Direct and indirect cryptographic dependencies

Direct dependencies: applications managing certificates, systems doing encryption/signing. Indirect: SaaS, cloud, vendors managing crypto internally. Indirect dependencies are often the most critical — harder to assess, may limit migration options. An inventory must identify both and document ownership and control; you cannot migrate what you do not control.