A Cryptographic Inventory Checklist for the Post-Quantum Era

Quick answer: A post-quantum cryptographic inventory checklist documents every key, certificate, and algorithm across your PKI, applications, SaaS providers, HSMs, APIs, IoT devices, and blockchain systems, recording what it is, where it lives, when it expires, who owns it, why it exists, and how it is configured. This inventory, often formalized as a Cryptographic Bill of Materials (CBOM), is the prerequisite for prioritizing which systems to migrate first as NIST and regulatory deadlines approach.

Key Takeaways

• Document every cryptographic asset with the “Six W’s”: what it is, where it is, when it expires, who owns it, why it is used, and how it is configured.
• Long-lived certificates and keys, especially those using RSA or ECC, are the highest-priority targets for harvest-now-decrypt-later attacks.
• No single scanning method finds everything: combine self-identification, static code scanning, dynamic analysis, SBOMs, and file system discovery.
• NIST finalized ML-KEM, ML-DSA, and SLH-DSA in August 2024; NIST IR 8547 (still in draft) proposes deprecating RSA and ECC after 2030 and disallowing them after 2035.
• An inventory is not a one-time project. It needs scheduled re-scans, documented blind spots, and an exceptions process to stay accurate.

Why Timing Matters: Current PQC Standards and Deadlines

A cryptographic inventory is not an abstract best practice. It is the prerequisite step for meeting concrete, dated deadlines. NIST finalized its first three post-quantum standards, ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), on August 13, 2024. A fourth signature standard, FN-DSA (FIPS 206, based on FALCON), remains in draft, with final publication expected in late 2026 or early 2027.

On the deprecation side, NIST IR 8547, still a draft as of 2026, proposes deprecating classical algorithms with 112-bit security, such as RSA-2048 and ECC P-256, after 2030, and disallowing quantum-vulnerable algorithms after 2035. For National Security Systems, the NSA’s CNSA 2.0 suite requires new acquisitions to be quantum-resistant by January 1, 2027, with most equipment transitions targeted for 2030 to 2033. U.S. Executive Order 14412, signed June 22, 2026, sets a December 31, 2030 PQC migration deadline for federal civilian agencies and their contractors. None of these deadlines are reachable without first knowing where your vulnerable cryptography lives, which is exactly what the inventory below is built to find.

Digital transformation has pushed cryptography into the spotlight as the unseen foundation of business security. Yet, for many organizations, this critical layer is a vast, unmapped territory. As we stand at the precipice of the quantum era, this lack of visibility is no longer a manageable risk, but it’s an existential threat. A comprehensive cryptographic inventory is not just a checklist, it’s the blueprint that will guide your organization’s journey to post-quantum readiness.

While the strategic importance of this inventory is clear, the real challenge lies in the execution. This detailed checklist goes beyond the “why” and provides a practical “what” and “how” to ensure your inventory is thorough, actionable, and robust enough to stand against the challenges ahead.

Understanding Key Inventory Principles

Before you begin collecting data, establish a clear framework. This isn’t a one-time task; it’s an ongoing process that requires continuous improvement and visibility. Your approach should be guided by these core principles:

• The Six W’s of Crypto: Every cryptographic asset in your organization must be documented with these six key details:
  1. What is the cryptographic component? This includes specific keys, digital certificates, software libraries, hardware security modules (HSMs), etc.
  2. Where is it located? This identifies its placement, whether in a specific application, on a server in a data center, within a cloud vault like Azure Key Vault, etc.
  3. When was it created, and when will it expire or be rotated? This is crucial for identifying long-lived keys that are prime targets for “harvesting.”
  4. Who is the owner or party responsible for its management and lifecycle?
  5. Why is it being used? This defines its purpose, such as protecting sensitive data for regulatory compliance like GDPR, authenticating a user, ensuring transactional integrity, and more.
  6. How is it being used? This specifies the technical details, including the specific algorithm, key length, protocol version configured, and more.
• Acknowledge Your Scope: Clearly define what’s under your direct control (your own keys, hardware, and applications) versus what’s managed by a third-party vendor. For third-party services, you must document them as “black boxes,” and your responsibility is to get a risk statement, a detailed remediation plan, and a PQC roadmap from the provider.
• Standardize and Simplify: Use consistent business processes and deployment methods wherever possible. This is the essence of crypto agility. By standardizing your approach, you simplify not only the inventory process but also future updates, patching, and new deployments.
• Be Comprehensive: Your inventory must reflect all components that could be negatively impacted by PQC advances, from legacy systems to cutting-edge technologies. No system is too small or too old to ignore.

