Why create a CBOM now?
Australia’s post-quantum transition is no longer just a theoretical discussion. The Australian Signals Directorate recommends a refined PQC transition plan by the end of 2026. A CBOM helps identify the algorithms, protocols, certificates and services that will need attention. These are recommended planning milestones, not a universal statutory deadline for every organisation.
Step 1: Choose one important system
Start with one business-critical system: a customer portal, payroll platform, document-management service or another important application. Identify its business owner, technical owner and the information it protects. Starting small makes the first inventory manageable and gives you a repeatable process.
Step 2: Identify the cryptography in use
Record the algorithms, protocols, certificates, key sizes or parameters, libraries, software versions, suppliers, system owners and the purpose of each cryptographic mechanism. Include cryptography protecting data in transit, data at rest, authentication and digital signatures. Record where information is unknown. Never put passwords or private cryptographic keys in a CBOM.
Step 3: Build a simple first inventory
You can start in a spreadsheet. The following is an illustrative example, not a claim about any specific deployment.
| Business system | Cryptography | Purpose | Initial action |
|---|---|---|---|
| Customer website | RSA certificate | Website authentication | Check certificate and vendor migration plans |
| Internal application | ECDH | Establish secure communications | Investigate PQC support |
| Document storage | AES-256 | Protect stored information | Review configuration |
| Software updates | ECDSA | Verify digital signatures | Confirm vendor roadmap |
RSA, ECDH and ECDSA are vulnerable to a sufficiently capable future quantum computer. AES-256 is symmetric cryptography and does not face the same type of quantum risk.
Step 4: Verify what you have found
Interviews and documentation are useful, but they can miss cryptography embedded in operating systems, software libraries, hardware and cloud services. Compare records with configuration checks, certificate discovery, software inventories and suitable technical discovery tools. Label each entry as verified, supplier-reported or unconfirmed.
Step 5: Ask your suppliers
Many organisations do not control the cryptography inside commercial products or managed services. Ask suppliers which algorithms and protocols they use, whether they support standardised post-quantum algorithms, their planned upgrade dates and any customer actions required. ASD’s July 2026 guidance on questions to ask vendors is a useful starting point.
Step 6: Consider a standardised CBOM format
A spreadsheet is a sensible first step. As the inventory matures, a machine-readable format can improve exchange and maintenance. CycloneDX supports cryptographic assets and CBOM use cases, helping teams move towards a more consistent and reusable record.
Step 7: Turn the CBOM into a transition plan
Use the inventory to prioritise quantum-vulnerable public-key cryptography, sensitive data with long confidentiality lifetimes, business-critical systems, hard-to-upgrade dependencies and supplier readiness. Assign owners and next actions. Keep the CBOM current as systems and configurations change.
My perspective
The biggest mistake would be to treat PQC transition as merely swapping encryption algorithms. Real-world systems contain complicated dependencies across applications, suppliers, certificates and infrastructure. A CBOM makes those dependencies visible. Start small, start now and improve the accuracy of your inventory over time.
Continue the conversation
Would you like to discuss creating a CBOM or preparing a post-quantum transition plan? I would be delighted to arrange a complimentary, no-obligation online discussion. darcy.eamonn@quecwa.com.au.
References and further reading
Australian Signals Directorate — Planning for Post-Quantum Cryptography; Post-Quantum Questions to Ask Your Vendors (July 2026); Information Security Manual: Guidelines for Cryptography (September 2026). NIST NCCoE — Migration to Post-Quantum Cryptography. CycloneDX — CBOM. Ecma International — ECMA-424.