PQC Ready · practical transition guidance

Cryptographic discovery and inventory

Build an evidence-led view of cryptography across services, software, devices and suppliers, with coverage and unknowns kept visible.

Published and reviewed 15 September 2026 · PQC Ready, a brand of SDTC Solutions Ltd

Discover how services depend on cryptography

The question is broader than which algorithms appear on an endpoint. A useful inventory connects a business service to its protocols, certificates, libraries, keys, devices and supplier dependencies.

Use several evidence sources

Authorised network observation can reveal exposed protocols and certificates. Asset and certificate exports add context. Software inventories, build evidence and supplier documentation help identify dependencies that a network scan cannot see.

An observation is bounded by its method, permissions and time. A public TLS scan does not reveal all encryption at rest, internal traffic or embedded firmware.

Include equipment that cannot be actively scanned

Printers, production machinery and embedded controllers may require supplier-supported exports, firmware analysis or passive observation. Agree access, operational constraints and the collection method with the asset owner. There is no universal USB device that can safely read every machine.

Where direct collection is unavailable, retain the asset and its evidence gap in the inventory. Assign a next action such as requesting a software bill of materials or confirming a vendor upgrade route.

Deliver a maintainable baseline

A cryptographic bill of materials (CBOM) is one output where supporting evidence exists. The wider inventory also needs ownership, provenance, freshness, service relationships and unresolved questions. Refresh it as systems and suppliers change.

Continue exploring

PQC glossary: terminology and standards explained