Your first post-quantum step: a cryptographic inventory

Short answer: A cryptographic inventory is a list of where your organisation uses public-key cryptography, with the algorithm, what it protects, how long that data must stay secret, the owner and the upgrade path. It is the first step of any post-quantum migration because you cannot plan or prioritise what you cannot see.

Every post-quantum migration starts with the same question: where do we use cryptography? Most organisations cannot answer it quickly. Cryptography is buried in libraries, appliances, certificates, cloud services and supplier products, and nobody wrote it all down.

The standards are ready. NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024. What most organisations lack is the map.

Why inventory comes first

You cannot prioritise what you cannot see. You also cannot ask suppliers the right questions, budget the work, or tell a regulator or customer where you stand. An inventory turns a vague worry into a list with owners and dates.

A simple inventory in four areas

1. Network. TLS endpoints, VPNs, Wi-Fi, SSH, email transport and API gateways. These are where key exchange happens, and so where harvest-now-decrypt-later exposure sits.

2. Identity. Certificates and their authorities, single sign-on, multi-factor systems, code-signing keys and device identity. Note expiry dates and who controls the keys.

3. Data. Databases, backups, archives, disk and file encryption, and key management systems. Record where data sits and how long it must stay confidential.

4. Third parties. SaaS tools, payment providers, managed services and anything that holds your data or signs on your behalf. You usually cannot change their cryptography, but you can ask about their plans.

What to record for each item

• The algorithm and key size in use (for example RSA-2048 or an elliptic curve).
• What it protects and how long that data must stay secret.
• The owner, inside or outside the company.
• Whether it can be upgraded, and how.
• The supplier's stated post-quantum plan, if any.

A spreadsheet is enough to start. Tooling can come later.

Then rank

Rank by two questions. How long must the data stay confidential? And could it be recorded today? Long-lived data protected by RSA or elliptic curve key exchange, crossing networks you do not control, goes to the top. Short-lived internal data goes to the bottom.

Build crypto-agility while you are at it

Crypto-agility means being able to change algorithms without rebuilding the system. Look for places where an algorithm is hard-coded, where certificates are pinned, or where a device cannot be updated. Fixing these now is worth doing whichever algorithms you finally choose.

A realistic first month

• Week 1: name an owner and agree the scope.
• Weeks 2 and 3: collect the four areas above from IT, security and suppliers.
• Week 4: rank the list and write a one-page plan with the top five items.

Common pitfalls

• Counting only what you run. A lot of cryptography sits inside supplier products and cloud services. Ask for their statements in writing.
• Forgetting embedded devices. Printers, cameras, building systems and industrial controllers often cannot be updated. Note them, and plan replacement cycles.
• Treating it as a one-off. Systems change. Give the inventory an owner and review it at least yearly.
• Starting with tools before scope. A scanner cannot tell you how long a dataset must stay confidential. People who know the business can.

Why this matters for Ireland

Irish organisations in finance, health, pharma and technology hold data with long lives and work under GDPR and, for many, NIS2 obligations. A clear inventory helps with both security planning and showing due care.

We cover this at Quantum Ireland from Clonmel, Tipperary. These are our own views, not a government position.

FAQ

What is a cryptographic inventory?

A record of every place cryptography is used: network, identity, data and third parties. For each item note the algorithm, key size, owner and how long the protected data must stay confidential.

How long does it take to build one?

A useful first version can take about a month: name an owner, collect the four areas from IT, security and suppliers, then rank the list and write a one-page plan.

What do I prioritise?

Long-lived data protected by RSA or elliptic curve key exchange that crosses networks you do not control, because it can be recorded today and read later.

What is crypto-agility?

The ability to change algorithms without rebuilding the system. Hard-coded algorithms, pinned certificates and devices that cannot be updated are the usual obstacles.

Do I need a quantum computer to start?

No. The inventory and planning need no quantum hardware.