Critical Infrastructure CBOM Profile, v0.1 draft
Post-quantum cryptographic inventory for critical national infrastructure and OT
A free, open CycloneDX 1.7 community profile for energy, water, transport and telecoms operators, where devices live for 15 to 30 years.
For: OT security leads, plant and grid engineers, CISOs of critical infrastructure operators
v0.1 draft, updated 7 Oct 2026. Validated against the CycloneDX 1.7 schema. A starting point, not a compliance determination.
Why now
- US Executive Order 14412 (22 Jun 2026). CBOM minimum elements from CISA and NIST due within 270 days; contractor PQC compliance by end-2030 via a FAR rule.
- UK NCSC migration timeline. Discovery by 2028, high-priority migration by 2031, completion by 2035.
- EU NIS2 and Cyber Resilience Act. Risk management for essential entities; CRA vulnerability reporting from 11 Sep 2026, full obligations from 11 Dec 2027.
- Canada (CCCS) roadmap. Federal systems: high-priority migration by 2031, completion by 2035.
A practical migration path
- Inventory controllers, gateways, remote access and firmware signing
- Identify devices that cannot be updated in place
- Prioritise firmware-signing keys (the hardest to change)
- Agree PQC requirements with OT suppliers
- Schedule migration in maintenance windows
From profile to evidence
Learn the risk in OpenRiskLab, build and keep your own CBOM in QDayRisk, and certify readiness in the public PQReady registry.
Contribute or stay informed
This profile will be updated to the CISA and NIST CBOM minimum elements when they are published. Practitioners, vendors and standards bodies are invited to co-author it under an open licence, with credit. How contributions work.