Cryptography Bill of Materials (CBOM): Finding Every Algorithm You Depend On

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

Inventory as the prerequisite for any cryptographic migration: what a Cryptography Bill of Materials (CBOM) records, grounded in the emerging CycloneDX cryptographic asset shape, and how to discover algorithm usage across source code, dependencies, containers, certificates, protocols and hardware. You will link every cryptographic use to the data it protects and how long that data must stay secret, score and prioritise replacement work, and keep the inventory current as your estate changes, building directly on the Academy's Software Bill of Materials (SBOM) courses.

What you'll learn

Why a Cryptography Bill of Materials

From Software Bill of Materials to Cryptography Bill of Materials
What a Cryptography Bill of Materials Records
The CycloneDX Cryptographic Asset: An Emerging Standard Shape

Discovering Algorithms Across the Estate

Discovery in Source Code and Dependencies
Discovery in Containers and Base Images
Discovery in Certificates, Protocols and Network Configuration
Discovery in Hardware and Firmware: What Software Cannot See

Linking Use to Risk

Linking Each Cryptographic Use to the Data It Protects
Data Lifetime and Prioritisation
Scoring and Prioritising Replacement

01Why a Cryptography Bill of Materials3 lessons

From Software Bill of Materials to Cryptography Bill of Materials
What a Cryptography Bill of Materials Records
The CycloneDX Cryptographic Asset: An Emerging Standard Shape

02Discovering Algorithms Across the Estate4 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Operationalising the Inventory

Keeping the Inventory Current: Triggers and Drift Detection
Where Safeguard Fits: Building Blocks for a Cryptography Bill of Materials
Reporting CBOM Findings to Stakeholders and Auditors

Putting It Together

A Worked Example: Building a CBOM Entry End to End
Where This Fits in the Rest of the Academy

Discovery in Source Code and Dependencies

Discovery in Containers and Base Images

Discovery in Certificates, Protocols and Network Configuration

Discovery in Hardware and Firmware: What Software Cannot See

03Linking Use to Risk3 lessons

Linking Each Cryptographic Use to the Data It Protects
Data Lifetime and Prioritisation
Scoring and Prioritising Replacement

04Operationalising the Inventory3 lessons

Keeping the Inventory Current: Triggers and Drift Detection
Where Safeguard Fits: Building Blocks for a Cryptography Bill of Materials
Reporting CBOM Findings to Stakeholders and Auditors

05Putting It Together2 lessons

A Worked Example: Building a CBOM Entry End to End
Where This Fits in the Rest of the Academy2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.