Start with a record of where cryptography is used, what it protects, and which systems and suppliers depend on it—not just a list of algorithms. Combine automated discovery with configuration, code, certificate, network, architecture, and vendor evidence; validate findings with system owners; then rank the dependencies by risk and migration difficulty. Treat the inventory as a maintained risk-management asset, not a one-time scan or proof of complete visibility.
What a cryptographic inventory needs to show
NIST’s National Cybersecurity Center of Excellence (NCCoE) describes a cryptographic inventory as a record of cryptography used across an organization’s systems, applications, services, devices, and data flows. For post-quantum migration, the useful unit is not simply an algorithm entry: it is a dependency with enough context to identify what uses cryptography, why it is used, what it protects, and who can validate or change it. NIST’s migration project treats discovery and inventory as a starting point alongside work on interoperability.
- Mechanism and purpose: record public-key algorithms as well as symmetric algorithms and hash functions, and note whether they support encryption, authentication, key establishment, signing, or another function.
- Where it is used: identify the protocol or service—such as TLS, SSH, VPN, code signing, encrypted email, or certificate-based authentication—and the application, service, library, hardware security module, device, or component involved.
- Certificates and key metadata: record relevant certificates and chains, plus key type, associated algorithm, owner, application, expiration, and lifecycle status. Store metadata, not secret key material.
- Dependencies and accountability: connect the finding to the system and component that rely on it, and name the system owner and any relevant supplier.
- What is protected: describe the data or process, its sensitivity, and how long confidentiality or integrity must be preserved.
- Evidence: note where the observation came from and how confident the team is in it—for example, a scan, configuration review, code inspection, or owner confirmation.
NIST’s cryptographic inventory guidance emphasizes the breadth of systems and uses to cover. Linking mechanism, purpose, owner, dependencies, and protected data turns a raw finding into something a migration team can act on. The same record can also support cryptographic policy, response to algorithm weaknesses, and technology changes such as cloud migration.
How to find where your organization uses cryptography
No single discovery route should be treated as complete. NIST’s draft discovery guidance describes a multifaceted approach and tool testing, while the NCCoE migration project separates visibility and risk management from interoperability and benchmarking. Use discovery methods that match the environment, then reconcile their evidence.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- COMPATIBILITY: Compatible with TPM-SPI
- SECURE CHIP: Using Infineon SLB9670 Implements TPM 2.0 specification for hardware-based security and cryptographic operations
- INTERFACE TYPE: only SPI (Serial Peripheral Interface), not compatible with LPC (Low Pin Count) headers.
- FUNCTIONALITY: Enables Windows 11 security features including BitLocker drive encryption and secure boot capabilities
- Installation: Please also check the TPM header pin definition, not just the pin count, in your motherboard’s user manual or on the manufacturer’s official website to ensure it matches this module’s layout before purchasing. You can verify compatibility by comparing your motherboard’s TPM pinout with the layout shown in Product Image 3.
- Set scope and owners. Include enterprise IT and, where relevant, operational technology (OT), applications, infrastructure, externally exposed services, devices, and supplier-provided products. Assign system and data owners to confirm results and explain operational dependencies.
- Inspect reachable services. Use appropriate network and service discovery to identify cryptographic protocols and exposed endpoints. Record what was actually observed, the inspection conditions, and any assets the method could not reach.
- Review configurations and certificates. Examine relevant platform, application, device, and security-service configurations, as well as certificate stores and chains. Tie each result to the service and system that use it.
- Inspect code and build paths. Where feasible, search application code, dependencies, build pipelines, and signing workflows for cryptographic libraries and use. Include software and firmware signing, not only data encryption.
- Gather architecture and asset evidence. Compare diagrams, service catalogs, asset and configuration records, and known data flows against scan and code findings. Look for cryptography in managed services, appliances, embedded devices, and shared components.
- Ask suppliers and validate with owners. Have vendors explain cryptography embedded in products, cloud services, firmware, and update mechanisms. Ask internal owners to confirm what a tool found and identify uses it could not inspect.
- Reconcile evidence and track gaps. Link duplicate observations to one dependency where appropriate, preserve their sources, and mark unknowns or unverified claims. An empty scanner result is not evidence that an asset contains no cryptography.
The joint CISA, NSA, and NIST quantum-readiness fact sheet calls for IT and OT procurement experts to lead supply-chain vendor engagement. That makes procurement part of discovery: buyers can request product-level cryptographic information and migration support rather than waiting until a deployment is already a blocker.
Tools that can help—and how to evaluate them
NIST’s NCCoE FAQ, last updated June 30, 2026, lists examples of tools and resources, while explicitly noting that its list is not exhaustive and directing readers to tool sites for capabilities. Examples are not NIST endorsements, and no tool should be assumed to produce a complete organization-wide inventory on its own. Check current capabilities and scope with the tool provider.
| Example | Use described by NIST NCCoE |
|---|---|
| pqcscan | Open-source scanning for SSH and TLS servers. |
| sslscan | Open-source SSL/TLS cipher-suite testing. |
| crt.sh | Open-source search for certificates issued for a domain or organization. |
| cyberzero PQC Edge Scanner | Open-source tool for PQC transition signals at the public edge. |
| SandboxAQ AQtive Guard; Data-Warehouse PCert; Keyfactor AgileSec; Cisco Mercury; Tychon Cryptographic Inventory | Collaborator tools listed by NIST NCCoE; the FAQ directs readers to tool sites for capabilities. |
| CodeQL | Listed with related material for code scanning. |
| PQC Coalition Inventory Workbook | Starting point for tracking migration efforts, as noted in the NCCoE FAQ. |
When comparing tools, evaluate fit to your environment rather than choosing by name. NIST’s list does not provide comparative performance results or establish a winner. Useful questions include:
- Which environments and asset types can the tool inspect, including OT, cloud services, endpoints, appliances, and embedded systems?
