Does this BOM account for what it read?

Drop in a CycloneDX BOM. The check reads the coverage statement the scanner carries and rules on it against the Coverage Attestation Profile, rule by rule. Nothing leaves this page.

CycloneDX JSON Choose a file

What this check reads

It reads the statement a scanner makes about its own run. A count carried by file extension is a remainder, and rule R1 refuses a remainder because no one can check which files it holds. Reading a tree to name every file needs the files, which stay on your machine: run cbom-check.mjs <bom.json> --tree <dir> beside the repository.

A BOM that states no coverage in a shape this check recognises is reported as exactly that. The recognised shapes are listed in the result.

Verify a result record

A result record carries the verdict, the counts, the digest of the input and the digest of the verifier. Drop one in and the page recomputes its digest.

Choose a record

The Certisyn estate

A coverage statement answers what a scan read. These answer the next question for the same reader: what the evidence shows, who sealed it, and whether it holds.

ReadPublished recordsSourced analyses of public commitments and incidents, each statement traced to its source. CheckKeysThe public Ed25519 keys and transparency log behind every Certisyn seal. Open to everyone, no account. VerifyRegistryResolve a Certisyn code to its verification record. ScanForensisForensics for documents, images, audio, video and archives. Findings fuse on authenticity, veracity, attribution and rights. Gated: request access. ScanBastionAgentless external security posture, converted to regulatory readiness. Request access from the Certisyn site. DetermineImprimaturSealed, replayable determinations with an independent timestamp, for regulated institutions. Gated: request access. ProveLumenSealed proofs of data-centre claims: grid response, energy and recovered-heat certificates, community commitments. Gated: request access. FileLitigationEvidence mapped to statutory elements and entailed into court-filable documents. Gated: request access. InvestigateAlliedA defence and intelligence verification workspace for UNCLASSIFIED and CUI material, with tearlines that release a redacted finding to a named audience for a set window. Gated: request access.

Request access

Forensis, Imprimatur, Lumen, Litigation and Allied open to customers by request. Choose the surface, add a line on what you need, and the page prepares the message for Certisyn customer contact in your own mail client. Nothing is sent from this page.

Surface Name Organisation Your email What you need it for

The standard behind it

The Coverage Attestation Profile, draft-hillier-coverage-attestation, defines rules R0 to R8: a scanner states what it read, what it did not, and why, and a verifier rules on the statement. A CBOM that carries the statement answers the first question a regulator asks of an inventory: what does it cover. The CBOM minimum elements guidance under EO 14412 is due 270 days after 22 June 2026, and PQC migration inventories start from the same question.