You can't migrate what you can't see. Before transitioning any system to post-quantum encryption, you need a complete inventory of where cryptography is used in your infrastructure. This template provides a structured approach to catalog cryptographic dependencies across your environment, helping you prioritize migration work to meet the 2030 federal deadline.
The G7 cybersecurity working group recently warned that organizations "can no longer afford to postpone" transitioning to post-quantum cryptography. The Trump administration moved federal PQC migration timelines from 2035 to 2030. Google and other industry leaders set their own timelines for 2029. If you're a defense contractor handling Controlled Unclassified Information or bidding on contracts requiring CMMC Level 2 certification, you're on the same timeline.
This isn't a distant problem. The quantum threat includes "harvest now, decrypt later" attacks happening today against encrypted data with long classification lifespans. Your CUI, ITAR-controlled technical data, and authentication mechanisms are at risk.
What This Template Does
This checklist helps you inventory every place your organization uses cryptographic functions. You'll identify systems relying on vulnerable public key encryption, document their business criticality, and establish a foundation for migration planning. The template covers five categories: authentication systems, data protection mechanisms, communications channels, code signing infrastructure, and third-party dependencies.
Use this inventory to support your Risk Management Framework documentation, implement NIST SP 800-171 control SC-13 (Cryptographic Protection), and demonstrate crypto-agility planning to assessors.
Prerequisites
Before you start:
- Access rights: Read access to network diagrams, system security plans, and configuration management databases
- Stakeholder involvement: IT operations, application owners, and security teams must participate
- Tool access: Network scanning tools, certificate management platforms, and asset inventory systems
- Baseline knowledge: Familiarity with X.509 Certificates, Public Key Infrastructure, and symmetric vs. asymmetric encryption concepts
You don't need to be a cryptographer. You need to know where to look and what questions to ask.
The Crypto Inventory Checklist
Copy this template into a spreadsheet. Add one row per cryptographic system or function.
Column A: System/Service Name
The application, service, or infrastructure component (e.g., "VPN concentrator," "email gateway," "code signing server")
Column B: Cryptographic Function
What cryptographic operation happens here?
- Authentication (user/device/service)
- Encryption at rest
- Encryption in transit
- Digital signatures
- Key exchange
- Certificate issuance/validation
Column C: Algorithm in Use
Document the specific algorithm: RSA-2048, ECDSA P-256, AES-256, etc. Check configuration files, certificate details, or vendor documentation.
Column D: Quantum Vulnerability
Mark "High" for RSA, ECDH, ECDSA, or DSA. Mark "Low" for symmetric algorithms like AES. Mark "Unknown" if you can't determine the algorithm.
Column E: Data Classification
What sensitivity level does this system protect? CUI Basic, ITAR-controlled, proprietary, or public? This drives prioritization.
Column F: Business Criticality
Rate impact if this system fails: Mission-critical, High, Medium, Low. Consider authentication dependencies, data access paths, and operational continuity.
Column G: Vendor/Internal
Is this your infrastructure or a third-party service? For vendors, you'll need their PQC roadmap.
Column H: Migration Complexity
Estimate effort: Simple (config change), Moderate (software update required), Complex (hardware replacement or architecture redesign needed)
Column I: Compliance Requirement
Which frameworks require crypto protection here? NIST SP 800-171 SC-13, FIPS 140-2 validation, DFARS 252.204-7012, FedRAMP controls SC-12/SC-13/SC-17
Column J: Notes/Dependencies
Capture dependencies, vendor support status, or integration constraints
How to Customize It
For CMMC-focused contractors: Add a column mapping each system to CMMC 2.0 practices. SC.3.177 through SC.3.191 cover cryptographic mechanisms. Your Third-Party Assessment Organization will want to see this mapping during Level 2 assessments.
For FedRAMP cloud providers: Expand Column I to reference specific baseline controls from NIST SP 800-53 Rev 5. Include SC-12 (Cryptographic Key Establishment and Management), SC-13 (Cryptographic Protection), and SC-17 (Public Key Infrastructure Certificates). Document your Customer Responsibility Matrix entries for cryptographic functions.
For classified systems: Add columns for Committee on National Security Systems Instruction No. 1253 requirements and Type 1 Encryption dependencies. If you're using Commercial Solutions for Classified programs, note which components fall under National Security Agency oversight.
For software development teams: Create a separate section for your Software Bill of Materials. Document cryptographic libraries, their versions, and upgrade paths. Track dependencies in third-party components that may not support post-quantum algorithms yet.
Validation Steps
Step 1: Cross-check against network scans
Run SSL/TLS scanning tools against your external and internal endpoints. Compare discovered certificates and cipher suites against your inventory. Any gaps indicate shadow IT or undocumented systems.
Step 2: Review with system owners
Walk through the inventory with application owners and infrastructure teams. They'll catch edge cases: legacy integrations, vendor APIs, or embedded systems you missed.
Step 3: Validate vendor roadmaps
For every third-party service marked "High" quantum vulnerability, request the vendor's PQC migration timeline. If they can't provide one by mid-2025, you have a supply chain risk.
Step 4: Prioritize by threat model
Sort your inventory by data classification and business criticality. Systems protecting CUI with long retention periods (think: technical drawings, personnel records, or contract data) go to the top of your migration queue. Authentication systems come next because compromised credentials affect everything downstream.
Step 5: Map to your System Security Plan
Every cryptographic control in NIST SP 800-171 or your FedRAMP baseline should map to at least one row in this inventory. If you documented SC-13 implementation but can't point to the actual systems, your assessor will issue a finding.
What Comes Next
This inventory isn't a one-time exercise. Update it quarterly as you deploy new systems, renew certificates, or migrate services. When NIST publishes additional post-quantum algorithm standards or when quantum computing capabilities advance, you'll need to reassess the "Quantum Vulnerability" column.
The G7 working group emphasized that PQC transition "can only be achieved with early engagement, coordinated planning and informed decision making." This checklist gives you the coordinated planning foundation. You can't make informed decisions about migration timelines, budget allocation, or vendor selection until you know what you're protecting and how you're protecting it today.
Start filling out this template this week. By the time NIST finalizes the next round of post-quantum standards, you'll know exactly which systems need attention and in what order.
