Published for review and comment. Comments are open through October 31, 2026: file them as issues on the taxonomy repository. A second release candidate adding canonical asset identity is planned for Q4 2026.
The Applied Quantum CBOM Profile is a property taxonomy layered on CycloneDX (ECMA-424) for cryptographic bills of materials. It defines the registered appliedquantum namespace: 50 properties across eight subnamespaces, covering post-quantum migration governance, financial-sector and custody context, and the inputs a cryptographic concentration computation needs. It serves the PQC Migration Framework and the Cryptographic Concentration Framework, and it’s owned by neither.
Licensed under CC BY 4.0. Free to use, adapt, and share, including for commercial purposes, with attribution to Steve Vaile and Marin Ivezic, Applied Quantum. The schema, validator and vocabularies are Apache-2.0 on GitHub.
The Applied Quantum
CBOM Profile
Version 1.0-RC specifies all 50 properties with closed enumerations and value formats, the four-tier structure, and evidence tiers E1–E5. It adds a binding deprecation and migration policy for any field the CycloneDX core later absorbs, and a worked ML-KEM fragment that validates against the CycloneDX 1.7 schema.
The appliedquantum namespace registration is filed with the CycloneDX property-taxonomy registry as issue #189, August 14, 2026. This release candidate is open for comment through October 31, 2026, and a second candidate adds canonical asset identity in Q4 2026.
Machine-Readable Companions
JSON Schema & Validator
A schema for every property, with a closed name set, closed enumerations and value formats, plus a validator that walks a whole BOM and fixtures that pass and fail on purpose. The canonical schema identifier lives at cbomprofile.org/schema/.
Controlled Vocabularies
Shared labels for entropy source designs, entropy generation designs and HSM firmware families, so identical designs group as one dependency across institutions. Seeded with the ring-oscillator family, the SP 800-90A DRBG designs and the ROCA-class prime generation entry.
Namespace Registration
The top-level namespace appliedquantum is filed with the CycloneDX property-taxonomy registry as issue #189, August 14, 2026. The issue is open. We’ll update this page when it gets resolved.
Four Tiers, Independently Adoptable
Tiers are additive. An institution running a PQC migration adopts Tiers 1 to 3. One computing concentration adds Tier 4. Neither requires the other, and the Profile references native CycloneDX cryptoProperties rather than restating them.
Deprecation & migration policy
Closed enumerations
Multi-valued carriage rules
Controlled vocabularies
Adopt the Profile in Three Moves
You don’t need the whole Profile to start. Tiers are additive, so adopt the ones your program needs and add the rest when the questions arrive.
Frameworks & Related Projects
The Profile is one of three openly published Applied Quantum properties. Both frameworks cite it by minimum version, and neither owns it.
The eight-phase migration methodology at v2.1, with six sector extensions. Phase 2 of its lifecycle builds the cryptographic inventory and CBOM this Profile structures.
Cryptographic Concentration Framework
Measures cryptographic concentration beneath the vendor layer. It consumes a CBOM conforming to this Profile, v1.0-RC or later, and its CBOM Conformance Statement states which fields each CCF level requires. CCF v1.0-RC was published August 16, 2026.
appliedquantum Property Taxonomy
The taxonomy on GitHub, with the JSON Schema, validator, fixtures and controlled vocabularies. Namespace registration filed as CycloneDX issue #189.
Research-driven professional services firm focused entirely on quantum technologies, from quantum computing and systems integration to strategy, sovereignty advisory, and quantum-safe security across all sectors.
Applied Quantum’s security-focused practice. Hands-on services including PQC readiness assessments, cryptographic inventory and CBOM, crypto-agility consulting, hybrid implementation, quantum risk assessment, and regulatory advisory.
Marin’s personal blog on quantum security with over 1 million monthly readers. In-depth practitioner analysis covering PQC migration, cryptographic inventory, CBOM, hybrid deployment, vendor governance, and sector deep dives.