Five categories of inventory now carry a government's signature. Software, cryptography, quantum, hardware, artificial intelligence. India's Computer Emergency Response Team, known as CERT-In, folded all five into a single framework on July 9, 2025 (CERT-In, 2025), and most enterprises reading this have not finished building the first one.

The acronyms sound interchangeable. Knowing where they diverge is the fastest way to tell whether your security team's roadmap is real or aspirational.

The List Grew From One to Five in a Year

CERT-In's first version, published in October 2024, covered only the Software Bill of Materials, or SBOM: a structured list of every library, module, and dependency that makes up an application. The idea came from manufacturing, where a bill of materials tracks every part in a physical product. Security engineers adapted it so a team could answer a basic question fast: does the vulnerable version of a library sit inside anything we run.

Version 2.0, released nine months later, added four more categories in one document (CERT-In, 2025). The guidelines remain voluntary in India, aimed first at public sector, government, and software export organizations. A five-category framework from a national cybersecurity authority still signals where regulation is headed, and regulatory signals tend to harden into requirements within a few years.

Cryptography Gets Two Separate Acronyms

A Cryptographic Bill of Materials, or CBOM, is an inventory of every algorithm, key length, certificate, and protocol running inside a system. IBM's research team built the concept as an extension of SBOM (IBM Research, 2024), and it has become the standard term security teams reach for when they start a post-quantum migration. A CBOM tells you that a particular service uses RSA-2048 for its TLS handshake. It does not tell you how worried to be.

That second question belongs to the Quantum Bill of Materials, or QBOM. A QBOM takes the same cryptographic inventory and scores it against quantum risk: which algorithms fall to Shor's algorithm, which weaken under Grover's algorithm, and how long the data behind each one needs to stay secret. CERT-In's guidelines treat QBOM and CBOM as a paired section (CERT-In, 2025), and that pairing is the right way to think about it. CBOM is the map. QBOM marks which roads wash out first.

Harvest-now-decrypt-later is the reason the distinction matters. An adversary intercepts encrypted traffic today and holds it, betting that a quantum computer capable of breaking it will exist before the data stops being sensitive. I wrote about Cisco Live's version of this problem in June, when the company's Quantum Ready Assessments feature launched to map exactly this kind of exposure. Only a QBOM tells a CIO which systems to fix first.

Hardware and AI Complete the Set

A Hardware Bill of Materials, or HBOM, inventories the physical layer: chips, firmware, embedded devices, and the sub-suppliers behind each one. It exists because a compromised component three tiers down a supply chain is invisible to a software-only inventory.

An AI Bill of Materials, or AIBOM, does the same work for models. It documents which model runs in production, what data trained it, and which third-party inference endpoints an application calls. The EU AI Act is the regulatory pressure most CIOs already track here, though its high-risk system deadlines were pushed to 2027 and 2028 by the Digital Omnibus law in July 2026, so the AIBOM conversation has more runway than the crypto one.

A QBOM is a CBOM with an expiration date attached to every entry.

The Crypto Deadline Is Already Mandatory in Washington

A June 2026 executive order gives U.S. federal agencies until the end of 2030 to migrate key establishment to post-quantum standards, and until the end of 2031 for digital signatures, as I covered in the Axonius federal ARR story out of Black Hat. Phase one of that mandate is inventory. An agency has to know where its cryptographic material lives before any migration plan makes sense. That is a CBOM, whether the memo uses the word or not.

The compliance path runs the same direction in the private sector. NIST has set 2030 as the point where RSA and elliptic-curve cryptography get deprecated, and 2035 as the point where they are disallowed outright. A CBOM built this year buys five years of sequencing room.

Waiting until 2034 to start removes that room entirely.

Unknowns and Uncertainties

No standards body has mandated one format across all five BOM types. CycloneDX has become the closest thing to a common standard for CBOM, and CERT-In's guidelines lean on it, but vendors still ship proprietary formats alongside it. Whether AIBOM converges on a similar shared schema, or fragments the way early SBOM tooling did, is still open.