Post-quantum readiness starts with an inventory

What does post-quantum readiness mean?

Post-quantum readiness is the work of understanding which systems depend on cryptography affected by future quantum attacks and planning how those systems can change. A scanner can support discovery; it cannot determine readiness on its own.

Start with four questions

1. Where is cryptography used? Look at application code, libraries, certificates, protocols, hardware and services. Source-level scanning covers only part of this picture.
2. What does it protect? Identify the data, signatures, identities and trust relationships involved.
3. How long must that protection last? Data confidentiality and signature verification can have different time horizons.
4. Who can change it? Record application owners, platform teams, vendors and external dependencies.

Keep evidence and assumptions separate

A match for an RSA API does not show whether the code runs in production. Record its location, then ask an owner to confirm its purpose and deployment. Keep unresolved questions visible instead of turning them into a confident score.

Make the next action concrete

Group related observations into workstreams, assign an owner to confirm the scope, and define the evidence needed to choose an approach. NIST’s transition guidance is a useful reference; your architecture and operational constraints still need review.

Your first deliverable: an inventory with evidence, owners, dependencies and open questions. Use it to start a reviewed migration plan, rather than treating it as a certification.