CycloneDX (since version 1.6, 2024) models cryptographic assets as components of type cryptographic-asset with properties such as algorithmProperties (primitive, parameter set, mode, NIST quantum security level), certificate properties and protocol properties (TLS versions, cipher suites), and links them to the code and services that use them. Scanners build CBOMs from source code, binaries, network traffic and certificate stores.
A CBOM answers questions a migration needs: where RSA-2048 is used, which services still negotiate TLS 1.2 without hybrid key exchange, which certificates expire after 2030, and which libraries need upgrading. It is only useful if kept current, which means generating it in CI rather than once.