What a cryptography inventory can—and cannot—tell you

What is a cryptography inventory?

A cryptography inventory is a record of cryptographic components and their relationships. One machine-readable representation is a Cryptography Bill of Materials (CBOM). You do not need to know that acronym to start: think of it as a structured list of the cryptography your tools have identified.

CycloneDX documents cryptographic assets and their relationships as part of its bill-of-materials model. The usefulness of an inventory depends on how it was collected and the scope it covers.

Evidence is a starting point

A source observation can tell a reviewer where a cryptographic pattern appears. It usually cannot establish all of the following on its own:

• Whether the code is deployed or reachable.
• Which data the operation protects.
• How a library is configured at runtime.
• Whether a vendor supports a suitable replacement.
• Which operational tests a change must pass.

Turn inventory entries into engineering work

For each related group of observations, record the owner, affected flow, dependencies, assumptions and verification criteria. Confirm scope before assigning an implementation deadline.

A useful review asks: What evidence would change our decision? This keeps missing information visible and makes the next action clearer.