Payments CBOM Profile, v0.1 draft
Post-quantum cryptographic inventory for payments and financial market infrastructure
A free, open CycloneDX 1.7 community profile for banks, payment firms and FMIs: what to record, what to prioritise, and how to evidence it.
For: CISOs, heads of payments, cryptography and HSM teams, compliance
v0.1 draft, updated 7 Oct 2026. Validated against the CycloneDX 1.7 schema. A starting point, not a compliance determination.
Why now
- US Executive Order 14412 (22 Jun 2026). Federal PQC deadlines of end-2030 (encryption) and end-2031 (signatures); CISA and NIST to publish CBOM minimum elements within 270 days.
- PCI DSS v4.0, requirement 12.3.3. Cryptographic cipher suites and protocols in use are documented and reviewed at least every 12 months.
- DORA (EU) and OSFI B-13 (Canada). ICT and technology-risk frameworks that expect a current inventory of information assets, including cryptography.
- G7 Cyber Expert Group (2026). Roadmap encouraging the financial sector to plan its transition to post-quantum cryptography.
A practical migration path
- Inventory TLS, HSM and messaging-interface cryptography
- Flag long-lived confidential data (harvest-now, decrypt-later exposure)
- Prioritise payment and settlement links
- Plan hybrid ML-KEM key exchange and ML-DSA signatures
- Evidence progress for supervisors and auditors
From profile to evidence
Learn the risk in OpenRiskLab, build and keep your own CBOM in QDayRisk, and certify readiness in the public PQReady registry.
Contribute or stay informed
This profile will be updated to the CISA and NIST CBOM minimum elements when they are published. Practitioners, vendors and standards bodies are invited to co-author it under an open licence, with credit. How contributions work.