Technical reference
CBOM Support
QDayRisk produces a Cryptographic Bill of Materials (CBOM) from a completed assessment. Each CBOM is a CycloneDX 1.7 JSON document and is validated against the official CycloneDX 1.7 JSON schema before it is issued; a document that fails validation is not issued. Each document carries a unique serial number and a dependency graph from the assessment to every asset, and devices to their firmware.
What it contains
Entries are compiled from what the organisation provides in the assessment — the cryptographic algorithms in use, and operational-technology devices with their firmware status — together with algorithms from any CycloneDX file the organisation imports. Devices and firmware sit in the same document as the cryptography, so exposure and the equipment it depends on are reviewed together. QDayRisk does not scan networks, hosts or code; it records what is declared or imported.
Standards mapping
Algorithms are classified by CycloneDX cryptographic primitive and annotated with their NIST status (FIPS 203/204/205) and CNSA 2.0 transition dates. Assessments also record safety criticality against IEC 61508, IEC 62443 and NIST SP 800-82, for organisations operating safety- or mission-critical systems.
Sector baselines
Open, sector-specific CycloneDX 1.7 community profiles for payments, critical infrastructure, PKI, AI systems and sovereign custody are published at cbomframework.com under CC BY 4.0. They describe what to record and prioritise for each sector, and are versioned in the open.
Current limitations
Entries are recorded at algorithm level, not per key, protocol configuration or code location. Certificates are not yet populated. Whether each algorithm was declared or imported is not yet recorded. CycloneDX 1.7 algorithm-family identifiers are not yet set, because padding and mode are not captured for declared algorithms and are not guessed.
- Output
- CycloneDX JSON 1.7: cryptographic assets, plus hardware and firmware components, with a serial number and dependency graph
- Validation
- Official CycloneDX 1.7 JSON schema; documents that fail are not issued
- Input formats
- CycloneDX JSON 1.5, 1.6 and 1.7 (SBOM or CBOM)
- Data sources
- Assessment answers; imported CycloneDX files
- Discovery scanning
- Not performed
- Cryptographic standards
- NIST FIPS 203/204/205
- Migration timelines
- NSA CNSA 2.0 (US national security systems); Canadian Centre for Cyber Security ITSM.40.001 (Government of Canada); EU NIS Cooperation Group roadmap (Member States); NCSC (UK)
- Sector baselines
- Open CycloneDX 1.7 community profiles at cbomframework.com (CC BY 4.0)
- Safety criticality
- IEC 61508, IEC 62443, NIST SP 800-82
- Maintainer
- NetraScale Ltd.