Building Your Inventory

A single scanning tool or method won’t give you the full picture. A truly comprehensive inventory requires a multi-layered approach that combines various techniques to eliminate blind spots.

Public Key Infrastructure (PKI)

Your PKI is the digital identity system for your organization, enabling secure communication and authentication. It’s a critical area for inventory because it relies on asymmetric encryption, which is highly vulnerable to quantum attacks.

• Crypto Asset List: Create a meticulous inventory that lists all applications and communications channels that use asymmetric cryptography. This includes TLS/SSL certificates for web servers, code-signing certificates, and keys used for digital signatures and authentication.
• Key Management Audit: Verify and document your entire PKI process, including how keys are generated, stored, and rotated. Your most critical keys, such as root signing keys, should be stored in a trusted Hardware Security Module (HSM), which provides a higher level of security. Examining HSM logs can be a powerful method for discovering which applications are making cryptographic calls.
• Certificate Lifecycle Management: Document the validity periods of all your certificates. This is particularly crucial for identifying long-lived certificates (e.g., 25 years or longer), as these are prime targets for “harvesting” attacks. Just as important as validity periods is the key size and algorithm used. Even with shorter lifecycles, certificates that rely on RSA (2048/3072/4096-bit) or ECC (P-256, P-384) are still vulnerable to quantum attacks, since Shor’s algorithm can break them regardless of key length. To mitigate this, create a process not only to regularly review and re-issue certificates with shorter lifecycles but also to catalog the algorithms and key sizes in use. This visibility will help prioritize which certificates pose the greatest quantum risk and should be transitioned first to quantum-resistant or hybrid cryptographic models.

Application Development (AppSec)

Cryptography is often embedded deep within applications, making it hard to find and manage. To build an effective inventory, you’ll need to leverage multiple discovery methods:

• Self-Identification: A simple and effective starting point is to expand your existing application inventory. Require application owners to explicitly record whether their application uses encryption, what type it is, and a brief description of its usage. This first-line data provides a crucial starting point for more technical discovery.
• Static Scanning: Integrate static code analysis tools into your CI/CD pipelines. These tools can scan code to find cryptographic function calls. While they may not be perfectly precise (e.g., they might show all available algorithms in a library, not just those in use), they are an excellent way to quickly identify which applications are calling algorithms that are no longer considered PQC-safe, like RSA and ECDSA.
• Dynamic Analysis: For a more accurate, run-time view, use Interactive Application Security Testing (IAST) tools. These tools have visibility into the cryptographic functions that are actually being used by an application, including calls from third-party libraries and framework components. This approach complements static scanning by showing “what’s really happening.”
• Software Bill of Materials (SBOM): As SBOMs become more widespread, they will provide a valuable “list of ingredients” for software components. You can use this to map cryptographic libraries and identify known vulnerabilities.
• File System Discovery: Use file system scans with tools like Tanium or Varonis to find cryptographic components like keys, key stores, and certificates. Be aware that this method can produce a lot of noise, so it’s best used in conjunction with other methods to confirm what’s actually in use.

Other Critical Considerations

Cryptography isn’t limited to traditional servers and applications. Your inventory must also account for these specialized asset classes:

• SaaS Providers: Don’t assume your data is safe just because it’s in the cloud. Document the encryption algorithms used by your SaaS providers. Understand their key management model: is it SaaS-managed, Bring Your Own Key (BYOK), or do they allow for customer-managed keys? Ask for their PQC plan and timeline, especially if they use older algorithms.
• Hardware Security Modules (HSMs): HSMs contain an organization’s most important keys. They must be included in your inventory. Beyond simply listing the HSMs, you should examine their logs to identify which applications are making calls to perform cryptographic functions, providing a more detailed view of usage.
• APIs, IoT, and Blockchain: These are separate asset classes that each present unique PQC risks. For APIs, document their use of encryption and ensure their connection ciphers are strong. For IoT, catalog all devices and their embedded crypto, as updating firmware can be a challenge. For blockchain, you must understand its usage of public-key cryptography, which is vulnerable to PQC risks.

The Journey of Continuous Improvement

Building and maintaining this inventory is a journey, not a destination. It requires continuous effort and a well-defined process to remain accurate and relevant.

• Start with a CBOM: Use your initial inventory to create a Cryptographic Bill of Materials (CBOM), which provides a comprehensive, structured view of your crypto usage.
• Frequency of Scans: Determine the appropriate frequency of scans based on risk and change activity. More critical areas should be scanned more often.
• Address Blind Spots: Acknowledge that some keys may be offline or in inaccessible locations. Develop alternative methods to find them or make assumptions where validation isn’t possible.
• Develop Awareness: Provide training to your development and security teams to embed crypto agility into your culture and processes.
• Monitor and React: Create a process for handling exceptions and alerts triggered by monitoring (e.g., an algorithm being deprecated or a key expiring).

