Crypto Bill of Materials: A 90-Day Plan 2026

Executive summary — You cannot migrate cryptography you cannot see. A crypto bill of materials is the inventory that makes post-quantum migration possible. This article lays out a 90-day plan to build a crypto bill of materials: the scope, the tools, the deliverables, and how it feeds certificate lifecycle management.

Every serious post-quantum migration plan begins with the same uncomfortable admission: most organisations do not know where they use cryptography. Algorithms are embedded in applications, libraries, certificates, protocols, hardware modules, and third-party services accumulated over decades. A crypto bill of materials, or C-BOM, is the structured inventory that answers the foundational question, what cryptography do we use, where, and for what, without which prioritisation is guesswork. A focused 90-day effort is enough to build a credible first version.

Days 1 to 30: Scope and Discovery

The first month establishes boundaries and begins automated discovery. Scope should be defined by risk: start with systems handling sensitive or long-lived data, external-facing services, and anything subject to harvest-now-decrypt-later exposure, where encrypted data captured today could be decrypted by a future quantum computer. Discovery then combines several sources: scanning network services to fingerprint the protocols and cipher suites in use, integrating with certificate stores and CLM tooling to pull certificate and key details, analysing application dependencies and libraries, and querying cloud and hardware security modules. The output of month one is breadth, a first pass across the estate rather than depth in any one system.

Days 31 to 60: Enrich and Assess

The second month turns raw findings into an assessable inventory. Each cryptographic asset is enriched with the attributes that drive decisions: algorithm and key length, the certificate or key it relates to, the system and business process it supports, the data sensitivity, and the expected lifetime of the protected data. This is where the C-BOM connects directly to certificate lifecycle management, because the certificate inventory is often the richest and most authoritative source of cryptographic truth already available. Assets are then assessed for quantum vulnerability, separating the algorithms that must change from those that are already resilient.

Ready to map your cryptographic estate? eMudhra post-quantum cryptography helps enterprises build a C-BOM and drive prioritised, crypto-agile migration from discovery through replacement.

Days 61 to 90: Prioritise and Plan

The final month converts the inventory into a migration roadmap. Assets are ranked by a combination of quantum vulnerability, data lifetime, and business criticality, so the systems protecting the most sensitive long-lived data move first. The deliverable is not just a list but a prioritised plan with owners, sequencing, and dependencies, grounded in the finalised NIST algorithms explained in NIST PQC standards. A crucial principle here is crypto-agility: the plan should favour architectures that allow algorithms to be swapped without re-engineering, because the standards themselves will evolve and no migration is ever truly final.

Deliverables and Ownership

A well-run 90-day effort produces four durable deliverables: a maintained C-BOM inventory, a quantum-risk assessment mapped to business impact, a prioritised migration roadmap, and a governance model assigning ongoing ownership. The last matters most. A C-BOM is not a one-time report; it is a living asset that must be updated as systems change, which is why it belongs alongside certificate and identity inventories rather than in a static document. The overarching context for all of this is post-quantum cryptography, the strategic reason the inventory exists.

Turning Discovery Into Momentum

The value of a C-BOM is that it replaces anxiety with a plan. Instead of a vague sense that quantum computing is a distant threat, leadership gets a concrete picture of exposure and a sequenced path to address it. Organisations choosing tooling and partners to sustain this should evaluate certificate-authority readiness through a quantum-ready CA comparison, ensuring the platforms that issue and manage cryptography can support quantum-safe algorithms as the migration proceeds.

START YOUR QUANTUM-READINESS INVENTORY
eMudhra helps enterprises build a C-BOM and execute prioritised, crypto-agile migration. Explore eMudhra post-quantum cryptography or talk to the eMudhra team.