Resource centre
BOM, cryptography and regulation guides.
92 source-cited guides in six topic clusters. Each cluster starts with a pillar guide and branches into tools, operations, comparisons, compliance and sector-specific advice.
BLOG
From the blog
Engineering notes, compliance patterns and platform updates, SBOM through HBOM.
CERT-In's QBOM Is a Hardware Checklist, Not a Quantum Readiness Strategy
CERT-In's July 2025 guidelines introduced QBOM alongside SBOM, CBOM, AIBOM and HBOM. It is a useful inventory template for quantum hardware, but it is not a PQC migration plan.
Read the post →Post-Quantum Cryptography Is Coming. Is Your Crypto Inventory Ready?
NIST has finalized its post-quantum cryptography standards and CERT-In has already expanded its BOM guidelines to cover it.
Read the post →Vulnerability Prioritization, Explained: What CISA's BOD 26-04 Means
A beginner's guide to CVSS, CISA's BOD 26-04, and why the way organizations decide what to fix first just changed. Explained simply, from scratch.
Read the post →SBOM
Software Bill of Materials
Everything a security, engineering or compliance team needs to run SBOMs as a governed inventory rather than a one-time export, from fundamentals and tooling to CERT-In requirements and procurement.
Tools & platformsSBOM platforms: what an enterprise SBOM management platform should doTools & platformsSBOM tools: open-source generators, analysers and how to chooseOperationsSBOM generation: build-time, source, container and runtime approachesOperationsSBOM management: storage, versioning, sharing and lifecycleOperationsSBOM validation: completeness, format conformance and quality scoringComparisonsCycloneDX vs SPDX: comparing the two SBOM standardsComparisonsSBOM vs CBOM: software components versus cryptographic assetsComparisonsSBOM vs SCA: inventory versus analysisComparisonsSBOM vs VEX: what each tells you and how they work togetherComplianceCERT-In SBOM 21 minimum fields explainedComplianceCERT-In SBOM requirements: what the Version 2.0 guidelines ask forComplianceSBOM compliance: the regulations and frameworks that require SBOMsComplianceSBOM procurement requirements: contract clauses and a supplier checklistIndustriesSBOM for Indian enterprises: what to do and in what orderIndustriesSBOM for banks and financial services: SEBI CSCRF, RBI and CERT-InIndustriesSBOM for government and the public sectorHow-toHow to validate an SBOM: a step-by-step guide
CBOM
Cryptographic Bill of Materials
How to find, record and govern the algorithms, keys, protocols and certificates your systems depend on, and use that inventory for policy, audit and post-quantum planning.
FundamentalsCrypto-agility: what it is and how a CBOM enables itFundamentalsCycloneDX CBOM format explained: cryptoProperties and asset typesTools & platformsCBOM platforms: evaluation criteria for enterprise cryptographic inventoryTools & platformsCBOM tools: open-source cryptographic discovery and scanning toolsOperationsCBOM management: ownership, policy, certificate lifecycle and driftOperationsCBOM validation: completeness and accuracy checksComparisonsCBOM vs QBOM: cryptographic and quantum bills of materials comparedComparisonsCBOM vs SBOM: how a cryptographic inventory extends the software bill of materialsComparisonsCBOM vs certificate lifecycle management and PKI inventoryComplianceCBOM compliance: which frameworks expect a cryptographic inventoryComplianceCBOM procurement requirements for suppliersComplianceCERT-In CBOM requirements: the four asset types and their fieldsIndustriesCBOM for Indian enterprises: CERT-In, SEBI, RBI and the national quantum-safe roadmapIndustriesCBOM for banks and financial servicesIndustriesCBOM for government and the public sectorHow-toCBOM generation: discovering algorithms, keys, protocols and certificatesHow-toHow to find weak cryptography with a CBOM
QBOM
Quantum Bill of Materials
Standards, timelines and practical steps for quantum readiness: how to inventory quantum-vulnerable cryptography, assess exposure and plan a migration you can evidence.
