Vista Platform / CBOM & compliance
Evaluate the cryptography in your inventory against clear controls. Resolve findings, verify new observations, and generate a scoped Cryptographic Bill of Materials with traceable evidence.
01 / Improve the inventory. Preserve the truth.
A CBOM documents what was observed. Vista helps your team improve that underlying inventory through evaluation and remediation, while keeping remaining issues and coverage gaps explicit.
Choose the assets and cryptographic inventory included in the evidence boundary.
Apply relevant framework controls to the observed inventory.
Assign failing findings, address configurations, and record decisions.
Collect updated evidence and review the resulting evaluation.
Create an on-demand, dated CBOM against the chosen Scope.
“Clean” means addressing issues and explaining exceptions and gaps. Exporting a CBOM does not fix findings or certify organizational compliance.
02 / Framework → control → measurement
Frameworks organize requirements into controls. Typed measurements test those controls against observed inventory, producing findings you can investigate down to the asset or cryptographic configuration.
Browse published controls in plain language, review preview scores, and activate relevant frameworks. Asset and certificate changes trigger incremental evaluation; scores reflect the severity of findings.
Illustrative control evaluation
03 / Apply the right policies
Included in Core
Evaluate inventory using bundled frameworks for cryptographic best practices, PQC readiness, certificate hygiene and expiry, inventory hygiene, and lifecycle.
Enterprise
Add the regulated content bundle with controls mapped to SOC 2, PCI-DSS, ISO/IEC 27001, NIST CSF, and IEC 62351-3. Author custom policies for internal requirements.
Framework results describe the implemented controls evaluated against available inventory evidence. They support compliance work; they do not establish full compliance with a standard or replace an independent audit. Enterprise regulated content must be enabled by the operator.
04 / A record with a boundary and a timestamp
Capture the Scope identity, version, and name so reviewers can understand the inventory boundary used at generation.
Produce a frozen CycloneDX 1.7 artifact from the cryptographic components matching that Scope.
Record when the artifact was created and its input-data freshness metadata. Review detailed coverage in the underlying inventory.
Hash canonical CycloneDX bytes with SHA-256. Verify the artifact against its recorded hash.
Download canonical CycloneDX, or SPDX JSON and PDF projections created from that same source.
Return to underlying inventory records for source evidence and context. The CBOM itself does not embed raw capture or device-response data.
05 / Enterprise evidence
Add HMAC signing for tamper-evidence, compliance-attestation layers for evaluation results, and comparison between artifacts to support migration and remediation reviews.
HMAC verification requires the shared secret or access to the verification endpoint. It is not a public-key signature. The hash and signature cover canonical CycloneDX bytes, not PDF or SPDX renderings.
Generate a scoped artifact with the inventory and evidence available at that time.
Resolve findings, record exceptions, and gather fresh observations.
Generate another artifact and review differences with Enterprise comparison.
Edition guide
| Capability | Core | Enterprise / MSP |
|---|---|---|
| Scoped CBOM generation & content hashes | Included | Included |
| CycloneDX, SPDX & PDF downloads | Included | Included |
| Bundled Core frameworks & evaluation | Included | Included |
| Regulated framework content | — | Included; operator-enabled |
| Custom policies & threshold overrides | — | Included |
| HMAC signing & compliance attestation | — | Included |
| Artifact comparison | — | Included |
Questions about evidence
Go deeper: What makes CBOM evidence traceable · Product documentation.
A CBOM is a structured record of cryptographic components and their context within a defined scope. Vista generates scoped CycloneDX CBOM artifacts from inventory evidence, with provenance, freshness information, and a content hash.
An SBOM describes software components and dependencies. A CBOM focuses on cryptographic components, such as algorithms, certificates, and related properties. They answer complementary questions: software composition and cryptographic use.
A useful CBOM has an explicit scope, consistent identities, traceable observations, and visible unresolved findings. Cleaning the inventory means correcting records and investigating findings, not removing inconvenient evidence or claiming that an export proves compliance.
A CBOM is a record of cryptographic inventory at a point in time. Enterprise attestation adds the evaluated control results. Neither is a certification or a substitute for the wider technical, operational, and organizational evidence an audit may require.
No. You can generate a baseline while issues remain. Use it to establish the current state, organize remediation, and generate later artifacts to document progress. A missing attestation layer must not be interpreted as a passing result.
Generation is on demand through the UI or API. Continuous inventory evaluation and CBOM generation are separate operations; Vista does not currently schedule recurring CBOM artifacts.
Enterprise users can author custom policies with controls and typed measurements against inventory. Governed threshold overrides are also Enterprise; override authoring is provisioned through the API rather than a tenant self-service screen.
Integrity verification applies to the canonical CycloneDX artifact. PDF and SPDX files are convenient projections. Enterprise HMAC signatures require access to the shared secret or the verification endpoint.
Self-hosted. Free and source-available.
Start with Core’s framework evaluation and CBOM generation. Add Enterprise when you need custom policies, regulated content, attestation, and comparison.
Stay in the loop
Get release notes, product updates, and opportunities to share feedback. Joining the mailing list is optional—Core is available without a subscription.