{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:3f1c2a9e-7d4b-4e8a-9b52-0c6d8e1f2a30",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-13T00:00:00Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "PlayCISO CBOM Generator",
          "externalReferences": [
            {
              "type": "website",
              "url": "https://playciso.com/tools/cbom-generator"
            }
          ]
        }
      ]
    },
    "supplier": {
      "name": "Example Freight Co. (fictional)"
    },
    "component": {
      "type": "application",
      "name": "Example Freight Customer Portal (fictional)",
      "version": "4.2.0",
      "bom-ref": "system"
    }
  },
  "components": [
    {
      "type": "application",
      "name": "customer-portal-web",
      "version": "4.2.0",
      "description": "Public web app for shipment tracking and invoices.",
      "bom-ref": "component/customer-portal-web"
    },
    {
      "type": "data",
      "name": "orders-store",
      "version": "2026.10",
      "description": "Order, customer and invoice records, kept for 10 years.",
      "bom-ref": "component/orders-store"
    },
    {
      "type": "application",
      "name": "release-signing-pipeline",
      "version": "1.8.3",
      "description": "Signs desktop and agent releases with a key held in an HSM.",
      "bom-ref": "component/release-signing-pipeline"
    },
    {
      "type": "cryptographic-asset",
      "name": "TLS 1.3",
      "bom-ref": "crypto/protocol/tls-1.3",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384",
              "tlsGroups": [
                "x25519"
              ]
            }
          ],
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/x25519"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/aes-256-gcm"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/sha-384"
            },
            {
              "type": "certificate",
              "ref": "crypto/certificate/portal.example.com-tls-certificate"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "TLS 1.2",
      "bom-ref": "crypto/protocol/tls-1.2",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.2",
          "cipherSuites": [
            {
              "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
              "tlsGroups": [
                "secp256r1"
              ]
            }
          ],
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/ecdh-p-256"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/rsa-2048"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/aes-256-gcm"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/sha-384"
            },
            {
              "type": "certificate",
              "ref": "crypto/certificate/portal.example.com-tls-certificate"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "TLS 1.3 (hybrid PQ pilot)",
      "bom-ref": "crypto/protocol/tls-1.3-hybrid-pq-pilot",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384",
              "tlsGroups": [
                "X25519MLKEM768",
                "x25519"
              ]
            }
          ],
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/x25519mlkem768"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/aes-256-gcm"
            },
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/sha-384"
            },
            {
              "type": "certificate",
              "ref": "crypto/certificate/portal.example.com-tls-certificate"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "portal.example.com TLS certificate",
      "bom-ref": "crypto/certificate/portal.example.com-tls-certificate",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "serialNumber": "4f2a9c1e7b3d5a60",
          "subjectName": "CN=portal.example.com",
          "issuerName": "CN=Example Issuing CA 1, O=Example Freight Co. (fictional)",
          "notValidBefore": "2026-03-01T00:00:00Z",
          "notValidAfter": "2027-03-31T00:00:00Z",
          "certificateFormat": "X.509",
          "certificateFileExtension": "crt",
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/rsa-2048"
            },
            {
              "type": "publicKey",
              "ref": "crypto/related-crypto-material/portal.example.com-rsa-2048-public-key"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "Release code signing certificate",
      "bom-ref": "crypto/certificate/release-code-signing-certificate",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "serialNumber": "19be04d27a6c8f31",
          "subjectName": "CN=Example Freight Co. Code Signing (fictional)",
          "issuerName": "CN=Example Code Signing CA, O=Example Freight Co. (fictional)",
          "notValidBefore": "2025-06-01T00:00:00Z",
          "notValidAfter": "2031-06-01T00:00:00Z",
          "certificateFormat": "X.509",
          "certificateFileExtension": "cer",
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/ecdsa-p-256"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "RSA-2048",
      "bom-ref": "crypto/algorithm/rsa-2048",
      "cryptoProperties": {
        "assetType": "algorithm",
        "oid": "1.2.840.113549.1.1.1",
        "algorithmProperties": {
          "primitive": "signature",
          "algorithmFamily": "RSASSA-PKCS1",
          "parameterSetIdentifier": "2048",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "padding": "pkcs1v15",
          "cryptoFunctions": [
            "sign",
            "verify"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "portal.example.com RSA-2048 public key",
      "bom-ref": "crypto/related-crypto-material/portal.example.com-rsa-2048-public-key",
      "cryptoProperties": {
        "assetType": "related-crypto-material",
        "relatedCryptoMaterialProperties": {
          "type": "public-key",
          "state": "active",
          "size": 2048,
          "format": "PEM",
          "creationDate": "2026-02-20T00:00:00Z",
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/rsa-2048"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "ECDSA P-256",
      "bom-ref": "crypto/algorithm/ecdsa-p-256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "algorithmFamily": "ECDSA",
          "ellipticCurve": "secg/secp256r1",
