What Is a Cryptographic Inventory and Why Every Organization Needs One

Every authoritative source on post-quantum migration, NIST, CISA, NSA, and sector-specific regulators, agrees on one prerequisite: before you can migrate, you must inventory. A cryptographic inventory is the systematic map of where and how cryptography is used across your organization. Without it, you are planning a migration into the unknown.

What a Cryptographic Inventory Covers

• Algorithms: which cryptographic algorithms are in use (RSA, ECC, ECDH, AES, SHA-256, etc.) and where each appears
• Protocols: which protocols carry cryptographic operations (TLS, SSH, S/MIME, IPSec, JWT, code signing)
• Libraries: which cryptographic libraries are in use (OpenSSL, BoringSSL, Bouncy Castle, platform APIs) and which versions
• Certificates: what PKI certificates exist, which algorithms they use, when they expire, and what systems depend on them
• Key management: where keys are stored, how they are generated, how they are wrapped, and who manages them
• Firmware and embedded systems: devices with long deployment lifetimes that may carry hardcoded cryptographic choices
• Supply chain: third-party software, managed services, and infrastructure components that perform cryptographic operations

Why the Inventory Is the Starting Point

Migration prioritization depends on it. You need to know which systems use RSA-2048 key exchange before you can decide which to migrate first. Roadmap planning depends on it. Understanding the scope of the work requires knowing how many certificate renewals, library upgrades, and protocol updates are involved. Cost estimation depends on it. Executive and regulatory reporting depends on it.

Organizations that skip the inventory and begin migrating individual systems in isolation discover later that they have missed high-risk dependencies, created inconsistent cryptographic postures, and cannot demonstrate systematic progress to auditors or regulators.

How to Build One

• Start with the highest-risk systems: those that protect the most sensitive data or have the longest confidentiality requirements
• Combine automated scanning (TLS scanning, dependency analysis, certificate enumeration) with manual review of architecture documentation
• Include third-party dependencies; they are often the largest gap in organizational cryptographic visibility
• Document findings in a structured format that can be used to drive risk scoring and roadmap sequencing
• Treat the inventory as a living artifact: cryptographic usage changes as systems are updated, and the inventory must reflect current state

What Comes Next

Once you have a cryptographic inventory, you can score each finding by risk (algorithm strength, data sensitivity, confidentiality lifetime, system criticality) and sequence a phased migration roadmap. The inventory does not tell you what to do; it gives you the information you need to make informed decisions. That is exactly what it is for.