Licensing the Applied Quantum CBOM Profile
The Applied Quantum CBOM Profile, meaning the specification document with its field definitions, tier structure, evidence tiers, and worked fragment, is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Its machine-readable companions, the JSON Schema, the validator, the schema generator, the test fixtures, and the controlled vocabularies in the taxonomy repository, are licensed under the Apache License 2.0. The split matches CycloneDX’s own practice, where the standard’s text and its schemas are licensed differently so that tooling can embed the schemas without legal review.
Both licenses permit use, adaptation, and sharing, including for commercial purposes, with attribution. Applied Quantum provides post-quantum migration advisory services. This work is published openly under CC BY 4.0 and is computable without engaging Applied Quantum.
You are free to
- Share. Copy and redistribute the material in any medium or format, for any purpose, including commercial
- Adapt. Remix, transform, and build upon the material for any purpose, including commercial
Under the following terms
- Attribution. You must give appropriate credit to Steve Vaile and Marin Ivezic, Applied Quantum, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensors endorse you or your use.
- No additional restrictions. You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
- For the Apache-2.0 kit. Redistribution keeps the LICENSE and NOTICE files, and the NOTICE names the authors.
Suggested attribution
Provenance and publication history
The Applied Quantum CBOM Profile is the original work of Steve Vaile and Marin Ivezic, published by Applied Quantum. It grew out of the field set Applied Quantum has been recommending to financial-sector clients and out of the data requirements of its two consuming frameworks. The PQC Migration Framework, which builds its cryptographic inventory and CBOM on the Profile’s tiers, and the Cryptographic Concentration Framework, which computes from a conforming CBOM. Earlier internal drafts preceded v0.3, and the field set was adjudicated through four external review rounds before it reached release candidate.
| Version | Date | Scope |
|---|---|---|
| 0.3 | August 2026 | Internal draft for review. External schema review adjudicated and applied; the version the consuming frameworks first cited |
| 1.0-RC | August 2026 | First public release: 50 properties across eight subnamespaces, four tiers, evidence tiers E1–E5, the binding deprecation and migration policy, and the machine-readable companions. Open for comment through October 31, 2026 |
| 1.0-RC (corrected) | September 9, 2026 | Corrected edition: registry status restated, CycloneDX 1.7 version notes extended, encoding and carrier rules stated, deflected added to disclosureStatus, observationWindow format pinned, worked fragment rebuilt as three records. The deprecation and migration policy, the tier structure and every field name are unchanged |
A second release candidate adds canonical asset identity in Q4 2026, and v1.0 final follows the comment window. The Profile versions independently of both frameworks, and each cites it by minimum version.
The appliedquantum namespace registration is filed with the CycloneDX property-taxonomy registry as issue #189, August 14, 2026. The issue is open, and the registry table does not yet carry the namespace. Beyond collision protection, the filing is a public, dated record of this property set under Applied Quantum’s name, with its authorship stated.
What this Profile defines
Section 9 of the Profile maps every field to its nearest published analogue or marks it as a gap. The gaps are the record of what this document adds, and they have a dated public history in the taxonomy repository, in registry issue #189 filed August 14, 2026, and in this release candidate. Among what the Profile defines where CycloneDX deliberately defines nothing:
- Path records as first-class components. A path is recorded once, keyed by pathId, with negotiated outcome distinguished from supported cipher suites, counterparty identity and class, target state, and an observation window. CycloneDX has no native path or topology object.
- Chain-versus-merge pedigree semantics as a profile rule. Nesting expresses derivation chains, flat entries express merges, and pedigree records derivation only, never mere use. The rule makes an intended-but-dormant CycloneDX structure hold cryptographic implementation ancestry.
- A disclosure status that separates refusal, deflection and silence. declined records an explicit refusal, deflected a reply that does not answer the request, and pending becomes no-response at the stated deadline; the three mean different things for supplier governance.
- Entropy source and generation design fields. The native drbg value records that a deterministic generator exists and nothing about the noise source or generation design behind it. These fields record both, capture the ROCA failure class, and draw values from a controlled-vocabulary registry.
