The Post-Quantum Cryptography Coalition (PQCC) has released its Post-Quantum Cryptography (PQC) Inventory Workbook, a tool designed to help organizations of all sizes build a centralized inventory for managing their cryptographic assets and tracking migration efforts. The workbook aims to support early planning and risk reduction as organizations prepare to secure their data against future quantum threats, before quantum computing becomes a practical reality.
The PQC Inventory Workbook is a practical resource designed to help organizations build a centralized cryptographic inventory, an essential step toward achieving post-quantum migration goals. For those beginning to establish a baseline understanding of their cryptographic assets, as outlined in the PQC Migration Roadmap, creating an inventory at the system or asset level is critical. This foundational step supports effective migration planning and sets the stage for long-term resilience not just for PQC readiness, but for any major cryptographic transition.
The workbook offers a focused set of fields to assess PQC requirements, align with system lifecycles, and prioritize assets for migration. It can be used as-is or adapted to track additional data as needed, giving organizations the flexibility to tailor it to their environment and maturity level.
The workbook also helps organizations identify and define the systems or assets they need to track. It guides them in categorizing these assets by priority, such as high, medium, or low. Organizations can use it to populate the inventory tab with available information and continue updating it as new data or systems are identified.
Additionally, the PQC Inventory Workbook contains a glossary which defines key cryptographic terms and lists the vulnerability of common algorithms. By maintaining and refining this inventory, organizations can better manage their transition to quantum-resistant cryptographic systems.
“As highlighted within the coalition’s PQC Migration Roadmap, building an inventory is essential for effective migration planning and long-term success,” Wen Masters, vice president of cyber technologies at MITRE, said in a Thursday media statement. “The workbook serves as a resource to help organizations achieve their migration goals.”
“The coalition continues to provide new resources to the greater cyber community to help them better manage their transition to quantum-resistant cryptographic systems,” said Matt Mickelson, lead coordinator of the PQCC and senior cyber principal for science and technology at MITRE. “This spring, the Coalition published the PQC Migration Roadmap. Now we have the inventory workbook, and we plan to publish quantum risk assessment materials later this year.”
Formed in September 2023, the PQCC was established to advance public awareness and support the adoption of NIST’s standardized post-quantum cryptographic algorithms. The coalition unites a diverse group of technologists, academic researchers, and industry leaders. Its founding members include IBM Quantum, Microsoft, MITRE, PQShield, SandboxAQ, and the University of Waterloo.
The PQC Inventory Workbook serves as a starting point for building such an inventory. It provides a streamlined set of fields to assess PQC needs, plan system lifecycles, and prioritize assets for migration. Organizations can use the workbook as-is or customize it to meet their specific needs, including adding fields to track additional data over time.
The PQC Inventory Workbook includes an Overview section that covers the purpose and intended use of the PQC Inventory workbook.
The Baseline Inventory is the primary section of the PQC Inventory Workbook. This tab explains the required fields and their role in supporting broader PQC migration activities. By maintaining and refining this inventory, organizations can better manage their transition to quantum-resistant cryptographic systems. It outlines the various fields that organizations should complete to begin their cryptographic inventory. Each column includes a description that serves as guidance for filling out the sheet, along with the purpose of the information and how it will support post-quantum cryptography migration.
The workbook also contains an Example Inventory provides a sample sheet with the first few rows filled in. This sample demonstrates how the fields should be completed. The Example Visualization contains a basic dashboard-style data visualization based on the Example Inventory. It offers visual summaries of PQC status according to asset priority. The Glossary includes a list of common cryptographic algorithms and key terms. This section is meant to support users as they complete their inventory.
It also comprises the Spreadsheet Customizations tab, which is a hidden support sheet used for drop-downs, visualizations, and intermediate calculations such as charts and ranges. To access this tab, users can right-click the spreadsheet tab area and select ‘unhide.’
As the threat of Cryptographically Relevant Quantum Computers (CRQCs) grows, organizations are increasingly preparing to transition to quantum-resistant cryptographic systems. A critical step in this process is creating a centralized inventory to track cryptographic migration efforts at the system or asset level. Building an inventory is essential for effective migration planning and long-term success, whether for PQC or other transitions.
In May, the PQCC released its PQC Migration Roadmap to assist organizations in navigating the complexities of transitioning to quantum-safe cryptography. The comprehensive and tailorable guide provides a strategic framework across four critical categories – preparation, baseline understanding, planning and execution, and monitoring and evaluation, equipping organizations with actionable tools and methodologies to safeguard their data against emerging quantum threats.
