The register, exportable
The Cryptographic Bill of Materials
Every engagement that reads your estate produces a register, and the register exports as a CBOM: the cryptography you actually run, in the bill-of-materials formats your tooling and your auditors already read. This page shows what the export contains, what it is stamped with, and the one thing it will never be — anonymous.
The formats
Two shapes, one register
CycloneDX 1.6
The bill-of-materials format with a first-class cryptographic asset model. The register's algorithms, keys, certificates and protocols land as crypto assets your SBOM tooling can already ingest — the CBOM extends the SBOM you have rather than starting a rival one.
SPDX 3.0.1
The same register, in the SPDX shape procurement and legal teams ask for by name. Both exports come from one scan pass over one register, so they cannot disagree with each other.
The scorecard
What a scored register reads like
Six rows from the specimen estate — the same illustrative estate the rest of this site uses. The standards column is public fact; the states are the specimen's, and a real register carries yours.
ML-KEM-1024
FIPS 203 · key establishment
ML-DSA-65
FIPS 204 · signatures
SHA-256
FIPS 180-4 · digest
AES-256-GCM
FIPS 197 · symmetric
RSA-2048
SP 800-131A · deprecation pointed at 2030
ECDSA-P256
Recorded traffic needs no deadline
Specimen estate score · theos-method-v1.0
58 / 100 — Watch · illustrative
The extract
One asset, in the real schema
A single cryptographic asset from the specimen register, in CycloneDX 1.6's own crypto-asset shape — the field names are the schema's, the values are illustrative, and a real export carries the whole estate.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"metadata": {
"component": { "name": "[SPECIMEN — illustrative estate]" },
"properties": [
{ "name": "theos:method_version", "value": "theos-method-v1.0" },
{ "name": "theos:estate_score", "value": "58/100 · Watch (illustrative)" }
]
},
"components": [
{
"type": "cryptographic-asset",
"name": "RSA-2048",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"parameterSetIdentifier": "2048",
"primitive": "signature",
"nistQuantumSecurityLevel": 0
}
},
"evidence": { "occurrences": [{ "location": "ci/release-sign" }] }
}
]
}Export API: [PLACEHOLDER: availability]. Until then, exports are delivered with the engagement's artefacts.
The standing facts
Six things that are always true of it
One name on the report
The register carries our name and the method version that scored it — never rebadged, never anonymous. A signature you can verify has to say who signed.
Two shapes, one pass
CycloneDX 1.6 and SPDX 3.0.1 are emitted from the same scan of the same register. There is no second pipeline to drift.
Stamped and versioned
Every export names the method version it was scored under, so this year's CBOM and last year's can be compared as deltas rather than re-argued from scratch.
The method is maintained in public
Standards move and the method moves with them — and every change is a dated entry in the Signal Log, not a silent re-score.
What we hold
The register is built from metadata: algorithm, size, location, state. Key material and source code are not what a bill of materials is made of, and we decline both.
Procurement-ready
The Assurance Center states our controls, the attestation is publicly checkable, and the paperwork a vendor review asks for is [PLACEHOLDER: DPA and questionnaire pack].
The first fact is a position, not a feature gap. Elsewhere this capability is sold white-label, one firm's work wearing another firm's name. Our Position explains why we will not do that: a register is a claim, and a claim needs a claimant.
Where it comes from
The register behind the export
A CBOM is only as good as the register it exports. The Estate Inventory builds that register; the free Readiness Check is the no-account way to see how the scoring thinks before anyone reads your estate.