RBI has asked a new expert committee to evaluate the financial sector’s cryptographic inventory through a Cryptographic Bill of Materials (CBOM). The same committee will assess how prepared the industry is to adopt quantum-safe cryptography. Put simply, the regulator wants to know what cryptography banks run today and how quickly they could change it. What this means for CISOs and compliance heads? That’s what we will explore in this blog.
In addition, we explain how CERT-In, SEBI and the Department of Science and Technology (DST) also point in the same direction, what a usable CBOM should hold and how to start building one in 3 months’ time.
Why RBI’s Q-SAFE committee matters to banks
RBI announced the Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) committee on May 25, 2026. Its members come from IIT Madras, DST, SBI, NPCI, MeitY, DSCI and RBI. It will evaluate the sector’s cryptographic inventory through a CBOM, assess crypto agility and identify the systems most exposed to quantum threats. It must report within six months of its first meeting.
Why it matters before any direction is issued
Q-SAFE is an assessment body, not a rule-maker. Yet its work will shape what RBI asks for next. A bank that already holds a current cryptographic inventory can answer the committee’s questions with evidence. A bank without one will be estimating, and estimates are hard to defend before a board or a supervisor.
Four bodies, one artefact
The case for acting now rests on alignment. Four Indian bodies have each named cryptographic inventory as a foundation.
1. CERT-In sets the format
CERT-In’s technical guidelines Version 2.0, released Jul 9, 2025, extend beyond SBOM to CBOM, QBOM, AIBOM and HBOM. They define minimum CBOM elements covering algorithms, keys, protocols and certificates. The guidance is advisory, but it gives banks a ready field standard.
2. SEBI CSCRF sets the expectation
Banks with SEBI registrations follow the Cybersecurity and Cyber Resilience Framework (CSCRF) for those activities. SEBI’s CSCRF FAQs expect regulated entities to inventory cryptographic assets. They also expect post-quantum migration to be prioritised by risk.
3. DST sets the timeline
DST’s quantum-safe task force report came out in Feb 2026 and was finalised in May 2026. It sets phased migration timelines for critical sectors. It also recommends CBOM submissions from vendors from FY 2027-28.
4. RBI sets the scrutiny
Q-SAFE completes the picture. Format, expectation, timeline and supervisory interest now point at the same artefact.
Build once, evidence many
The practical lesson is simple. Do not build four separate compliance responses. Build one continuously maintained inventory that can produce evidence for each body.
What a bank-grade CBOM should contain
A useful CBOM records more than a list of certificates. At a minimum, it should capture:
- Algorithms, key lengths and modes in use, by application.
- Protocols such as TLS versions on internal and external services.
- Certificates, their owners and expiry dates.
- Keys and where they are stored, including HSM integrations.
- The software component or vendor product each asset sits inside.
Why the SBOM link matters
In a bank, much of the cryptography sits inside vendor binaries, payment switches and libraries pulled in by other libraries. Linking each cryptographic asset to its software component turns the CBOM into a map of who must fix what. Without that link, your crypto team will find problems it cannot assign.
Possible 3-month CBOM plan for BFSI security teams
You do not need the full estate inventoried to show progress but a defensible start. The plan below assumes a mid-size bank or NBFC.
Days 1 to 30: scope and govern
- Name an executive owner for cryptographic risk and brief the board risk committee.
- Pick 10 to 20 critical applications, starting with payments, core banking and customer channels.
- Agree a CBOM schema mapped to CERT-In’s minimum elements and SEBI’s expectations.
- Add a CBOM clause to new vendor contracts and renewals.
Days 31 to 60: discover and enrich
- Scan source code, binaries, containers and network traffic in scoped applications.
- Ask critical vendors for CBOMs or cryptographic disclosures in CycloneDX format.
- Flag weak cryptography such as SHA-1, RSA-1024, TLS 1.0 and hardcoded keys.
- Record unknowns openly rather than guessing.
Days 61 to 90: prioritise and report
- Run a PQC risk assessment that scores each asset by data sensitivity, data lifespan and “harvest now, decrypt later” exposure.
- Fix quick wins such as expiring certificates and legacy TLS.
- Draft a phased migration roadmap aligned to DST timelines.
- Produce a board-ready summary that doubles as evidence for Q-SAFE, SEBI or audit queries.
Conclusion
Q-SAFE has not told banks what to build. But CERT-In, SEBI and DST have already described it: a current, evidence-ready inventory of cryptography, linked to the software it lives in. Banks that start now will be able to answer the committee’s questions with strong data. They will also find weak cryptography before an attacker or an auditor does.
CyberNX’s SBOM and CBOM solutions, maps cryptographic assets to software components. It produces outputs aligned to CERT-In, SEBI CSCRF and RBI expectations. If you are planning your first CBOM pilot, our team can help you scope the first 90 days around your critical systems. Speak with us to see what your cryptographic inventory looks like today.
FAQs
Does RBI’s Q-SAFE committee make CBOM mandatory for banks?
Not yet. Q-SAFE is an expert committee that will assess the sector through a CBOM and recommend a roadmap. Any binding requirement would come later through RBI directions.
What is the difference between an SBOM and a CBOM?
An SBOM lists the software components inside an application. A CBOM lists the cryptographic assets, such as algorithms, keys, certificates and protocols. Together, they show what cryptography sits where and who owns it. Our CBOM vs SBOM guide explains the difference in more detail.
Can a CBOM be built manually?
For a handful of systems, yes. But cryptography changes with every release and certificate renewal, so a spreadsheet goes stale within weeks. Automated discovery keeps the inventory current enough to serve as evidence. Our guide to PQC risk assessment tools covers what to look for.
