Scope & Independence Disclosure: Q-Day Audits (qdayaudits.com) publishes vendor-neutral post-quantum audit scoping estimators, regulatory mandate matrices, and procurement RFP templates. We do not perform, sign off, or certify accredited cryptographic security audits, nor do we issue compliance attestations. Read our Disclaimer and Affiliate Disclosure.
Scope Your Enterprise Post-Quantum Cryptography Audit & CycloneDX CBOM Inventory
NSA CNSA 2.0 requires quantum-resistant support on new National Security System acquisitions from 1 January 2027, US OMB M-23-02 mandates annual cryptographic inventories, and NIST IR 8547 sets 2030 for classical RSA and ECDSA deprecation. Model your external assessment effort across 12 control domains before issuing an audit RFP.
Port-443 TLS 1.3 X25519MLKEM768 (0x11EC) & OpenSSH 9.9+ bastions
East-west Envoy/Istio mTLS proxies & OIDC/JWT signing rotation
PKCS#11 v3.2 FIPS 140-3 vaults & root CA validity past 2030
Machine-verifiable cryptoProperties JSON workpapers & OIDs
I. 12-Point Enterprise PQC Audit Scoping Estimator
Adjust your infrastructure parameters and tick verified internal cryptographic controls below. All calculations run locally in your browser to produce an illustrative external audit scoping range before you issue a procurement RFP.
Step 1: Infrastructure & Regulatory Footprint
Scope driver: Annual HVA inventory + 1 Jan 2027 NSS acquisition gate (1.32x documentation rigor weight).
Harvest-Now-Decrypt-Later alert: data encrypted today remains confidential past 2036, overlapping the 2030-2035 NIST IR 8547 classical asymmetric deprecation window.
Illustrative Scoping Output
3/12 VerifiedEstimated external assessment effort (planning benchmark; non-binding). Internal CBOM automation reduces paid discovery hours.
External edge endpoints are tracked, but internal service meshes, HSM firmware roadmaps, and CI/CD CBOM generation require structured remediation prior to formal audit.
| Audit Workstream | Est. Days |
|---|---|
| 1. Automated CBOM & Passive Network Discovery | 11.5d |
| 2. PKI Hierarchy, HSM Firmware & Ceremony Review | 13.8d |
| 3. Service Mesh, Identity & Protocol Sampling | 9.3d |
| 4. Mandate Mapping, Supplier Review & Executive Report | 8.2d |
DOM-01: Automated CycloneDX v1.6 CBOM generation in CI/CD build pipelinesDOM-03: East-west service mesh and internal mTLS cipher-suite telemetryDOM-04: PKCS#11 v3.2 HSM firmware & cloud KMS post-quantum roadmap verification
Step 2: Verify 12 Enterprise Cryptographic Readiness Controls
II. CycloneDX v1.6 Dependency Blueprint & Live Schema Ledger
ECMA-424 / CYCLONEDX v1.6External PQC assessments fail when scoped solely to public web certificates. Inspect how asymmetric algorithm OIDs trace from perimeter TLS listeners through custodial PKCS#11 HSM roots into a unified CycloneDX v1.6 JSON ledger.
III. Global Regulatory Mandate Matrix
Align internal CycloneDX v1.6 inventory fields with the statutory transition deadlines governing each operating entity.
| Framework | Horizon | Core Audit & Inventory Requirement |
|---|---|---|
NSA CNSA 2.0 US National Security Systems & defense contractors | 01 Jan 2027 | ML-KEM-1024, ML-DSA-87, and stateful LMS/XMSS firmware signing required on new acquisitions. |
US NSM-10 & OMB M-23-02 US Federal civilian agencies & covered integrators | Annual CBOM | Recurring automated cryptographic inventory prioritizing High-Value Assets through 2035. |
NIST IR 8547 Global baseline & FIPS 140-3 validated modules | 2030 / 2035 | Deprecates classical 112-bit RSA-2048 and ECDSA P-256 in 2030; full disallowance in 2035. |
EU DORA Art. 9 EU financial entities & critical ICT providers | Active Now | Mandates board-approved cryptographic policy, key-lifecycle register, and threat-aligned agility. |
Australian ASD ISM Australian government & critical infrastructure | 2030 Target | Schedules retirement of traditional RSA, DH, ECDH, and ECDSA across regulated systems by 2030. |
IV. Enterprise Cryptographic Posture & PKI Lifecycle Platforms
When multi-cloud fleets exceed manual CLI inventory scripts, commercial posture platforms automate passive network inspection, PKCS#11 vault telemetry, and X.509 certificate rotation. Open-source alternatives (Syft and CBOMkit) remain documented in full on our CBOM Schema page.
Receive Quarterly PQC Mandate & CycloneDX CBOM Governance Briefings
Enterprise CBOM & PQC Audit GovernanceStore your work email for quarterly summaries when NIST, NSA, OMB, EU ENISA, or the Australian Signals Directorate updates post-quantum cryptographic audit timelines.
Reviewed by Evelyn Mercer, Principal Cryptographic Governance & GRC Editor
Reviews OWASP CycloneDX CBOM schemas, federal post-quantum procurement mandates, and PKI governance frameworks.
Last reviewed:
All regulatory mandate timelines, CycloneDX v1.6 schema references, audit scoping weights, and RFP clauses are reviewed every 3 months, or sooner whenever NIST, NSA, OMB, ENISA, or the Australian Signals Directorate issues updated guidance.
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- NIST IR 8547: Transition to Post-Quantum Cryptography Standards (Initial Public Draft) (National Institute of Standards and Technology, Nov 2024)
- Announcing the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) (US National Security Agency (NSA), 2027 NSS Acquisition Gate)
- OMB Memorandum M-23-02: Migrating to Post-Quantum Cryptography (US White House Office of Management and Budget, Federal Inventory Mandate)
- OWASP CycloneDX v1.6 Specification: Cryptographic Asset Inventory (CBOM) (OWASP Foundation / Ecma-424, CycloneDX v1.6)