The program
Cryptographic inventory comes first
You cannot prioritize, fund, or migrate what you cannot see — a credible inventory is the first deliverable of any program, not a side task.
5 min read
What you'll be able to do
- Explain why a cryptographic inventory has to exist before prioritization or funding conversations are credible.
- List what a credible inventory actually contains.
- Identify the organizational reasons inventories are usually incomplete.
Every later decision in this course — what to migrate first, how much it costs, who owns each piece — depends on knowing what cryptography the organization actually has, where it lives, and who is responsible for it. Skipping the inventory does not skip the work; it just moves the discovery into the middle of the migration, where it is more expensive and more visible.
- Cryptography is buried in dependencies. A library a team imported chose the algorithm, and the person who added it may have moved on.
- Third parties and vendors carry cryptography the organization does not control and often cannot see: a SaaS integration, a managed service, a hardware appliance.
- Protocol and certificate constraints, such as message size limits and certificate chain length, mean some systems cannot simply drop in a new algorithm without a broader change.
- Ownership is unclear. A ten-year-old service may have no team that considers it theirs.
| What a credible inventory contains | The question it answers |
|---|---|
| Systems, protocols, and libraries in use | What cryptography exists, and where? |
| Certificates and key material, and where each is issued and renewed | What expires, and who is notified? |
| Third-party and vendor cryptography the organization depends on but does not control | What is out of your hands, and who is asking the vendor? |
| Data classification linked to each flow or store | What does the confidentiality lifetime look like, per the previous lesson? |
| A named owner for every entry | Who answers when this item comes up in a review? |
An inventory is never finished. Treat the inventory is complete as a claim to interrogate, not a milestone to celebrate: new code, new vendors, and new acquisitions add to it continuously.
Marking a lesson complete only updates this browser.