Summary
The joint CISA, NSA and NIST quantum-readiness guidance recommends a migration roadmap, cryptographic discovery, a useful inventory and engagement with suppliers. Start by finding dependencies, not by replacing one algorithm name in a configuration file.
What to record
The following is a practical inventory template based on that guidance. Adapt it to the systems you actually operate; it is not a mandated agency form.
| Record | Questions to answer |
|---|---|
| System and owner | Which service, device or product depends on the cryptography? Who can authorize a change? |
| Protocol and purpose | Is it protecting transport, stored data, authentication, signatures or software updates? |
| Implementation | Which library, product, hardware module and installed version implement it? |
| Algorithms and parameters | What is configured, and what is actually negotiated in use? |
| Keys and certificates | Where are they generated, stored, rotated and validated? Which trust roots and peers depend on them? |
| Protected information | How long must confidentiality or signature validation remain useful? |
| Dependencies | Which vendors, counterparties, firmware updates or certificate services must change first? |
| Evidence and status | When was the record checked, by which method, and what migration test remains? |
Record key identifiers and custody arrangements, not private-key material in the spreadsheet.
How to use the inventory
- Assign an owner and scope for discovery. Include externally supplied services as well as your own code.
- Combine technical discovery with questions to system owners and suppliers. Ask vendors for their cryptographic dependencies and migration plans.
- Prioritize long-lived sensitive data and systems that take a long time to replace. The joint guidance explains the risk of collecting encrypted data now for later decryption.
- Track a tested replacement path, including compatibility, performance and rollback decisions. An inventory item is not migrated merely because a supplier announced support.
- Keep the inventory current as systems, dependencies and certificates change.
Trust model / threat model
A vendor response is evidence to assess, not proof of what a deployed endpoint negotiates. Keep documentation and measurements connected to the same system record. Use hybrid KEM migration when planning protocol transitions.
Readiness
Usable now. Discovery and dependency mapping do not require waiting for every product to support new algorithms. CISA's quantum initiative explicitly includes inventory and migration planning.
Limits
The cited NIST IR 8547 page labels that publication an Initial Public Draft. Its proposed transition approach is not treated here as a final mandatory deadline. This page does not predict a quantum-computer arrival date or imply that every cryptographic primitive needs the same replacement. Continue with post-quantum cryptography and the deployment tracker.
Primary sources
- CISA, NSA and NIST quantum-readiness guidance
- Joint factsheet: inventory, priorities and vendor engagement
- CISA quantum initiative
- NIST IR 8547 Initial Public Draft
Page history
- Updated
- 2026-10-25
- Origin
- Written for ungovernable.tech.
- Improve this page
- Suggest an edit — issues and pull requests are welcome.