to describe software components and dependencies.

The CBOM feature enables Compliance Manager to exchange cryptographic inventory data with external tools that support the CycloneDX standard. Imported assets are consolidated into the Compliance Manager inventory and can be used for reporting, compliance analysis, and PQC readiness assessments. Exported CBOM files can be shared with other systems that support the same format.