EN|FREN|FRPost-quantum risk cannot be assessed without knowing where and how cryptography is used. Crypto is often embedded, implicit, and rarely documented centrally. An inventory maps dependencies between business assets, systems, and crypto mechanisms. It is a governance prerequisite, not just a technical exercise.
Crypto appears in encryption at rest/transit, authentication, digital signatures, secure comms. Examples: TLS, certificates, VPNs, identity providers, document signing, backups. Many mechanisms use asymmetric cryptography. Usage is often embedded in products or inherited from vendors; understanding it requires IT, security, architecture, and procurement.
Direct dependencies: applications managing certificates, systems doing encryption/signing. Indirect: SaaS, cloud, vendors managing crypto internally. Indirect dependencies are often the most critical — harder to assess, may limit migration options. An inventory must identify both and document ownership and control; you cannot migrate what you do not control.
Keep inventories manageable and actionable: system name, business purpose, crypto function, symmetric/asymmetric, direct/indirect, ownership, data sensitivity and retention. Goal is decision support — prioritisation, long-term confidentiality risks, alignment with regulatory discussions. Maintain periodically and integrate into risk management.