FundamentalsHarvest now, decrypt later explainedTools & platformsQBOM and PQC-readiness tools: open-source optionsTools & platformsQBOM platforms: evaluation criteria for quantum-readiness inventoryOperationsQBOM management and post-quantum migration trackingOperationsQuantum risk assessment: scoring exposure and data longevityComparisonsQBOM vs CBOM: how the quantum and cryptographic BOMs differComplianceCERT-In QBOM requirements: Table 8 elements and recommendationsComplianceCNSA 2.0 algorithms and timelineComplianceNIST IR 8547 transition timeline: 2030 and 2035 explainedComplianceNIST PQC standards: FIPS 203, 204, 205 and HQCCompliancePost-quantum procurement requirements for vendorsComplianceQBOM and post-quantum compliance: frameworks and timelinesIndustriesQuantum readiness for Indian enterprisesIndustriesQuantum readiness for banks and financial servicesIndustriesQuantum readiness for government and defenceHow-toHow to build a QBOM: a step-by-step guideHow-toPreparing for post-quantum cryptography: a migration plan
AIBOM
AI Bill of Materials
How to document the models, datasets, frameworks and third-party AI services in your environment, and connect that record to regulation, procurement and risk.
FundamentalsAI supply-chain risks: models, data, software and servicesTools & platformsAIBOM platforms: evaluation criteria for enterprise buyersTools & platformsAIBOM tools: open-source options for generating, validating and securing AI BOMsOperationsAIBOM generation: discovering models, datasets and AI servicesOperationsAIBOM management: model registry, versions and approvalsOperationsAIBOM validation: schema, policy and provenance checksComparisonsAIBOM vs SBOM: what changes when the component is a modelComparisonsAIBOM vs model cards and datasheets for datasetsComparisonsSPDX 3.0 AI profile vs CycloneDX ML-BOMComplianceAI procurement requirements for vendors and model providersComplianceAIBOM compliance: EU AI Act, CERT-In, NIST AI RMF, ISO/IEC 42001 and Indian guidanceComplianceCERT-In AIBOM requirements: Table 10 minimum elements explainedComplianceEU AI Act documentation duties and how an AIBOM supports themIndustriesAIBOM for Indian enterprises: CERT-In, MeitY, RBI and DPDPIndustriesAIBOM for banks and financial servicesIndustriesAIBOM for government and the public sectorHow-toHow to validate an AIBOM: a step-by-step procedure
HBOM
Hardware Bill of Materials
Visibility below the operating system: processors, firmware, embedded modules and their lifecycle, how to inventory them, validate supplier HBOMs and act on advisories.
FundamentalsCycloneDX for hardware BOMs: device and firmware componentsFundamentalsFirmware BOMs: bridging hardware and softwareFundamentalsHardware supply-chain risks: counterfeits, tampering and firmware vulnerabilitiesTools & platformsHBOM platforms: evaluation criteria for hardware BOM managementTools & platformsHBOM tools: open-source building blocks for hardware and firmware inventoryOperationsHBOM generation: collecting hardware and firmware inventoryOperationsHBOM management: lifecycle, end-of-life and advisoriesOperationsHBOM validation: levels of assurance for hardware BOMsComparisonsHBOM vs SBOM: how hardware and software bills of materials differComplianceCERT-In HBOM requirements: the Table 11 minimum elementsComplianceHBOM compliance: the frameworks that call for hardware and firmware inventoryComplianceHBOM procurement requirements for hardware suppliersComplianceThe CISA HBOM Framework explainedIndustriesHBOM for Indian enterprisesIndustriesHBOM for banks and financial services: HSMs, ATMs and network infrastructureIndustriesHBOM for government and defenceHow-toHow to validate an HBOM: a step-by-step procedure
PROGRAMME
Supply chain security & regulation
Cross-cutting guidance that spans every bill of materials: operating models, metrics and regulatory reporting.
Turn guidance into evidence.IntelliXBOM maps every BOM to the controls these guides describe.
Request a Demo