Finding Your Encryption: A Beginner’s Guide to Cryptographic Inventories

Encryption hides inside websites, mobile apps, databases, VPNs, email servers, payment terminals, cloud services, software libraries, hardware security modules and your suppliers’ products. Most organisations have never written down where it all is, because it usually just works.

A cryptographic inventory is a list of where and how your organisation uses cryptography. For each item, it records things like:

• ◆Which algorithm is used (for example, RSA-2048 or ECDSA P-256).
• ◆Where it is used (which application, server, device or supplier).
• ◆What it protects (customer data, payments, logins, software updates).
• ◆Who owns it, and how easily it can be changed.

When this list is kept in a standard, machine-readable format, it is often called a Cryptography Bill of Materials (CBOM). The open CycloneDX standard added support for CBOMs in version 1.6, released in 2024.

US federal agencies are already required to inventory their quantum-vulnerable cryptography: a 2022 White House memorandum (M-23-02) asks them to submit inventories every year, and the Quantum Computing Cybersecurity Preparedness Act, signed in December 2022, put migration planning into law. The UK NCSC also makes discovery the first milestone, due by 2028.

1. 1Start with what matters most: list the systems that handle your most sensitive and long-lived data.
2. 2Use tools, then check by hand: code scanners, network scanners and certificate tools can find much of your cryptography automatically, but not all of it.
3. 3Ask your suppliers: much of your encryption lives in products you buy. Ask vendors which algorithms they use and when they will support the new standards.
4. 4Rank by risk: combine how sensitive the data is, how long it must stay secret, and how hard the system is to change.
5. 5Keep it up to date: an inventory is a living document, not a one-off project.

Inventories often uncover old algorithms nobody knew were still running, expired certificates, and encryption hard-coded inside legacy applications. Finding these is valuable even before quantum computers arrive, because many are weak today.