CBOM Community Profiles
Open, sector-specific baselines for a cryptographic bill of materials, in the spirit of NIST CSF 2.0 Community Profiles: what to record, what to prioritise and how to evidence it, co-developed with practitioners and versioned in the open.
PayCBOM
Payments CBOM Profile
A free, open CycloneDX 1.7 community profile for banks, payment firms and FMIs: what to record, what to prioritise, and how to evidence it.
v0.1 draft, updated 7 Oct 2026
CNICBOM
Critical Infrastructure CBOM Profile
A free, open CycloneDX 1.7 community profile for energy, water, transport and telecoms operators, where devices live for 15 to 30 years.
v0.1 draft, updated 7 Oct 2026
PKICBOM
PKI CBOM Profile
A free, open CycloneDX 1.7 community profile for certificate authorities, enterprise PKI and signing infrastructure.
v0.1 draft, updated 7 Oct 2026
AICBOM
AI Systems CBOM Profile
A free, open CycloneDX 1.7 community profile covering the cryptography that protects AI pipelines, from model signing to inference APIs.
v0.1 draft, updated 7 Oct 2026
SovereignCBOM
Sovereign Custody CBOM Profile
A cryptographic inventory is a map of your weaknesses. This profile records where it is held, by whom, and who controls the keys.
v0.1 draft, updated 7 Oct 2026
How the profiles are built
- CycloneDX 1.7 format, validated against the official schema.
- Only published instruments are cited, with dates as published.
- Versioned: v0.1 draft today; v1.0 aligned to the CISA and NIST CBOM minimum elements once published.
- Vendor-neutral: NetraScale sells no cryptographic hardware or certificates.
How contributions work
- Proposals need sources for any regulatory claim.
- Contributors disclose any vendor affiliation.
- Accepted changes are credited (named, organisation or anonymous) and licensed CC BY 4.0.
- A structured contribution form is coming; until then, write to us.