A Cryptographic Bill of Materials becomes useful when different teams can rely on its meaning, not merely when it contains many columns. A new research paper, CATALOGA: A Normative Minimum-Elements Model for Cryptographic Bills of Materials, proposes nine minimum CBOM elements intended to support automated, whole-infrastructure post-quantum migration.
Published October 6, the paper’s proposed elements cover asset identity, algorithms and parameters, classification, location and provenance, system context, quantum-vulnerability classification, lifecycle state, crypto-agility attributes, and relationship or deduplication identity. That is a useful checklist for discussion. It is not an adopted standard, and the paper should not be treated as proof that one nine-field model will fit every organization or satisfy every mandate.
Minimum content is only half the contract
A required field can still contain an unverified guess, an ambiguous label, or a value copied from supplier documentation that does not describe the deployed state. Two CBOMs can use the same field names while disagreeing about scope, identifiers, timestamps, and what “observed” means.
A practical minimum therefore needs evidence semantics alongside data semantics. For each material fact, teams should know:
- which source produced it and when;
- whether it describes capability, configuration, observation, or policy;
- the collection method and covered population;
- confidence, validation state, and unresolved conflicts;
- the owner responsible for confirming or correcting it;
- the identifier used to reconcile it with other sources;
- refresh triggers and expected evidence age; and
- which unknowns, exclusions, and inaccessible environments remain.
Without these rules, completeness can be simulated by filling cells. A CBOM should preserve uncertainty rather than convert it into false certainty.
Relationships make the inventory actionable
Algorithms do not migrate independently. They are implemented by libraries and modules, configured by applications, negotiated across connections, attached to keys and certificates, and constrained by suppliers and relying parties. A list of cryptographic assets cannot express that dependency chain unless relationships are first-class records.
For example, one certificate may be served by multiple endpoints, rely on an issuing hierarchy, terminate at a gateway, and protect applications owned by different teams. One library version may appear in hundreds of software components. A stable relationship model lets teams change a shared dependency once, identify its blast radius, and retain separate proof for each deployment.
Deduplication must not erase legitimate distinctions. Records that share a fingerprint may still have different locations, owners, configurations, exposure, or lifecycle states. Canonical identity should connect observations while retaining source-specific evidence.
Quantum-vulnerability labels need context
A CBOM can flag RSA or elliptic-curve public-key cryptography as quantum vulnerable, but prioritization depends on the role it plays. Key establishment protecting long-lived confidential data creates a harvest-now-decrypt-later concern. A signature or certificate creates an authentication timeline. Symmetric encryption and hashing have different quantum implications.
Classification should therefore include cryptographic role, protected data or service, confidentiality lifetime, exposure, and target state. “Quantum vulnerable” is an evaluation result, not a complete remediation decision.
Crypto agility must be evidenced, not self-declared
The proposed model includes crypto-agility attributes. That concept is valuable but easy to overstate. A product that supports several algorithms may still require downtime, a firmware replacement, a contract change, or coordinated upgrades across partners.
Evidence of agility can include configuration paths, supported identifiers, tested upgrade and rollback procedures, key and certificate lifecycle compatibility, supplier commitments, and observed production changes. The meaningful question is not whether change is theoretically possible, but whether an approved target can be deployed safely within the required window.
What organizations should do next
First, compare existing CBOM fields with the proposed minimum categories, but do not add fields without defining their evidence rules.
Second, distinguish capability, configuration, and observed use. Preserve all three where they answer different questions.
Third, define canonical identifiers and relationships before attempting large-scale deduplication. Retain provenance for every merged observation.
Fourth, make unknown, stale, conflicting, and excluded records visible in coverage reporting. Discovery gaps are not proof of absence.
Finally, test whether each record can support a real decision: assign an owner, evaluate policy, create a remediation item, re-observe the state, and produce reviewable proof.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps organizations reconcile cryptographic observations while retaining owners, relationships, decisions, remediation, and evidence.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted rather than indiscriminate network scanning. Vista is not a vulnerability scanner, and discovery gaps are not proof of absence.
Explore Vista’s CBOM and compliance and cryptographic inventory resources.
Where uncertainty remains
CATALOGA is a research proposal, not an adopted CBOM standard or a validated universal minimum. Organizations should verify its legal and policy interpretations independently and compare the model with their sector requirements and existing schemas. Its strongest contribution is the invitation to define a common minimum; operational credibility still depends on provenance, coverage, and repeatable proof.
Source
- CATALOGA: A Normative Minimum-Elements Model for Cryptographic Bills of Materials, Sumit Kumar Mitra, SSRN, October 6, 2026.