Deliverables
The board pack, the CBOM and the chain verification — what you hand over and how each one is defended.
Purpose
Three artefacts leave the engagement: a board pack, a cryptographic bill of materials, and a chain-verification result. Each is generated from the tenant's own rows, and each says on its face where its numbers came from.
Steps
1. Board pack. Board › Reports leads with Post-Quantum Trust Board Pack, offering Export board pack and View board pack (the Board Risk Report card further down the page is a different generator — the per-audience standard report). Open it. The board pack top bar carries the period, a provenance badge, Print and Export board pack. The pack's persona, reporting currency and obligation calendar all come from the sector pack matched on the institution profile — change the profile, not the pack. Exposure by business unit has its own Export BU cut (CSV) once a service map is loaded.
2. CBOM. Board › Reports › Other exports › Cryptographic bill of materials (/compliance/cra/cbom). Export offers PDF (browser print), JSON (a real CycloneDX 1.6 cryptographic bill of materials) and CSV (the live component rows). There is no SPDX button because no SPDX document is emitted. The table on screen is the same data as the file: Component · Algorithm · Key length · Usage · Certificate · Issuer · Expiry · Quantum status · PQC ready, where quantum status is Resistant, Breakable, or Unknown when the algorithm could not be identified.
3. PQC position. Board › PQC Position carries its own Export position.
4. Verify the chain. Operations › Activity. The Audit chain integrity panel explains it: verifying recomputes each row's SHA-256 from its sealed fields plus the previous row's hash, so a retroactive edit, a gap or a re-order inside the chain breaks the link and is named. Press Verify chain.
A good result reads:
Chain intact — N events recomputed and linked. Sealed as event #S at timestamp.
A bad result reads:
Chain BROKEN at event #S — N events checked.
Hand the customer the intact result with its sealed event number. That number is what an assessor asks for.
What the screen shows
The board pack's top-bar badge is the pack's honesty statement and takes exactly one of three states:
| Badge | Meaning |
|---|---|
| Includes benchmark templates | At least one scenario is still an uncalibrated pack magnitude |
| No scenarios modelled yet | Nothing has been modelled — an empty estate is never dressed as live data |
| Live data | Every scenario in the pack is this tenant's own |
The business-unit section always keeps its Unmapped row: certificates nobody has assigned are part of the picture, not an omission to hide.
Provenance
| Figure | Tier |
|---|---|
| Certificate, algorithm and expiry counts | live |
| Any scenario magnitude not yet calibrated | benchmark, and the pack badge says so |
| Analyst readiness, owners, narratives | typed |
| An algorithm the parser could not name | unknown in the CBOM, never defaulted |
| A section with no input collected | empty, with the next step named |
Common failures
- The chain reports BROKEN. This is an incident, not a UI problem. Stop, preserve the result, and follow the incident procedure in the security handbook. Do not re-run to see if it clears.
- Verification is throttled. The action is rate-limited; a refused call renders as a throttle in its own neutral line and is not a broken chain.
- Removal of the newest events. The chain alone cannot detect a truncation at the head. Compare the sealed event number across runs — that is why you record it.
- The pack shows Includes benchmark templates on handover day. Finish the calibration workshop or say plainly, in the room, which figures are benchmark.
- The pack shows No scenarios modelled yet. Bootstrap the pack on Console › Onboarding; do not present an empty pack as a result.
- A review or a recalibration after handover. It lands in the chain like everything else; re-verify and give the customer the new sealed event number.
Previous: Calibration workshop · Next: Monitoring
All steps: Analyst method