          "executionEnvironment": "hardware",
          "implementationPlatform": "other",
          "certificationLevel": [
            "fips140-3-l3"
          ],
          "cryptoFunctions": [
            "keygen",
            "sign",
            "verify"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "ECDH P-256",
      "bom-ref": "crypto/algorithm/ecdh-p-256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "algorithmFamily": "ECDH",
          "ellipticCurve": "secg/secp256r1",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "keygen",
            "keyderive"
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "X25519",
      "bom-ref": "crypto/algorithm/x25519",
      "cryptoProperties": {
        "assetType": "algorithm",
        "oid": "1.3.101.110",
        "algorithmProperties": {
          "primitive": "key-agree",
          "algorithmFamily": "ECDH",
          "ellipticCurve": "other/Curve25519",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "keygen",
            "keyderive"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "ML-KEM-768",
      "bom-ref": "crypto/algorithm/ml-kem-768",
      "cryptoProperties": {
        "assetType": "algorithm",
        "oid": "2.16.840.1.101.3.4.4.2",
        "algorithmProperties": {
          "primitive": "kem",
          "algorithmFamily": "ML-KEM",
          "parameterSetIdentifier": "768",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "keygen",
            "encapsulate",
            "decapsulate"
          ],
          "classicalSecurityLevel": 192,
          "nistQuantumSecurityLevel": 3
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "X25519MLKEM768",
      "bom-ref": "crypto/algorithm/x25519mlkem768",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "combiner",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "keygen",
            "encapsulate",
            "decapsulate"
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "AES-256-GCM",
      "bom-ref": "crypto/algorithm/aes-256-gcm",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "algorithmFamily": "AES",
          "parameterSetIdentifier": "256",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "mode": "gcm",
          "cryptoFunctions": [
            "keygen",
            "encrypt",
            "decrypt"
          ],
          "classicalSecurityLevel": 256,
          "nistQuantumSecurityLevel": 5
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "orders-store data encryption key",
      "bom-ref": "crypto/related-crypto-material/orders-store-data-encryption-key",
      "cryptoProperties": {
        "assetType": "related-crypto-material",
        "relatedCryptoMaterialProperties": {
          "type": "secret-key",
          "state": "active",
          "size": 256,
          "creationDate": "2025-01-15T00:00:00Z",
          "expirationDate": "2027-01-15T00:00:00Z",
          "relatedCryptographicAssets": [
            {
              "type": "algorithm",
              "ref": "crypto/algorithm/aes-256-gcm"
            }
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "SHA-384",
      "bom-ref": "crypto/algorithm/sha-384",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "hash",
          "algorithmFamily": "SHA-2",
          "parameterSetIdentifier": "384",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "digest"
          ],
          "nistQuantumSecurityLevel": 4
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "name": "SHA-1",
      "bom-ref": "crypto/algorithm/sha-1",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "hash",
          "algorithmFamily": "SHA-1",
          "executionEnvironment": "software-plain-ram",
          "implementationPlatform": "x86_64",
          "cryptoFunctions": [
            "digest"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    }
  ],
  "services": [
    {
      "bom-ref": "service/partner-edi-bridge",
      "name": "partner-edi-bridge",
      "version": "2.1",
      "description": "Legacy integration with freight partners. Signs message digests with SHA-1."
    },
    {
      "bom-ref": "service/edge-pq-pilot",
      "name": "edge-pq-pilot",
      "version": "0.3",
      "description": "Pilot edge endpoint offering hybrid post-quantum key exchange in TLS 1.3."
    }
  ],
  "dependencies": [
    {
      "ref": "system",
      "dependsOn": [
        "component/customer-portal-web",
        "component/orders-store",
        "component/release-signing-pipeline",
        "service/partner-edi-bridge",
        "service/edge-pq-pilot"
      ]
    },
    {
      "ref": "component/customer-portal-web",
      "dependsOn": [
        "crypto/protocol/tls-1.3",
        "crypto/protocol/tls-1.2",
        "crypto/certificate/portal.example.com-tls-certificate",
        "crypto/algorithm/rsa-2048",
        "crypto/related-crypto-material/portal.example.com-rsa-2048-public-key",
        "crypto/algorithm/ecdh-p-256",
        "crypto/algorithm/x25519",
        "crypto/algorithm/aes-256-gcm",
        "crypto/algorithm/sha-384"
      ]
    },
    {
      "ref": "component/orders-store",
      "dependsOn": [
        "crypto/algorithm/aes-256-gcm",
        "crypto/related-crypto-material/orders-store-data-encryption-key"
      ]
    },
    {
      "ref": "component/release-signing-pipeline",
      "dependsOn": [
        "crypto/certificate/release-code-signing-certificate",
        "crypto/algorithm/ecdsa-p-256"
      ]
    },
    {
      "ref": "service/partner-edi-bridge",
      "dependsOn": [
        "crypto/protocol/tls-1.2",
        "crypto/algorithm/ecdh-p-256",
        "crypto/algorithm/sha-1"
      ]
    },
    {
      "ref": "service/edge-pq-pilot",
      "dependsOn": [
        "crypto/protocol/tls-1.3-hybrid-pq-pilot",
        "crypto/certificate/portal.example.com-tls-certificate",
        "crypto/algorithm/x25519",
        "crypto/algorithm/ml-kem-768",
        "crypto/algorithm/x25519mlkem768",
        "crypto/algorithm/aes-256-gcm",
        "crypto/algorithm/sha-384"
      ]
    },
    {
      "ref": "crypto/algorithm/x25519mlkem768",
      "dependsOn": [
        "crypto/algorithm/ml-kem-768",
        "crypto/algorithm/x25519"
      ]
    }
  ]
}