Crypto Inventory Template
Excel workbook with inventory fields, dropdowns, risk scoring, priority formulas, readiness checklist, cloud/IAM playbook, OT/ICS checklist, and reference map.
Download XLSX
Hub Home
PQC Readiness Checklist
Cloud/IAM Playbook
SCADA/ICS Checklist
Crypto Agility Assessment
Cloud Identity Checklist
Reference Map
This hub provides public-facing templates and checklists for post-quantum cryptography readiness. It focuses on practical migration preparation: cryptographic inventory, crypto-agility, cloud and IAM dependencies, supplier readiness, and safety-first OT/ICS/SCADA planning.
Recommended starting point: download the workbook, complete the Crypto Inventory sheet for priority systems, then use the playbook and checklists to build a risk-based migration roadmap.
Resource downloads
Templates and checklists for teams building a measured migration path from today’s cryptography to quantum-resistant standards.
PQC Readiness Checklist
Governance, discovery, risk classification, architecture, PKI, cloud/IAM, supplier, testing, operations, and training readiness items.
Open ChecklistCloud/IAM Migration Playbook
Phase-based migration playbook for cloud services, IAM, machine identities, certificates, federation, workload identities, and signing dependencies.
Open PlaybookSCADA/ICS PQC Checklist
Safety-first checklist for OT/ICS/SCADA cryptographic discovery, remote access, vendor roadmaps, testing, compensating controls, and lifecycle planning.
Open OT ChecklistCrypto Agility Assessment
Assessment prompts for algorithm visibility, replacement speed, certificate lifecycle readiness, integration ownership, policy exception handling, and measurable agility.
Open AssessmentCloud Identity Checklist
Identity-focused checklist for Entra ID, federation, SSO, workload identities, token signing, certificate chains, conditional access, and machine-to-machine trust.
Open Identity ChecklistCSV Inventory Template
Lightweight CSV version of the cryptographic inventory fields for teams that want to import data into Power BI, GRC tooling, or migration trackers.
Download CSVReference Map
Mapped guidance areas across NIST post-quantum standards, federal migration expectations, enterprise implementation dependencies, and operational control families.
Open MapReadiness checklist
Prepare the organization before algorithms change
PQC readiness begins with ownership, inventory discipline, and a practical view of where cryptography supports business-critical systems.
- Define migration ownership across security, cloud, IAM, architecture, procurement, legal, and platform teams.
- Identify systems using public key cryptography, certificates, signing, federation, VPN, TLS, SSH, PKI, HSMs, and embedded libraries.
- Classify risk by data sensitivity, system criticality, exposure, cryptographic dependency, vendor control, and migration complexity.
- Track vendor PQC roadmaps and require evidence for supported algorithms, hybrid modes, integration constraints, and lifecycle timelines.
Migration playbook
Move from discovery to controlled transition
A cloud and IAM migration plan should sequence visibility, readiness, testing, staged adoption, and operational monitoring.
1
Inventory and classify
Build a cryptographic dependency map across cloud, identity, workloads, certificates, integrations, and suppliers.
2
Prioritize and design
Rank systems by risk and migration feasibility, then define hybrid, replacement, isolation, or compensating control strategies.
3
Test and stage
Validate PQC-ready libraries, certificates, identity flows, service-to-service trust, logging, rollback, and performance impact.
4
Operate and improve
Track exceptions, vendor readiness, crypto policy drift, certificate lifecycle changes, and migration progress metrics.
SCADA and ICS planning
Operational technology environments need a safety-first migration path that respects uptime, vendor constraints, certification boundaries, and long equipment lifecycles.
Discover cryptographic use
Map remote access, engineering workstations, gateways, historian connections, firmware signing, vendor tunnels, and certificate-based trust.
Control the transition
Use segmentation, jump hosts, access control, compensating monitoring, and tested maintenance windows before touching production control paths.
Plan with vendors
Request PQC roadmaps, upgrade compatibility, performance constraints, validated firmware paths, rollback plans, and support timelines.
Crypto agility
Measure how quickly cryptography can change
Crypto-agility is the operational ability to identify, replace, validate, and govern cryptography without rebuilding entire systems.
- Document algorithms, key sizes, certificates, protocols, libraries, owners, business processes, and renewal timelines.
- Identify hardcoded cryptography, unsupported libraries, vendor-managed trust, custom protocols, and unsupported certificate chains.
- Measure replacement effort by owner availability, integration testing needs, downtime windows, compliance constraints, and rollback complexity.
- Maintain exception records with business justification, expiration dates, compensating controls, and assigned remediation owners.
Cloud identity
Prioritize the trust systems every application depends on
Identity platforms, federation flows, token signing, workload identities, and certificate authorities are high-leverage starting points for PQC readiness.
- Inventory SAML, OIDC, OAuth, token signing certificates, application registrations, enterprise applications, and federation metadata.
- Track workload identities, managed identities, service principals, automation identities, CI/CD credentials, and machine-to-machine trust.
- Review certificate authority chains, renewal automation, key storage, HSM dependencies, signing processes, and rotation ownership.
- Align conditional access, privileged access, logging, incident response, and policy exception workflows with the PQC migration roadmap.
Reference map
Use these source families to align migration work with public standards, agency guidance, and enterprise security control expectations.