- Which protocols, algorithms, code patterns, libraries, and cryptographic components does it detect?
- Does it export the context needed to identify purpose, owner, dependencies, certificates, and protected data, or only raw observations?
- Can it connect findings to existing asset or configuration-management records?
- How can system owners and suppliers validate findings, and can the workflow record unresolved gaps?
- What are its stated access, coverage, and inspection limits?
How to prioritize dependencies for PQC migration
Inventory is the input to prioritization, not a migration order by itself. NIST explains that quantum computers could undermine public-key algorithms such as RSA and elliptic-curve cryptography. Data intercepted now may be retained for later decryption, so confidentiality that must last a long time can require attention before a cryptographically relevant quantum computer exists. Signature use matters too: compromised signing and validation paths can affect the trustworthiness of software and firmware updates.
Rank #3
- RESERVED MEMORY: Simple to install and use, some motherboards require the TPM module to be connected or updated to the latest BIOS to enable the TPM option. Standard PC architectures reserve a certain amount of memory for system use.
- ENCRYPTION KEY: The TPM 2.0 module can use an encryption key created by encryption software (e.g. forfor BitLocker). Without this key, the contents of the user's PC will remain encrypted and protected from unauthorized access.
- STAND-ALONE CRYPTOGRAPHY PROCESSOR: The TPM 2.0 Encryption Security Module is a stand-alone cryptographic processor connected to a daughter card connected to the motherboard.
- SPI INTERFACE: 12‑1 pin TPM security module supports memory types greater than DDR3, SPI interface, support10 11.
- SUPPORTED MOTHERBOARDS: The TPM module supports MSI motherboards for Intel 400, 500,600 and 700 series motherboards, MSI A520,B550,WRX80,X570S,B650 and X670 series motherboards.
Assess each dependency across the following dimensions, then discuss proposed urgency and constraints with its system owner, security team, and supplier:
| Dimension | Questions to answer | Why it changes priority |
|---|---|---|
| Protected data and lifetime | How sensitive is the information, and how long must it remain confidential? | Long-lived sensitive data raises concern about harvest-now, decrypt-later exposure. |
| Public-key exposure and function | Does the dependency use a quantum-vulnerable public-key algorithm? Is it used for key establishment, authentication, or signatures? | Identifies the cryptographic use that may need replacement and whether confidentiality, integrity, or both are at stake. |
| Operational consequence | What happens if the system, service, or trust path fails or cannot interoperate? | Helps distinguish high-impact business or OT dependencies from lower-consequence uses. |
| Migration constraints | Can the component be updated independently? Does it depend on a vendor roadmap, hardware replacement, protocol changes, or coordination with other systems? | Surfaces work that needs early supplier engagement, testing, or long lead times. |
NIST encourages organizations to begin transitioning to its first three finalized PQC standards, released in 2024; its migration FAQ recommends discovery and inventory as a good place to start. NIST IR 8547 is an initial public draft transition report, not a final requirement. Treat its transition discussion as draft guidance rather than a mandate. Inventory findings identify candidate changes; the NCCoE project’s separate interoperability and benchmarking work helps teams examine compatibility before production deployment.
Rank #4
- COMPATIBILITY: Compatible with TPM2-S
- SECURE CHIP: Using Infineon SLB9665 Implements TPM 2.0 specification for hardware-based security and cryptographic operations
- Interface Type: only LPC (Low Pin Count), not compatible with SPI (Serial Peripheral Interface) headers.
- Functionality: Enables Windows 11 security features including BitLocker drive encryption and secure boot capabilities
- Installation: Please also check the TPM header pin definition, not just the pin count, in your motherboard’s user manual or on the manufacturer’s official website to ensure it matches this module’s layout before purchasing. You can verify compatibility by comparing your motherboard’s TPM pinout with the layout shown in Product Image 3.
Keep the inventory useful as systems change
There is no universal inventory schema, scoring formula, or review cadence established by the cited NIST materials. Choose fields and update triggers that fit your environment, and make the record part of normal change and risk processes. Revisit affected entries when systems, applications, certificates, suppliers, services, or data flows change; investigate stale or unowned records rather than treating them as settled facts.
- Give each dependency an accountable owner and a status such as confirmed, inferred, or unresolved.
- Preserve the evidence source and relevant scope limits so later readers can judge what a finding actually establishes.
- Connect priority decisions to the data lifetime, public-key use, operational impact, and migration constraints recorded for that dependency.
- Use procurement and supplier reviews to capture cryptography and update-path information for new or changing products.
- Keep migration tracking linked to the inventory so completed changes and remaining dependencies can be distinguished.
This approach keeps the record useful beyond PQC: it can inform cryptographic risk decisions as technology and supplier relationships evolve.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
