If someone asked your team today which systems in your environment rely on RSA, Diffie-Hellman, or the Elliptic Curve Digital Signature Algorithm (ECDSA), how long would it take to answer, and how confident would you be in that answer?
A credible post-quantum cryptography (PQC) transition plan starts with knowing where traditional asymmetric cryptography exists across your environment. The Australian Signals Directorate (ASD) starts there too in its LATICE framework.
A complete cryptographic inventory doesn’t need to exist before you can start making transition decisions. You need enough visibility to make the next decision, then more detail where risk warrants it.
To build a refined transition plan by the end of 2026, you need to start the discovery work earlier. We explain why in Australia’s 2026 post-quantum cryptography milestone: why planning starts now.
Why does ASD put cryptographic inventory first?
ASD’s LATICE framework, which ASD encourages organisations to consider when undertaking their PQC transition, opens with a locate phase: discovering and documenting where traditional asymmetric cryptography is used. The assess and triage phases that follow both draw on that evidence, since you can’t assess the business impact of a system you haven’t identified or prioritise one without knowing it relies on cryptography.
What should a cryptographic inventory tell you?
For an inventory to support transition decisions, it needs to answer four questions, each building on the one before it.
1. What cryptography do we use?
This covers the algorithms, protocols, certificates, and libraries in use; their versions and configurations; and what each is used for, such as digital signatures, authentication, or encrypting data in transit. Those details show whether existing systems can support ASD-approved post-quantum algorithms or whether software, hardware, or other dependencies will need to change.
2. Where does it exist?
Cryptography sits across applications, cloud services, hardware, and operational technology, including embedded or legacy systems that can be difficult to update and tied to long asset lifecycles.
3. What depends on it?
Dependencies include the applications, services and third parties that rely on a given piece of cryptography, and ASD says a refined plan should account for them. Many organisations rely on vendors, managed services and cloud providers that implement and control cryptography on their behalf, so part of the answer sits outside your own team.
A list of algorithms and certificates that leaves out who controls them can look complete and still leave the transition plan exposed.
4. What should change first?
Once you know what you use, where it sits and what depends on it, prioritisation becomes workable. ASD’s triage guidance points to factors such as whether a system handles sensitive or classified data, interacts with external organisations, is bespoke or commodity, or implements standards for legacy interoperability.
What is a cryptographic bill of materials (CBOM)?
A cryptographic bill of materials (CBOM) is an inventory of the cryptographic dependencies and implementations your systems rely on, similar in purpose to a software bill of materials. ASD describes it as an effective way to document those dependencies at both environment and system level. A mature CBOM records each implementation in the context where it’s used, but an early high-level CBOM can be a simple list of critical systems and components mapped to the security functions that rely on cryptography.
An inventory may list thousands of cryptographic assets, but if you can’t connect them to the systems they support, the information they protect, and the dependencies controlling their replacement, it gives you little basis for deciding what should move first.
Does cryptographic visibility have to start with a complete inventory?
Visibility doesn’t need to start with a complete inventory. A transition first needs decision-ready visibility: enough information about a system, where it sits and what depends on it, to decide what should move next. You can build that in layers: an initial baseline, a clear view of where visibility is limited, and progressively more detail as risk is identified.
A complete inventory remains the goal, though not every additional piece of information has the same value at each stage. A useful test for each round of discovery is to ask what additional information would change your decision. That keeps deeper discovery aimed at the gaps that matter most.
Visibility deepens in layers, and transition decisions can start at the first one.
An external assessment looks at the cryptography your environment presents to the internet, including certificates, protocols and cipher suites on public-facing domains and subdomains, and it can be run without agents, credentials or changes to production systems. Those domains build up over the years, and what runs on them is part of your cryptographic estate whether anyone is managing it.
For government organisations that don’t yet have a reliable baseline, we’d treat the external view as a first layer of discovery. It gives you evidence to work from and shows where further investigation may be warranted. It can’t establish internal implementations, dependencies, or vendor-controlled components, which need internal discovery to build a complete inventory.
From there, the path runs through internal discovery and a CBOM to a prioritised transition plan, with each step adding the evidence needed for the next decision.
Build a clearer picture of your cryptographic environment
You don’t need a complete inventory before you can start making PQC transition decisions, but you do need enough evidence to know where to look next.
Together with Venari Security, The Missing Link can help you establish an external view of the cryptography visible across your public-facing environment, identify gaps that need deeper investigation, and build the visibility needed to inform your next steps.
Talk to us about your cryptographic visibility.