Quick Implementation Checklist

Use this as a condensed working checklist once the detailed steps above are underway:

• Document every cryptographic asset against the Six W’s (what, where, when, who, why, how).
• Flag long-lived certificates and keys (25 years or more) and any RSA or ECC assets for priority migration review.
• Combine at least three discovery methods (self-identification, static scanning, dynamic analysis, SBOM review, or file system discovery) to reduce blind spots.
• Get a documented PQC roadmap and risk statement from every third-party and SaaS provider handling your data.
• Consolidate findings into a Cryptographic Bill of Materials (CBOM) and set a re-scan cadence based on system risk.
• Map inventory findings against current deadlines: NIST IR 8547’s 2030/2035 dates, CNSA 2.0’s 2027 acquisition gate, and Executive Order 14412’s 2030 federal deadline where applicable.

How Encryption Consulting Can Help

Building a comprehensive cryptographic inventory is a huge undertaking, but you don’t have to do it alone. We are a globally recognized leader in applied cryptography, offering Post-Quantum Cryptography (PQC) Advisory Services specifically designed to help organizations like yours navigate the quantum shift.

Our services are built on a structured, end-to-end approach:

• PQC Assessment: We perform cryptographic discovery and inventory to locate all your keys, certificates, and dependencies. This delivers a clear Quantum Threat Assessment and a Quantum Readiness Gap Analysis that identifies your vulnerabilities and most urgent priorities.
• PQC Strategy & Roadmap: Based on the inventory data, we help you develop a custom, phased PQC migration strategy aligned with NIST and other industry standards. This includes creating a Cryptographic Agility Framework to ensure you’re prepared for future changes.
• Vendor Evaluation and PoC: We assist in selecting the best PQC solutions by defining evaluation criteria, shortlisting vendors, and executing proof-of-concepts (PoCs) on your critical systems to validate their effectiveness.
• PQC Implementation: We help you seamlessly integrate PQC algorithms into your PKI and other security ecosystems, including the deployment of hybrid cryptographic models for a secure and disruption-free transition.

With our deep expertise and proven framework, you can build, assess, and optimize your cryptographic infrastructure, ensuring a smooth and secure transition to a post-quantum future.

Conclusion

The quantum era will not wait for organizations to catch up. A comprehensive cryptographic inventory is the cornerstone of true post-quantum readiness, giving you the visibility and control needed to protect your most critical assets. By moving beyond theory to a structured, actionable checklist, you can uncover hidden risks, strengthen crypto agility, and prepare your infrastructure for the inevitable transition.

With the right approach, and the right partners, you can turn today’s uncertainty into tomorrow’s resilience. Start building your cryptographic inventory now to ensure your organization is not just quantum-aware, but quantum-ready.

Frequently Asked Questions

What is a cryptographic inventory, and why does it matter for PQC migration?

A cryptographic inventory is a documented record of every key, certificate, algorithm, and protocol in use across an organization, including who owns each asset and when it expires. It matters because a PQC migration cannot be planned or prioritized for cryptography that has not been found; discovery is typically the most time-intensive part of any migration program.

What are the “Six W’s” of a cryptographic inventory?

The Six W’s are what the cryptographic component is, where it is located, when it was created and will expire or rotate, who owns it, why it is being used, and how it is configured, including the algorithm, key length, and protocol version.

Which certificates and keys should be prioritized first in an inventory?

Prioritize long-lived certificates and keys, those valid for 25 years or longer, along with any assets using RSA or ECC, since these are the most exposed to harvest-now-decrypt-later collection and to Shor’s algorithm regardless of key length.

What is the difference between a cryptographic inventory and a Cryptographic Bill of Materials (CBOM)?

A cryptographic inventory is the raw discovery data collected from PKI systems, applications, SaaS providers, HSMs, and other sources. A CBOM formalizes that data into a structured, machine-readable record of cryptographic assets and their relationships, similar in concept to a software bill of materials, so it can be tracked, queried, and kept current over time.

By when do organizations need to complete their PQC migration?

Deadlines vary by sector. NIST IR 8547, still in draft, proposes deprecating 112-bit classical algorithms after 2030 and disallowing quantum-vulnerable algorithms after 2035. National Security Systems follow the NSA’s CNSA 2.0 timeline, with new acquisitions required to be quantum-resistant from January 1, 2027. U.S. federal civilian agencies and contractors face a December 31, 2030 deadline under Executive Order 14412, signed June 22, 2026.