Building a cryptographic inventory means discovering all the cryptography in use across your systems (algorithms, keys, certificates, libraries, and protocols) and recording it in a structured, continuously maintained catalog, usually a CBOM in the CycloneDX format.
To build a cryptographic inventory, run cryptographic discovery across certificates, code, key stores, and network traffic, then normalize the findings into a CBOM in the CycloneDX format with owners and locations. Assess the inventory against policy to flag weak or quantum-vulnerable cryptography, and keep it current with continuous discovery. The inventory is the foundation for PQC migration.
Key Takeaways
- A cryptographic inventory records all cryptography in use, usually as a CycloneDX CBOM.
- Build it by discovering certificates, then code, keys, and protocols, and normalizing the results.
- Use the CycloneDX format (ECMA-424) so the inventory is machine-readable and interoperable.
- Assess the inventory against policy to flag weak or quantum-vulnerable cryptography.
- Keep it continuous; a stale inventory loses its value quickly.
Why Build a Cryptographic Inventory?
A cryptographic inventory is the starting point for managing cryptographic risk and for post-quantum migration. You cannot replace weak or quantum-vulnerable algorithms you cannot see. The inventory, usually a CBOM, makes your cryptography visible so it can be assessed and upgraded.
Step-by-step: Building a Cryptographic Inventory
- Define scope and goals: Decide which systems, environments, and asset types to cover, and why (for example, PQC readiness or compliance).
- Discover certificates first: Start with certificate discovery, where visibility is usually highest, then expand.
- Scan code and binaries: Find cryptographic algorithms, hard-coded keys, and bundled libraries in applications.
- Inspect key and certificate stores: Catalog keys, key pairs, and certificates in key management systems and HSMs.
- Analyze network traffic: Identify protocols such as TLS and SSH and the algorithm versions actually in use.
- Normalize into a CBOM: Record everything in the CycloneDX format, with owners and locations.
- Assess against policy: Flag weak, deprecated, or quantum-vulnerable cryptography for remediation.
- Keep it current: Run discovery continuously so the inventory stays accurate as systems change.
Use the CycloneDX Format
Record the inventory in CycloneDX, the open standard that added native cryptographic asset support in version 1.6 and is published as ECMA-424. Using a standard format makes the inventory machine-readable, lets it sit alongside an SBOM, and keeps it interoperable with tooling across the supply chain.
Make it Continuous
A cryptographic inventory is only useful if it stays current. Treat building it as the start of ongoing cryptographic posture management rather than a one-off audit, and let it feed your PQC migration.
How Encryption Consulting Helps
CBOM Secure automates cryptographic discovery and inventory and builds a continuously updated CycloneDX inventory across code, certificates, keys, and traffic, so you do not have to assemble it by hand. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is a cryptographic inventory?
A cryptographic inventory is a structured, maintained record of all the cryptography an organization uses: algorithms, keys, certificates, libraries, and protocols. It is commonly expressed as a CBOM (Cryptography Bill of Materials) in the CycloneDX format, and it is the foundation for managing cryptographic risk and planning post-quantum migration.
How do you build a cryptographic inventory?
Build it through cryptographic discovery: scan source code and binaries for algorithms and libraries, inspect certificate and key stores, and analyze network traffic for protocols. Normalize the findings into a CBOM, assign owners, and keep the inventory current with continuous discovery. The result is a living catalog rather than a one-time snapshot.
What format should a cryptographic inventory use?
CycloneDX is the de facto standard. It added native support for cryptographic assets in version 1.6 and is published as the Ecma International standard ECMA-424. Using CycloneDX makes the inventory machine-readable and interoperable with tooling, and it lets cryptographic inventory sit alongside an SBOM in the same format.
How often should a cryptographic inventory be updated?
Continuously. Cryptography changes as code is updated, certificates are issued and renewed, and systems are deployed or retired. A point-in-time inventory becomes stale quickly, so discovery should run on an ongoing basis, feeding a living inventory. This is the difference between a one-time audit and ongoing cryptographic posture management.
Where do you start when building a cryptographic inventory?
Start where you have the most visibility and risk, often TLS certificates, then expand to algorithms, keys, libraries, and protocols across code and systems. Prioritize systems that protect long-lived sensitive data, since they are most exposed to harvest-now, decrypt-later. Automated discovery tools make broad coverage practical.
Build Your Inventory Faster
Ready to automate cryptographic inventory? See CBOM Secure in action, or read about cryptographic discovery and inventory.