Most quantum-readiness programmes stall at the same point: the organisation accepts that its cryptography has an expiry date, commissions a migration plan, and then discovers that nobody can say with confidence what is actually deployed. The plan is written against an assumed estate, and the first weeks of execution are spent discovering that the assumptions were wrong.
Discovery before strategy
A cryptographic inventory is not a compliance artefact to be produced once and filed. It is the input that makes every downstream decision tractable — which systems are exposed to harvest-now-decrypt-later, which certificates are pinned into hardware that will not accept a larger key, and which third parties hold your data under algorithms you do not control.
- Algorithms, key lengths, and certificate chains in active use, not as documented
- Where cryptography is embedded in firmware, appliances, and vendor products
- Data with a confidentiality lifetime that outlasts the algorithm protecting it
- Ownership: who can authorise a change to each cryptographic dependency
What the paper covers
The full whitepaper sets out the staged journey in detail: the discovery baseline, the risk model that turns an inventory into a prioritised backlog, the governance needed to keep the estate from drifting back, and the operating model that carries the programme past its first migration wave. Download the PDF for the complete framework.