You don't need to wait until March 2027 for CISA and NIST to publish a Cryptography Bill of Materials (CBOM) standard. The executive order issued on June 22 sets a timeline for defining what should be in your CBOM, but it won't tell you how to discover the cryptographic assets already buried in your infrastructure. Start that work now, while you still have budget flexibility and time to address what you find.
This checklist guides you through the foundational steps for cryptographic asset discovery and inventory management. Think of it as pre-work that positions your organization to map cleanly to whatever schema the federal government eventually publishes.
What This Checklist Covers
You'll inventory cryptographic implementations across your estate, document their locations and dependencies, and establish a process for maintaining that inventory as your environment changes. This isn't a post-quantum migration plan. It's the discovery work that makes migration possible.
The checklist focuses on practical steps you can complete with existing tools and staff. It assumes you're working in a heterogeneous environment with legacy systems, third-party software, and modern cloud services.
Prerequisites
Before you begin:
- Executive sponsorship confirmed. Cryptographic discovery touches every part of the technology stack. You'll need authority to request information from application owners, infrastructure teams, and vendors.
- Baseline tooling identified. You need network scanning capabilities, access to source code repositories, and certificate management system exports at minimum.
- SBOM lessons documented. If your organization has attempted Software Bill of Materials implementation, review what worked and what didn't. The ENISA 2026 adoption survey found that 78% of organizations started SBOM programs, but only 9% achieved mature, automated implementation. Document your organization's experience so you don't repeat the same mistakes with cryptographic inventories.
Checklist Items
1. Map Certificate Stores Across All Environments
Scan production, staging, development, and disaster recovery environments for X.509 certificates. Include on-premises servers, cloud instances, containers, and network appliances.
Good looks like: A spreadsheet or database containing every certificate's subject, issuer, expiration date, key algorithm (RSA-2048, ECDSA P-256, etc.), signature algorithm, and the system or service where it's installed. You should be able to filter by algorithm type and see which certificates rely on quantum-vulnerable cryptography.
2. Inventory Cryptographic Libraries in Your Software Supply Chain
Request SBOMs from commercial software vendors. For internally developed applications, scan dependencies in package managers (npm, Maven, pip, NuGet) and identify which cryptographic libraries each application uses.
Good looks like: A list showing which applications use OpenSSL, BoringSSL, Bouncy Castle, or other crypto libraries, along with version numbers. You know which applications would be affected if a library needs to be updated for post-quantum algorithm support.
3. Document Legacy Systems with Embedded Cryptography
Identify systems that haven't been updated in five or more years. Check industrial control systems, point-of-sale terminals, building access systems, and any custom hardware with firmware-embedded crypto.
Good looks like: A risk-rated inventory of legacy systems that includes: system name, business function, cryptographic implementation (if known), last update date, and whether the vendor still provides support. Systems marked as "crypto implementation unknown" should be flagged for deeper investigation.
4. Catalog VPN Concentrators and Network Encryption
Document IPsec configurations, SSL/TLS termination points, and any hardware security modules. Include cipher suites currently enabled on each device.
Good looks like: For each network encryption point, you have the device model, firmware version, enabled cipher suites, and whether the device supports configuration updates. You've identified which devices can't be reconfigured and will require hardware replacement when post-quantum algorithms become mandatory.
5. Survey Third-Party Integrations and APIs
List every external API your systems call and every external system that calls your APIs. Document the authentication and encryption methods used for each integration.
Good looks like: An integration map showing partner name, integration purpose, authentication method (API keys, OAuth, mutual TLS), and transport encryption. You've contacted critical partners to ask about their post-quantum readiness timelines.
6. Establish a Cryptographic Asset Owner for Each System
Assign a responsible party for every system, application, or service that uses cryptography. This person should be able to answer questions about the system's crypto implementation and approve changes.
Good looks like: Your inventory includes an "owner" field that's populated for every entry. Owners have acknowledged their responsibility in writing and understand they'll be contacted when remediation work begins.
7. Create a Data Model Flexible Enough to Extend
Design your inventory schema to accommodate fields you don't have answers for yet. The March 2027 deadline will produce a standard definition, but your current model should be able to absorb new requirements without a complete rebuild.
Good looks like: Your database or spreadsheet includes columns for algorithm type, key length, implementation location, and compliance status, plus empty columns reserved for future requirements. You've documented your schema design decisions so the team maintaining this inventory understands why certain fields exist.
8. Test Your Discovery Tools Against a Known Baseline
Pick one well-understood application or system. Run your discovery process and compare the results against what you know should be there.
Good looks like: Your tools correctly identified all certificates, libraries, and cryptographic implementations in the test system. Any gaps are documented with an explanation of why the tool missed them and what manual steps are needed to fill those gaps.
9. Document Vendor Dependencies and Support Timelines
For every commercial product in your environment, record the vendor's post-quantum roadmap if available. Note which vendors have published timelines and which haven't responded to inquiries.
Good looks like: A vendor matrix showing product name, current cryptographic capabilities, vendor's stated post-quantum support timeline, and your organization's risk rating if the vendor doesn't deliver on schedule. You've identified which products have no viable post-quantum path and will require replacement.
10. Set a Refresh Cadence for the Inventory
Cryptographic assets change constantly: certificates expire, applications get updated, new integrations launch. Decide how often you'll refresh your inventory and who's responsible for keeping it current.
Good looks like: You've scheduled quarterly full scans and established a process for updating the inventory whenever a new application ships or an integration changes. The inventory includes a "last verified" date for each entry.
Common Mistakes
Waiting for perfect tooling. No single tool will discover everything. Start with what you have and plan to supplement automated discovery with manual documentation.
Treating this as a one-time project. Your cryptographic inventory will be out of date the day you finish it unless you build a maintenance process from the start.
Skipping legacy systems because they're "too hard." Those systems represent your highest risk. Document what you know, flag what you don't, and escalate the business risk to executives who can make replacement decisions.
Assuming vendors will provide CBOMs automatically. The ENISA survey found that 40% of organizations never receive SBOMs from suppliers despite contractual requirements. Don't assume crypto inventories will be any different. Build vendor communication into your process and escalate non-responsive vendors to procurement.
Next Steps
Once you've completed this checklist, you'll have a working cryptographic inventory that can evolve as federal guidance becomes available. Your next priorities:
- Map your inventory to NIST's post-quantum algorithm recommendations to identify which implementations will need updates. NIST post-quantum algorithm recommendations
- Develop a risk-based remediation roadmap that prioritizes internet-facing systems and high-value assets.
- Establish a cross-functional working group that includes application teams, infrastructure, security, and vendor management to coordinate the transition work.
The March 2027 deadline will give you a data model. But the discovery work, the vendor negotiations, and the remediation planning belong to you. Start now while you can still control the timeline.
