Deterministic Post-Quantum Cryptographic Bill of Materials (CBOM) Extraction, Quantum-Vulnerability Scoring, and EU Cyber Resilience Act (Regulation (EU) 2024/2847) Binary Attestation

Regulation (EU) 2024/2847 (the EU Cyber Resilience Act, CRA, published 20 November 2024 and entering into force on 10 December 2024 pursuant to Article 71(1)) establishes horizontal mandatory cybersecurity requirements for all hardware and software 'products with digital elements' made available on the Union market, backed by administrative fines of up to EUR 15,000,000 or 2.5% of worldwide annual turnover (Article 64). While Chapter IV notified-body rules applied from 11 June 2026 and full CE-marking conformity and Annex I Part II machine-readable Software Bill of Materials (SBOM) duties take effect on 11 December 2027, Article 14 mandatory vulnerability and severe-incident reporting through ENISA's Single Reporting Platform (SRP) became legally enforceable on 11 September 2026 across ALL new and legacy in-scope products on the EU market (Article 69(3) and Article 71(2)), imposing strict 24-hour early-warning, 72-hour notification, and 14-day/1-month final report clocks. Concurrently, Annex I Part I Point (2)(e) mandates state-of-the-art cryptographic protection alongside cryptographic agility for transitioning from Shor-vulnerable asymmetric primitives (RSA, ECDSA, ECDH, Ed25519 standalone for long-lived secrets) to finalized NIST Post-Quantum Cryptography standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA, promulgated August 2024, and NSA CNSA 2.0). Conventional package-manifest SBOM scanners inspect only lockfiles (package.json, Cargo.lock, pom.xml) and miss statically linked C/C++/Rust/Go cryptographic primitives, hardcoded ASN.1 OIDs, weak elliptic curves, and non-agile TLS/JWT cipher suites inside compiled ELF/PE/Mach-O/Wasm binaries. This technical note formalizes a deterministic binary-level Cryptographic Bill of Materials (CycloneDX v1.6 CBOM per BSI TR-03183-2 v2.1.0) extraction, NIST PQC security-category scoring, and RFC 8785 cryptographic attestation protocol. Reference Implementation & Archival Availability: A deterministic zero-egress WebAssembly (WASM) reference verification engine implementing the formal invariants specified in this monograph is maintained by TITAN Capital Forensics LLC (Albuquerque, New Mexico, USA; ORCID: 0009-0005-3920-2333) at cisopass.com. No source code or executable software is distributed within this technical monograph.