Method
CycloneDX CBOM Import/Export and Validator
Is a cryptographic BOM complete enough for migration tracking?
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| Component | text | context | context | no |
| Algorithm | text | context | context | no |
| Key/certificate asset | text | context | context | no |
| Protocol | text | context | context | no |
| Relationships captured | select | evidence_signal | higher_is_better | yes |
| Owner evidence | select | evidence_signal | higher_is_better | yes |
| Machine-readable export evidence | select | evidence_signal | higher_is_better | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.