Cryptographic inventory: the foundation of post-quantum readiness
Post-quantum migration requires knowing where cryptography is used, how, and who controls it. Yet most organizations lack a cryptographic inventory—a structured map of systems, protocols, and dependencies that use encryption, key exchange, or digital signatures.
Why inventory matters
Without visibility, organizations cannot:
- Assess exposure: Which systems rely on vulnerable algorithms (RSA, ECDH, ECDSA)?
- Prioritize migration: What gets migrated first, and why?
- Manage third-party risk: Which vendors control critical crypto decisions?
- Track progress: How do you measure readiness over time?
An inventory is not just a technical list. It connects business assets (data, systems, processes) to cryptographic mechanisms (TLS, certificates, VPNs, signing) and ownership (internal vs vendor, direct vs indirect control).
What to do
Start with critical systems and long-term data. Document: system name, business purpose, crypto function (encryption, authentication, signing), symmetric vs asymmetric, direct vs indirect dependency, data sensitivity, retention period. Keep it manageable and actionable—focus on decision support, not completeness.
Integrate the inventory into risk management and procurement processes. Review it periodically as systems change. A structured maturity assessment (such as the Qubixor Post-Quantum Maturity Model) helps organizations evaluate inventory completeness and identify gaps.