Discover
Find cryptographic assets, certificates, keys, algorithms, protocols and embedded dependencies.
The challenge
Cryptography is everywhere. Visibility often is not.
Cryptography protects identities, applications, APIs, infrastructure, transactions, data and communications. Yet it is often distributed across platforms, products, libraries, certificates, keys and third parties with no single view of the full dependency landscape.
When algorithms weaken, standards change, certificates fail or quantum-safe migration becomes necessary, organisations need more than a list of assets. They need ownership, context, prioritisation and the ability to change safely.
A continuous capability
The cryptography resilience journey
Resilience is not a one-time migration project. It is a repeatable operating capability that connects visibility, risk, governance and transformation.
Understand
Add business context, ownership, data sensitivity, exposure and dependency relationships.
Govern
Define policy, standards, accountability, lifecycle controls, exceptions and risk decisions.
Transform
Prioritise remediation, modernise weak cryptography and design for safe, repeatable change.
Resilience
Continuously adapt as technologies, threats, standards and organisational dependencies evolve.
Knowledge areas
Build the foundations before the next migration.
Cryptographic resilience sits at the intersection of technology, governance, architecture and risk. These are the core areas this project explores.
01
Cryptographic Discovery
Inventory cryptographic assets and reveal where cryptography is embedded across the organisation.
Explore topic →02
Dependency Mapping
Understand what systems, services, data flows and business processes depend on each cryptographic mechanism.
Explore topic →03
Cryptography Governance
Establish ownership, policies, standards, decision rights, risk acceptance and lifecycle oversight.
Explore topic →04
Crypto-Agility
Design systems and processes so algorithms, keys and protocols can be replaced without uncontrolled disruption.
Explore topic →05
PKI & Certificates
Connect certificate lifecycle management, trust models and PKI dependencies to the broader resilience strategy.
Explore topic →06
Key Management
Understand how key generation, storage, rotation, access, backup and destruction shape cryptographic risk.
Explore topic →07
Third-Party Dependencies
Identify cryptographic risk inherited through vendors, platforms, libraries, SaaS and supply-chain dependencies.
Explore topic →08
Quantum Readiness
Prepare for post-quantum migration by understanding exposure, prioritising dependencies and building the ability to change.
Explore topic →Free · 5–7 minutes
How ready are you to change the cryptography you depend on?
The Cryptography Governance Readiness Check uses 18 questions across six dimensions to surface the gaps that can make future cryptographic change difficult — before they become migration blockers.
✓ A visual readiness profile across six governance dimensions✓ Personalised prompts based on your weakest readiness signals✓ No registration, company details or technical artefacts required
Take the Readiness Check →Not another compliance questionnaire.
The questions are designed to make you think about what your organisation could actually identify, own and change if cryptography became unacceptable tomorrow.
Quantum readiness is a governance problem before it becomes a migration problem.
Quantum transition
Post-quantum migration is not just an algorithm swap.
Replacing a vulnerable algorithm is only the visible part of the challenge. Organisations first need to know where vulnerable cryptography exists, what depends on it, who owns it, which data requires long-term protection and how change can be coordinated across technology estates and suppliers.
Quantum readiness therefore becomes a test of cryptographic visibility, governance and agility — and a powerful driver for building resilience now.
The core question
How quickly could your organisation identify and safely replace a cryptographic dependency that became unacceptable tomorrow?
Operating model
Cryptographic resilience is a team sport.
No single security function can solve it alone. Sustainable resilience depends on coordinated ownership across technical, risk and business teams.
Information SecurityEnterprise ArchitecturePKIIdentity & AccessApplication DevelopmentInfrastructureCloudRisk & ComplianceProcurementThird-Party RiskData ProtectionBusiness Owners
Methodology
Technically accurate. Risk-focused. Decision-oriented.
The knowledge base is written for Information Security Risk Management and adjacent security-governance audiences. Technical depth is included when it changes a risk decision, while source material is prioritised from authoritative public standards and guidance.
Standards & resources
Grounded in public standards and technical guidance.
This project connects practical cryptography governance to authoritative public sources including NIST, ENISA, IETF and other relevant standards bodies and primary technical guidance. Source references are included throughout the knowledge base.