OMB CSV Output Format

Overview

The CSV output format produces a federal cryptographic inventory spreadsheet aligned to the data fields required by OMB Memorandum M-23-02 (Migrating to Post-Quantum Cryptography) and NSM-10 (National Security Memorandum on Quantum Computing). The report covers every cryptographic dataset the scanner collects — TLS, SSH, non-TLS wire protocols, VPN and IPSec clients, filesystem certificates, WiFi, and MACsec — each mapped into the same 34-column structure. Fields not covered by the fixed columns are serialised into the Additional Notes column (col 13).

# Minimal — writes crypto-inventory.csv
.\certscanner-windows-amd64.exe -outputformat csv -output crypto-inventory.csv

# Full local scan with all datasets
.\certscanner-windows-amd64.exe -outputformat csv -output crypto-inventory.csv `
  -scan-installed-apps -detect-vpn-clients -detect-ipsec `
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Minimal — writes crypto-inventory.csv
./certscanner-linux-x64 -outputformat csv -output crypto-inventory.csv

# Full local scan with all datasets
./certscanner-linux-x64 -outputformat csv -output crypto-inventory.csv \
  -scan-installed-apps -detect-vpn-clients -detect-ipsec \
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Intel Mac
./certscanner-darwin-amd64 -outputformat csv -output crypto-inventory.csv

# Apple Silicon Mac
./certscanner-darwin-arm64 -outputformat csv -output crypto-inventory.csv \
  -scan-installed-apps -detect-vpn-clients \
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Single host — full cipher enumeration
./certscanner -mode remote -hosts 192.168.1.0/24 -ports 443,8443,22 \
  -cipherscanquick -outputformat csv -output remote-inventory.csv \
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Dual output: JSON for SIEM + CSV for OMB submission in one run
./certscanner -mode remote -hosts 10.0.0.0/8 -ports 443,8443,22,8080 \
  -cipherscanquick -output scan-results.json \
  -csv-output remote-inventory.csv

Dataset Coverage

Every cryptographic dataset detected by the scanner produces one or more rows in the CSV. Each dataset type maps its specific fields to the 34 OMB columns; fields with no direct column equivalent are written to Additional Notes (col 13).

Column Reference

All 34 column names match the OMB cryptographic inventory data field names exactly. The "Populated by" column lists which dataset types fill each field.

Row Mapping Logic

The scanner emits one row per cryptographic asset instance. The priority order within each application's port list is: TLS → SSH → SMB3 → Kerberos → NFS → IBM MQ → AirPlay → OPC-UA → Tor. Non-port datasets (VPN clients, IPSec tunnels, filesystem certificates, WiFi, MACsec) are appended after all port rows.

Enterprise Deployment Workflows

# Deploy via Intune Win32 app — collect OMB CSV per device, upload to SharePoint
$hostname = $env:COMPUTERNAME
$outfile  = "C:\ProgramData\TYCHON\inventory-$hostname.csv"
.\certscanner-windows-amd64.exe `
  -outputformat csv `
  -output $outfile `
  -scan-installed-apps `
  -detect-vpn-clients -detect-ipsec `
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Upload to SharePoint or S3 via separate script
if (Test-Path $outfile) {
    # ... upload logic ...
}

#!/bin/bash
# Collect OMB CSV and ship to central aggregation bucket
HOSTNAME=$(hostname)
OUTFILE="/var/log/tychon/inventory-${HOSTNAME}.csv"

./certscanner-linux-x64 \
  -outputformat csv \
  -output "$OUTFILE" \
  -scan-installed-apps \
  -detect-vpn-clients -detect-ipsec \
  -tags "Agency-XYZ,FY2026-Q1,OMB-M-23-02"

# Upload to S3 / GCS / central store
aws s3 cp "$OUTFILE" s3://agency-crypto-inventory/ --region us-east-1

# Combine per-host CSV files into a single agency inventory
# The header from the first file is retained; subsequent files are appended without header
head -1 inventory-HOST1.csv > agency-inventory-combined.csv
for f in inventory-*.csv; do
    tail -n +2 "$f" >> agency-inventory-combined.csv
done

Regulatory Context

Limitations & Scope

• Local mode only. The CSV format reflects the crypto profile of the host running the scanner. Remote network scans (cipher suite sweeps) are documented in FlatNDJSON or Tychon NDJSON format, which are better suited for SIEM ingestion.
• Non-TLS crypto source fidelity. For protocols where a live handshake does not expose cipher negotiation (OPC-UA, Tor, NFS), cipher data is sourced from the published protocol specification rather than the running server's actual configuration. The crypto_source qualifier in column 33 indicates whether data came from the wire (wire) or the spec (protocol_spec).
• One format at a time. If you also need JSON for a SIEM, run the scanner twice: once with -outputformat csv and once with -outputformat flatndjson (or use -splitoutputs with a non-CSV format).
• Cipher data reflects observed negotiations. If a port's cipher suites could not be probed (firewall, timeout, protocol mismatch), that application's columns will be empty and status will be Unknown/Not Yet Assessed.
• Multi-value cells use semicolons as delimiters. When importing into Excel, use the Text Import Wizard or Power Query to split semicolon-delimited values into separate columns if needed for pivot analysis.
• WiFi and MACsec require elevated privileges. On Linux, reading WiFi security mode and MACsec interface configuration may require root or CAP_NET_ADMIN. Rows for these datasets will be absent if the scanner lacks the necessary permissions.