Discover
Find cryptographic assets, certificates, keys, algorithms, protocols and embedded dependencies.
The challenge
Cryptography is everywhere. Visibility often is not.
Cryptography protects identities, applications, APIs, infrastructure, transactions, data and communications. Yet it is often distributed across platforms, products, libraries, certificates, keys and third parties with no single view of the full dependency landscape.
When algorithms weaken, standards change, certificates fail or quantum-safe migration becomes necessary, organisations need more than a list of assets. They need ownership, context, prioritisation and the ability to change safely.
A continuous capability
The cryptography resilience journey
Resilience is not a one-time migration project. It is a repeatable operating capability that connects visibility, risk, governance and transformation.
Understand
Add business context, ownership, data sensitivity, exposure and dependency relationships.
Govern
Define policy, standards, accountability, lifecycle controls, exceptions and risk decisions.
Transform
Prioritise remediation, modernise weak cryptography and design for safe, repeatable change.
Resilience
Continuously adapt as technologies, threats, standards and organisational dependencies evolve.
Knowledge areas
Build the foundations before the next migration.
Cryptographic resilience sits at the intersection of technology, governance, architecture and risk. These are the core areas this project will explore.
01
Cryptographic Discovery
Inventory cryptographic assets and reveal where cryptography is embedded across the organisation.
Explore topic →02
Dependency Mapping
Understand what systems, services, data flows and business processes depend on each cryptographic mechanism.
Explore topic →03
Cryptography Governance
Establish ownership, policies, standards, decision rights, risk acceptance and lifecycle oversight.
Explore topic →04
Crypto-Agility
Design systems and processes so algorithms, keys and protocols can be replaced without uncontrolled disruption.
Explore topic →05
PKI & Certificates
Connect certificate lifecycle management, trust models and PKI dependencies to the broader resilience strategy.
Explore topic →06
Key Management
Understand how key generation, storage, rotation, access, backup and destruction shape cryptographic risk.
Explore topic →07
Third-Party Dependencies
Identify cryptographic risk inherited through vendors, platforms, libraries, SaaS and supply-chain dependencies.
Explore topic →08
Quantum Readiness
Prepare for post-quantum migration by understanding exposure, prioritising dependencies and building the ability to change.
Explore topic →Quantum transition
Post-quantum migration is not just an algorithm swap.
Replacing a vulnerable algorithm is only the visible part of the challenge. Organisations first need to know where vulnerable cryptography exists, what depends on it, who owns it, which data requires long-term protection and how change can be coordinated across technology estates and suppliers.
Quantum readiness therefore becomes a test of cryptographic visibility, governance and agility — and a powerful driver for building resilience now.
The core question
How quickly could your organisation identify and safely replace a cryptographic dependency that became unacceptable tomorrow?
Operating model
Cryptographic resilience is a team sport.
No single security function can solve it alone. Sustainable resilience depends on coordinated ownership across technical, risk and business teams.
Information SecurityEnterprise ArchitecturePKIIdentity & AccessApplication DevelopmentInfrastructureCloudRisk & ComplianceProcurementThird-Party RiskData ProtectionBusiness Owners
Standards & resources
Grounded in public standards and technical guidance.
This project will connect practical cryptography governance to authoritative public sources including NIST, ENISA, IETF and other relevant standards bodies, research and industry guidance. Source references will be included throughout the knowledge base as content develops.