Inventory the cryptography
List the cryptography before anyone claims it has moved.
What can go wrong
A TLS scan treated as the whole estate misses what the scanner cannot see. The list then looks finished when it is not.
A stronger practice
The CISA, NSA, and NIST fact sheet, as of 17 August 2023, says discovery tools may not identify embedded cryptography inside products, and tells organisations to ask vendors for those lists. It also says the inventory should cover network protocols, assets on end-user systems and servers (including firmware and software updates), and cryptographic dependencies in the build pipeline, and should estimate how long the most sensitive datasets need protection.
The UK NCSC timelines, modified 3 August 2026, say the early list is not a formal asset register: understand the nature of each system, quantify the scale, capture version and patch level where you have it, and identify dependencies.
NIST SP 1800-38 is still a 2023 preliminary draft. Volume B is the discovery practice in that draft, not a finished standard.
Vista Security, a vendor blog of 13 October 2026, sizes a small-staff inventory to four questions for each system that handles sensitive data or an external connection: what key-establishment and signature algorithms it uses, who controls the software, how long the data must stay confidential, and when the platform or contract renews. That blog is a sizing, not an authority.
What to ask
For each system that handles sensitive data or an external connection: what key-establishment algorithm and what signature algorithm are in use, who controls the software, how long the data must stay confidential, and when the platform or contract renews? What can a scan not see, and which vendor will you ask?
Evidence
The list itself: the systems, the algorithms, the owner, the secrecy life, the renewal, and a mark on what a scan cannot see. The questions are written out on Inventory questions.
A weak answer
"Our scanner found no issues."
A stronger answer
"We listed the systems, the algorithms, the owner, the secrecy life, and the renewal, and we marked what a scan cannot see."
Which pass
This is the first pass.
Options
No algorithm is chosen on the inventory. Priority orders the list. Vendor plan is how you ask for what a scan cannot see.
Sources
- CISA, NSA, and NIST, Quantum-Readiness fact sheet, as of 17 August 2023. Fact sheet
- UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines
- NIST SP 1800-38B preliminary draft, December 2023. Volume B
- Vista Security, a vendor blog, 13 October 2026. Vendor blog