Cryptographic Discovery & Post-Quantum Readiness

It does not. The word "quantum" does not appear anywhere in PCI DSS v4.0.1, and any vendor telling you that the standard mandates post-quantum cryptography has not read the document they are citing.

What Requirement 12.3.3 does require is that your cryptographic cipher suites and protocols are documented and reviewed at least once every 12 months, which includes active monitoring of industry trends bearing on their continued viability, together with a documented plan for responding to anticipated changes in cryptographic vulnerabilities. It is AKATI Sekurity's view that the post-quantum transition is the largest such anticipated change currently on the public record, and that an inventory built to satisfy 12.3.3 is the same artefact a migration would require in any case. That reading of the standard is our own, and it is not a PCI mandate. We set the argument out in full in our analysis of PCI DSS Requirement 12.3.3 and cryptographic inventory.

It applies in full. PCI DSS appears throughout this page because it is the clearest and most dated expression of the obligation rather than because it is the boundary of who carries one. ISO 27001 requires rules for the effective use of cryptography and an inventory of information assets, neither of which can be evidenced without knowing what cryptography exists. The technology risk regimes our regulated clients answer to, including MAS TRM and BNM RMiT, require the same discipline in less prescriptive language.

And where no obligation applies at all, the exposure does not go away, because it was never created by the regulation in the first place. It is created by the confidentiality lifetime of your data. Source code, intellectual property, patient records, legal files and commercial secrets remain sensitive for years or decades regardless of whether anybody has written a rule about them, and encrypted traffic carrying them can be captured today and read later. The absence of a regulator is not the absence of a risk. It is only the absence of a deadline.

A Cryptographic Bill of Materials is a complete, machine-readable inventory of every cryptographic asset in an environment, covering algorithms, keys, certificates, protocols and the libraries that implement them, and recording where each one runs, what depends on it, and when it expires. A CBOM is to your cryptography what an SBOM is to your software dependencies: the same standard, answering a different question. The format is CycloneDX, the OWASP bill-of-materials standard, which introduced native cryptographic support in version 1.6 and is published as ECMA-424.

The essential characteristic is that a CBOM is discovered rather than surveyed, and the distinction matters more than it sounds. Nobody fills in a form, because forms return the cryptography that people happen to remember. Discovery runs across source code, binaries, configuration, certificate and key stores, and network traffic, in order to establish what is genuinely running, which includes the cryptography that nobody would ever have reported for the simple reason that nobody knew it was there.

It cannot. There is no update to push out and no product that renders an organisation quantum-safe upon installation, whatever the marketing around it may suggest. Post-quantum migration is a programme, not a package.

Cryptography is not a component that can be swapped out; it is a dependency threaded through every library, certificate, protocol handshake, hardware security module, embedded device and third-party product in the estate, very much including the ones you did not build and cannot modify. Migration is therefore a multi-year programme rather than a maintenance window, and its first phase is discovery. Organisations that have started this work report, with some consistency, that discovery alone has taken longer than they originally budgeted for the entire project.

Because of the problem known as harvest now, decrypt later. Encrypted traffic captured today can be stored indefinitely and decrypted at whatever point the capability arrives, which means that for any data carrying a long confidentiality life, including payment data, health records, legal and regulatory material, intellectual property, and commercial or state secrets, the exposure begins at the moment the traffic crosses the network rather than at the moment the hardware comes into existence.

The useful question, then, is not when a cryptographically relevant quantum computer will arrive, since nobody can answer that with any authority. It is how long your data must remain confidential, measured against how long your migration will realistically take. If the first number is larger than the second, you are already late, and no amount of waiting for the estimates to firm up will change that arithmetic.

The standards timeline is not waiting for the hardware in any case. NIST published the first post-quantum standards, FIPS 203, FIPS 204 and FIPS 205, on 13 August 2024, and its draft transition roadmap proposes deprecating widely deployed classical asymmetric algorithms after 2030 and disallowing them after 2035. Migration programmes are routinely measured in years, and the discovery phase alone has consistently overrun the budgets set for entire projects.

The engagement produces a discovered inventory of the cryptography actually running within a bounded scope, and the cardholder data environment is the natural place to begin, on the straightforward grounds that the obligation already exists there and somebody has already drawn the boundary around it.

The deliverable supports Requirement 12.3.3, establishes the organisation's post-quantum exposure, and surfaces a set of findings that matter immediately rather than eventually: expired and orphaned certificates, deprecated protocols still quietly negotiating in production, keys that have outlived the people who owned them, and algorithms that would not survive an assessment conducted this afternoon. It earns its cost well before quantum enters the conversation at all.