# QCAI post-quantum security glossary

These are QCAI working definitions, with references for context.

## Post-quantum cryptography (PQC)

Cryptographic methods designed to resist attacks by both classical and quantum computers. They run on ordinary computers; they do not require a quantum computer.

Original reference: https://www.nist.gov/pqc

[Practical guide](https://www.quantumcomputing.ai/academy/lesson/what-is-post-quantum-cryptography)

## Cryptography inventory

A record of cryptographic components, where they are used, and their dependencies. Its coverage depends on the discovery methods and systems included.

Original reference: https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc

[Practical guide](https://www.quantumcomputing.ai/blog/post-quantum-readiness-start-with-inventory)

## Cryptography Bill of Materials (CBOM)

A structured inventory of cryptographic assets and their relationships. CycloneDX can represent algorithms, keys, certificates and relationships to software components.

Original reference: https://cyclonedx.org/capabilities/cbom/

[Practical guide](https://www.quantumcomputing.ai/blog/what-a-cryptography-inventory-can-tell-you)

## Cryptographic agility

The ability to change cryptographic algorithms and implementations as requirements evolve. It involves architecture, dependencies, configuration and testing, rather than a single replacement algorithm.

Original reference: https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc

[Practical guide](https://www.quantumcomputing.ai/academy/lesson/planning-a-quantum-safe-migration)

## Post-quantum migration plan

A working plan that connects cryptographic discovery to owners, dependencies, implementation choices, pilot tests and rollout checks. A draft plan still needs technical approval.

Original reference: https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc

[Practical guide](https://www.quantumcomputing.ai/blog/build-a-post-quantum-migration-plan)

## Source-level observation

An indication that a selected cryptographic pattern appears in source code. It does not by itself establish production use, exploitability or whether a whole system is quantum-safe.

[Practical guide](https://www.quantumcomputing.ai/demo)

Canonical page: https://www.quantumcomputing.ai/glossary