CBOM Manual: Cryptographic Inventories for DORA Work

1. Where a Cryptographic Inventory Fits

DORA's ICT risk management requirements, and the regulatory technical standards made under it, expect financial entities to manage encryption and cryptographic keys deliberately. Check the regulation and the standards themselves, or your legal and compliance teams, for the exact obligations that apply to you.

Whatever the precise obligations, you cannot manage algorithms you have not inventoried. A CBOM gives a machine-readable list of the algorithms found in your code that you can review, track over time and feed into your own risk processes.

2. What a CBOM Contains

A CycloneDX 1.6 CBOM lists cryptographic assets as components with crypto-properties, such as the primitive, parameter set and the functions used. crypto-cbom builds these entries from the algorithm names it finds when scanning source files. The /v2/compliance/cbom endpoint of crypto-server returns a CBOM of the algorithms that service implements.

3. Generating and Auditing a CBOM in CI

Install @sebastienrousseau/crypto-cbom from npm (0.0.8 or later). Its CLI has two commands: scan writes a CycloneDX (or, with --format spdx, SPDX) CBOM, and audit validates a CBOM and prints an audit.

crypto-cbom scan src/ --format cyclonedx --output cbom.cdx.json
crypto-cbom audit cbom.cdx.json

Because audit exits with status 1 when the inventory fails its checks, you can run it as a CI step to stop a pull request that introduces broken algorithms. It prints JSON; it does not produce SARIF or line-level annotations.

4. Algorithm Classification Used by the Audit

The audit classifies each asset by name. This is a heuristic based on the algorithm name, not a regulatory classification:

5. Third-Party Providers

DORA also covers the management of ICT third-party risk. When you depend on external software or service providers, consider asking them for a CBOM with each major release and for their post-quantum migration plans, so their cryptography can be included in your own inventory.

6. What the Tool Produces

• crypto-cbom scan: a CycloneDX 1.6 or SPDX 3.0 CBOM document.
• crypto-cbom audit: a JSON audit result with findings per asset and a summary score.

There is no evidence bundle, key-rotation proof or auditor package. Treat the output as engineering input to be reviewed by people accountable for your compliance.

7. A Practical Starting Checklist

1. Discover: run crypto-cbom scan across your repositories and collect the CBOMs.
2. Review: check the findings by hand; name-based scanning misses indirect uses and can flag false positives.
3. Remediate: remove broken algorithms (DES/3DES, RC4, MD5, SHA-1) from active use.
4. Plan: record where quantum-vulnerable public-key algorithms are used and plan their migration with your risk and compliance teams.