Compliance guides

A cryptographic inventory is a complete, current map of every algorithm, key, certificate, protocol, and library in your estate, plus where each is used and what data it protects. Why it is the mandatory first step of any PQC migration, how to build one, and how CBOM keeps it alive instead of stale.

How to turn a cryptographic inventory into a prioritized, deadline-aware migration plan: the five phases, how to sequence by data shelf life rather than by ease, and how to roll out hybrids without breaking production.

Passing NIST's ACVP known-answer vectors, conforming to FIPS 203/204/205, and passing a security audit are three different things. What the KATs miss, how conformance testing actually works, and why an audited, popular library is not evidence of conformance.

A post-quantum readiness assessment is a breadth-first evaluation of how prepared your organization is to migrate, turning a vague sense of quantum risk into a scored, prioritized baseline. What it evaluates, how it differs from a full technical audit, and what you get out of it.

The concrete checks a conformant ML-KEM implementation must pass: §7.2/§7.3 input validation, implicit rejection, exact sizes and encoding, versioning and adversarial vectors, as a checklist you can run against any library.

"ACVP-tested," "conformant," and "FIPS 140-3 validated" are three different claims that answer three different questions. What each one covers, what it silently leaves out, and how to ask which axis a vendor's assurance really lives on.

Regulators publish dated deadlines for retiring classical cryptography; most CI gates only catch new findings. How a policy-as-code mandate gate evaluates your whole estate against CNSA 2.0 or NIST IR 8547's calendar (warning after the deprecate date, failing after the disallow date), and why a regulatory deadline cannot be baselined away.