- Custody resolution through firmware family and manufacturing origin. A module sold under three names from one manufacturer is one dependency, and the cloud provider is recorded as a boundary, never as the manufacturer.
- A coverage figure that resists gaming. discoveryCoverage is defined against an independently enumerated estate, per service, so an institution that mapped its estate poorly cannot silently score better than one that mapped it well.
- Evidence tiers E1–E5 graded per claim family. Runtime-observed through inferred, with namespace-specific evidence properties and an asset-level default that never overrides them.
- A binding deprecation and migration policy. Where the CycloneDX core later absorbs a field: deprecation in the following release, a normative one-to-one mapping, a two-version validity window, dual-form tooling acceptance, and no removal without a major increment.
- Determination-carried marking. Governance judgments such as criticality live in the factual document, explicitly marked as determinations rather than discovered facts.
These definitions, their names, and their semantics are matters of public record with a dated history in the Profile’s changelog and the registry filing.
What attribution requires in practice
CC BY 4.0 is one of the most permissive open licenses in existence. It permits commercial use, derivative works, and redistribution without restriction. It imposes a single binding condition: attribution. That is not a courtesy or a suggestion. It is the legal requirement that makes the license valid.
Proper attribution means:
1. Credit Marin Ivezic and Steve Vaile, Applied Quantum as the original authors
2. Provide a link to cbomprofile.org or the license
3. Indicate what changes were made (if any)
4. Do not add restrictions that prevent others from using the original
A property taxonomy differs from prose methodology in one way that matters here. Its value is the shared names. A derivative that renames the appliedquantum properties strips the attribution and, worse, destroys the cross-institution comparability the taxonomy exists to create, because two institutions using different names for one field can’t group their dependencies. Reuse the names, credit the source, and extend under your own namespace, which is exactly what the Profile’s extensibility clause provides for.
An organization that adopts this Profile, credits it, and populates it from its own estate is doing exactly what the license intends. A tool vendor that embeds the Apache-2.0 schema and validator, keeps the NOTICE, and ships conformant output strengthens the whole measurement effort and is encouraged.
An organization that takes this field set, renames the namespace, adds its own branding, and presents it to clients as proprietary work has violated the license twice over: by removing the required attribution, and by applying restrictions that CC BY 4.0 explicitly prohibits. Adding a proprietary copyright notice to a derivative of CC BY 4.0 material does not convert it into proprietary intellectual property. The original license terms follow the work.
A note to organizations evaluating CBOM tooling and advisory
If a vendor or consulting firm has presented a cryptographic-inventory property set, a CBOM extension schema, or a concentration data model as part of an engagement, you may want to compare it against this publicly available Profile.
Indicators that a property set may be derived from this one:
- Field sets mirroring this Profile’s eight subnamespaces under different names, particularly migration-governance, path, lineage, entropy, and custody fields with matching semantics
- Paths or counterparties treated as first-class records that state a negotiated outcome distinct from supported cipher suites
- A supplier disclosure status that separates explicit refusal, deflection and silence, or a coverage figure defined against an independently enumerated denominator
- Evidence grading in five tiers from runtime-observed to inferred, applied per claim family with a non-overriding default
- A deprecation policy tracking the five clauses of this Profile’s Section 2, including the two-version validity window and dual-form tooling acceptance
If a firm has adopted this Profile and credited it properly, that reflects well on their judgment. Conformant tooling and advisory built on shared names is what makes cross-institution measurement possible, and it is exactly the use both licenses encourage.
If a firm is presenting this field set as proprietary work without attribution, you should know that the same taxonomy is available here at no cost, in its original and most current form, with a validator to check any BOM against it, maintained by the practitioners who defined it.
Ask your vendor which public taxonomies their property set builds on. You are better served by vendors who are transparent about their sources than by firms presenting repackaged open work as proprietary innovation.
Disclaimer
The Profile and its machine-readable companions are provided as-is, without warranty of any kind, express or implied. They do not constitute legal, regulatory, or professional advice. Organizations should seek qualified professional guidance for their specific circumstances.
The licensors do not waive any rights or authorize any use beyond what the licenses permit. For the full legal texts, see the CC BY 4.0 Legal Code and the Apache License 2.0.