Cryptographic Inventory Register Template
An editable register of every place you use cryptography, one row per use, with the per-system fields from OMB M-23-02 and columns that map to CycloneDX 1.7 cryptoProperties. Record quantum status, the NIST IR 8547 transition, an owner and a migration target, then export it.
Template & sample only — a structured starting point with sample content for a fictional organisation, not legal, audit or compliance advice.
Register preview: a fictional insurer
Eight of the eighteen columns are shown. The full template adds asset ID, data sensitivity, secrecy lifetime, key length, OID, CycloneDX primitive, library or vendor, hosting, IR 8547 transition and owner.
| System / component | Protocol and version | Algorithm | Parameter set / curve | Usage | Quantum status | Migration target | Status |
|---|---|---|---|---|---|---|---|
| Customer portal: TLS key exchange | TLS 1.3 | ECDH (X25519) | X25519 | Key establishment | Quantum-vulnerable | Hybrid X25519MLKEM768 (RFC 10024, codepoint 0x11EC); needs OpenSSL 3.5 or later | Planned |
| Customer portal: server certificate | TLS 1.3 | RSA signature | RSA-2048 | Signature | Quantum-vulnerable | ML-DSA-65 once public CAs and browsers support it (check the source) | Not started |
| SSO identity provider: SAML assertion signing | SAML 2.0 over TLS 1.2 | RSA signature | RSA-2048 | Signature | Quantum-vulnerable | ML-DSA-65 when the vendor supports it; ask for a dated roadmap | Waiting on vendor |
| Internal VPN: site-to-site tunnels | IKEv2 / IPsec | ECDH | secp521r1 | Key establishment | Quantum-vulnerable | Hybrid with ML-KEM per vendor roadmap | Waiting on vendor |
| Claims platform: SFTP to reinsurer | SSH (OpenSSH 10.0) | ML-KEM-768 + X25519 hybrid | mlkem768x25519-sha256 | Key establishment | Hybrid (PQC + classical) | Keep; review for PQC only in the hybrid exit plan | Migrated |
| Desktop agent: code signing | - | RSA signature | RSA-3072 | Signature | Quantum-vulnerable | ML-DSA-65 (FIPS 204) | Pilot |
| Branch routers: firmware signing | - | ECDSA | P-384 | Signature | Quantum-vulnerable | LMS or XMSS (SP 800-208), per vendor roadmap | Waiting on vendor |
| Backup service: data key wrapping | - | RSA key transport (OAEP) | RSA-3072 | Key establishment | Quantum-vulnerable | ML-KEM-768 (FIPS 203) or symmetric key wrapping; re-wrap existing keys | Planned |
4 more rows in the full template. Customise it with your organisation’s details and download it as Word, PDF, Markdown or CSV with Pro.
Machine-readable equivalent: build a CycloneDX 1.7 CBOM with the CBOM generator or open the sample CBOM (JSON).
An editable register of every place your organisation uses cryptography: one row per use, with the per-system fields OMB M-23-02 asks US federal agencies for and columns that map to CycloneDX 1.7 cryptoProperties (protocol, algorithm, parameter set, OID, primitive). Each row records its quantum status, its NIST IR 8547 transition, an owner, a migration target and a status. The summary flags harvest-now-decrypt-later priorities. The sample is a fictional insurer; the machine-readable equivalent is a CBOM.
Your context
How the inventory was built
Register
One row per use of cryptography. Several rows can share a system: key exchange, certificate and data encryption are separate rows.
Loading…
TL;DRWhat this template gives you
5 points
- One row per use of cryptography: a system usually has several (key exchange, certificate, data encryption).
- Columns follow the per-system fields OMB M-23-02 asks US federal agencies for: asset ID, sensitivity, algorithm, service provided, key length, vendor, OS and hosting.
- Protocol, algorithm, parameter set, OID and primitive map to CycloneDX 1.7 cryptoProperties, so the register converts to a CBOM.
- Quantum status and the NIST IR 8547 (final, October 2026) transition per row: RSA, ECDSA, EdDSA, DH, ECDH and MQV are deprecated after 2030 and disallowed after 2035.
- The summary flags harvest-now-decrypt-later priorities: quantum-vulnerable key establishment protecting data that must stay secret beyond 2030.
Frequently asked questions
What is a cryptographic inventory?
A list of every place cryptography is used: protocols, algorithms, key lengths, certificates, keys, libraries and the systems that depend on them. OMB M-23-02 has required US federal agencies to submit one every year since May 2023, and OMB M-26-15 calls a continuously updated inventory the foundation of the migration plan.
How is this different from a CBOM?
A CBOM (cryptographic bill of materials) is the machine-readable form, in CycloneDX 1.7. This register is the human-readable working document: owners, sensitivity, secrecy lifetime, migration target and status. The protocol, algorithm, parameter set, OID and primitive columns map to CycloneDX cryptoProperties, so you can move between the two with the CBOM generator.
Which rows should be migrated first?
Quantum-vulnerable key establishment that protects data which must stay secret for a long time, because traffic recorded today can be decrypted later. OMB M-26-15 also prioritises high impact systems, high value assets and asymmetric logical access control systems. The summary counts the first group for you.
Are AES and SHA-256 quantum-vulnerable?
They are not on NIST IR 8547's list of quantum-vulnerable algorithms. IR 8547 says NIST-approved symmetric primitives with at least 128 bits of classical security are believed to meet at least Category 1, and SHA-256 is collision Category 2. Record them so the inventory is complete, but they are checked for strength rather than replaced.
Where do the OIDs come from?
From the NIST Computer Security Objects Register. For example ML-KEM-768 is 2.16.840.1.101.3.4.4.2 and ML-DSA-65 is 2.16.840.1.101.3.4.3.18. Some published CBOM examples give ML-KEM-1024 a wrong OID; the NIST value is 2.16.840.1.101.3.4.4.3.
Is this a finished document I can rely on?
No. It is a template with sample content for a fictional organisation. It gives you a structured, editable starting point, but it is not legal, audit, compliance or professional advice. Check every date and requirement against the primary source for your sector before you rely on it.
Who can use it?
The page and sample are public. Customising the template is Pro; a free account gets 3 runs in total, shared across every Pro tool, and the generated document is free to view on the page. Download is Pro: downloading or copying the document (Word, PDF, Markdown, CSV) is never part of the free runs. Pro is $5/month or $40/year. Your work is saved in your own browser.
PQC toolkit
The other tools in the post-quantum cryptography program.
- PQC practice pathThe whole program in order: learn, inventory, plan, practise.
- PQC deadline calculatorWhich dates apply to you, by jurisdiction, plus Mosca’s inequality.
- CBOM generatorBuild a CycloneDX 1.7 cryptographic bill of materials.
- CBOM analyzerCheck a CBOM for quantum-vulnerable algorithms.
- PQC migration labMake the migration calls in a scenario and see the trade-offs.
- PQC exam practiceQuestions on NIST IR 8547, FIPS 203–205 and the federal deadlines.
- PQC migration project planFive phases with tasks, owners, deliverables and exit criteria.
- PQC RACI templateWho does what in the migration, one Accountable per activity.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.