Sovereign Custody CBOM Profile, v0.1 draft

Where your cryptographic inventory lives: residency, custody and key control

A cryptographic inventory is a map of your weaknesses. This profile records where it is held, by whom, and who controls the keys.

For: Data protection officers, regulated firms with residency requirements, public-sector buyers

Download the profile (CycloneDX 1.7)Measure your own exposure (free)

v0.1 draft, updated 7 Oct 2026. Validated against the CycloneDX 1.7 schema. A starting point, not a compliance determination.

Why now

  • GDPR and UK GDPR. Security of processing and storage limitation apply to any personal data in inventories and logs.
  • PIPEDA and Quebec Law 25. Canadian privacy obligations, including assessments for transfers outside Quebec.
  • DORA third-party risk (EU). Financial entities must manage ICT third-party and concentration risk, including where data is held.

A practical migration path

  1. Classify the inventory as sensitive security information
  2. Choose the hosting region (Canada, UK or EU)
  3. Decide who holds encryption keys
  4. Set retention and deletion rules
  5. Record custody in your data processing agreements

From profile to evidence

Learn the risk in OpenRiskLab, build and keep your own CBOM in QDayRisk, and certify readiness in the public PQReady registry.

Contribute or stay informed

This profile will be updated to the CISA and NIST CBOM minimum elements when they are published. Practitioners, vendors and standards bodies are invited to co-author it under an open licence, with credit. How contributions work.

Notify me of updatesContribute