CBOM for government and the public sector

Governments are both large operators of cryptography and the authors of the rules that now require an inventory of it. This article covers what public bodies are asked to do and how to organise a public-sector CBOM effort.

The public-sector challenge

Government systems combine long-lived sensitive data, identity, tax, health, defence, land records, with estates that are old, federated across departments and largely built and run by suppliers. Cryptography sits in citizen portals, inter-departmental data exchanges, identity and signing infrastructure, and embedded in operational technology. Few departments can say today where RSA or elliptic-curve cryptography is used, which is the first question every post-quantum roadmap asks.

India

CERT-In Technical Guidelines v2.0

CERT-In's guidelines are addressed in part to government, public sector and essential services organisations. Recommendation 8.4.1.1 states that such organisations "shall require a comprehensive Bill of Materials (BOM), specifically a Cryptographic BOM (CBOM) for cryptographic assets and a Quantum BOM (QBOM) for quantum systems in all related procurements, developments, and integrations" ^[1]. Recommendation 8.5.4 goes further on post-quantum contracting, proposing tiered vendor PQC requirements: service providers to document all cryptographic implementations, provide quarterly migration progress reports with C-level attestation, accept penalty clauses, and demonstrate quantum-safe alternatives through proofs of concept before contract renewals ^[1].

DST Task Force report

The Department of Science and Technology's report on implementing a quantum-safe ecosystem (February 2026) recommends "common procurement requirements across all government RFPs" to ensure "crypto-agile and PQC-compliant assets, along with compulsory Bill of Materials". For critical information infrastructure it proposes foundations by 2027, high-priority migration by 2028 and full adoption by 2029 ^[2].

United States

The Quantum Computing Cybersecurity Preparedness Act requires each agency to maintain a current inventory of IT "vulnerable to decryption by quantum computers" ^[4]. OMB M-23-02 sets the mechanics: an inventory submitted to ONCD and CISA by 4 May 2023 and annually thereafter, covering high-impact systems, High Value Assets and other likely-vulnerable systems, with fields including system identifiers, the vulnerable cryptography in use, hosting environment and data lifecycle ^[3]. CISA's September 2024 strategy supports this with automated cryptography discovery and inventory tools, supplemented by manual collection ^[5]. For national security systems, NSA's CNSA 2.0 specifies quantum-resistant algorithms ^[6] with category-specific transition dates culminating in 2035 ^[7].

Europe and the UK

Organising a public-sector CBOM effort

1. Set scope by criticality. Start with systems that hold long-lived sensitive data or are designated critical. M-23-02's focus on high-impact systems and High Value Assets is a useful model ^[3].
2. Use a common template. Adopt CERT-In's four asset types and fields ^[1] and a standard format (CycloneDX) across departments so inventories can be aggregated.
3. Write CBOM clauses into procurement. Require supplier CBOMs at delivery and on each major release, and PQC roadmaps for critical products. See CBOM procurement requirements.
4. Combine discovery methods. Network scans, code analysis for in-house systems, key store exports and supplier CBOMs; see CBOM generation.
5. Protect the inventory. A consolidated government CBOM is sensitive. CERT-In recommends encryption, access control and integrity mechanisms for CBOM data (8.4.1.12) ^[1]; self-hosted or air-gapped storage may be appropriate.
6. Report on a cycle. Review at least quarterly as CERT-In recommends ^[1], and keep history to show migration progress.

How IntelliXBOM helps

IntelliXBOM ingests supplier and internally generated CBOMs, validates them against required-field policies such as CERT-In's minimum elements, and keeps version history across reporting cycles. It maps the inventory to framework controls with timestamped evidence and can be deployed on-premise or fully air-gapped for sensitive environments.