The program
Cryptographic inventory comes first
You cannot prioritize, fund, or migrate what you cannot see — a credible inventory is the first deliverable of any program, not a side task.
6 min read · 6 min 21 sec film
What you'll be able to do
- Explain why a cryptographic inventory has to exist before prioritization or funding conversations are credible.
- List what a credible inventory actually contains.
- Identify the organizational reasons inventories are usually incomplete.
Lesson film
Watch: Cryptographic inventory comes first
Skipping the inventory does not skip the work — it moves the discovery into the middle of the migration, where it costs more and shows.
6 min 21 sec · 8 scenes
6 min 21 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
Every later decision in this course depends on one thing existing first.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. Everything depends on it
2. What rests on it
3. Why they are incomplete
4. What a credible one has
5. One entry, read properly
6. "The inventory is complete"
7. Never finished
8. Takeaway
The written lesson
Every later decision in this course — what to migrate first, how much it costs, who owns each piece — depends on knowing what cryptography the organization actually has, where it lives, and who is responsible for it. Skipping the inventory does not skip the work; it just moves the discovery into the middle of the migration, where it is more expensive and more visible.
- Cryptography is buried in dependencies. A library a team imported chose the algorithm, and the person who added it may have moved on.
- Third parties and vendors carry cryptography the organization does not control and often cannot see: a SaaS integration, a managed service, a hardware appliance.
- Protocol and certificate constraints, such as message size limits and certificate chain length, mean some systems cannot simply drop in a new algorithm without a broader change.
- Ownership is unclear. A ten-year-old service may have no team that considers it theirs.
| What a credible inventory contains | The question it answers |
|---|---|
| Systems, protocols, and libraries in use | What cryptography exists, and where? |
| Certificates and key material, and where each is issued and renewed | What expires, and who is notified? |
| Third-party and vendor cryptography the organization depends on but does not control | What is out of your hands, and who is asking the vendor? |
| Data classification linked to each flow or store | What does the confidentiality lifetime look like, per the previous lesson? |
| A named owner for every entry | Who answers when this item comes up in a review? |
An inventory is never finished. Treat the inventory is complete as a claim to interrogate, not a milestone to celebrate: new code, new vendors, and new acquisitions add to it continuously.
A useful inventory row includes the asset and owner, data purpose, cryptographic operation, algorithm and parameter set, where keys live, relevant protocol hops, vendor dependencies, evidence source and date, and current uncertainty. Coverage needs a denominator: discovered entries divided by systems or flows the organization expects to cover. “Complete” without a defined population is not a useful metric.
Work it through
Challenge an inventory claim
A unit says “100% complete” based on 80 application rows. Its estate list has 95 applications, seven managed appliances, and six vendor flows; 18 rows have no owner or evidence date.
About 5 min of unscored practice
Your task
- State what the 80-row claim actually measures.
- Choose two gap-closing actions and a defensible denominator.
Type here or copy the template. Your response stays in this page and is not submitted or scored.
Reveal model response and self-check rubric
A different answer can be sound when it states its assumptions and follows the evidence.
The inventory contains 80 application rows, not complete coverage of the 95 known applications, seven appliances, and six vendor flows. At least 28 known assets/flows are absent if categories do not overlap, and 18 of the 80 recorded rows lack basic ownership or freshness. Reconcile the estate list, assign owners for missing and stale rows, and ask the vendors for current cryptographic evidence. Report both inventory presence and verified evidence coverage.
Self-check
For each point: 0 = absent or incorrect, 1 = partly supported, 2 = well supported.
- Use a stated population and avoid calling row count coverage.
- Identify both absent assets and weak recorded evidence.
- Give owned, feasible closure actions.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- TR 104 016: A Repeatable Framework for Quantum-Safe MigrationsETSI · Published technical report · checked 2026-09-26
- CSWP 39-upd1: Considerations for Achieving Crypto AgilityNIST · Updated guidance; supersedes CSWP 39 · checked 2026-09-26
Marking a lesson complete only updates this browser.