Scoping Workbench
#Audit-Scoping#PKI-HSM#CNSA-2.0
12-Domain Enterprise PQC Audit Scoping & Effort Estimator
Model discovery, PKI/HSM remediation, and vendor attestation effort across external TLS, internal mTLS, databases, and code signing.
INSIGHTS, TOPIC TAGS & GUIDES INDEX · LAST SYNCED 2026-11-06
RSS 2.0 FeedPQC Governance Insights, Mandate Tags & Audit Guides
Explore regulatory post-quantum deadlines, CycloneDX v1.6 CBOM governance playbooks, and audit scoping advisories mapped to CNSA 2.0, NIST IR 8547, EU DORA, and Australian ASD ISM.
Automated compliance watcher monitors NIST CSRC, NSA CNSA 2.0, CycloneDX, and ASD ISM publications; human GRC editor verifies every deadline before live publication.
Filter by Topic Tag
Reference Guides & Interactive Workbenches
4 matchingMandate Ledger
#CNSA-2.0#NIST-IR-8547#ASD-ISM#DORA
Global Post-Quantum Regulatory Mandate Matrix (2025-2035)
Side-by-side compliance deadlines across NSA CNSA 2.0, OMB M-23-02, NIST IR 8547, EU DORA, NCSC UK, and Australian ASD ISM.
Governance Guide
#CBOM#Audit-Scoping
OWASP CycloneDX v1.6 CBOM Governance & Schema Verification Guide
Audit cryptoProperties JSON fields, algorithm OIDs, key lengths, and CI/CD attestation gates.
Procurement Builder
#RFP-Procurement#Audit-Scoping#PKI-HSM
Board-Ready Post-Quantum Cryptography Audit RFP Builder
Generate structured vendor procurement clauses, deliverable acceptance criteria, and conflict-of-interest attestations.
Dated Primary-Source Briefings & Standards Signals
3 entries#CNSA-2.0#RFP-Procurement#CBOM
Audit Readiness Window Tightens Ahead of 2027 CNSA 2.0 New Acquisition Gates
Procurement teams supplying national security and regulated enterprise ecosystems face near-term LMS/XMSS/ML-DSA firmware signing and ML-KEM transport verification clauses.
Actionable takeaway: Require third-party software and appliance vendors to deliver a signed CycloneDX v1.6 CBOM prior to contract renewal.
#ASD-ISM#PKI-HSM#Audit-Scoping
Australian Information Security Manual (ISM) Cryptographic Agility Inventory Expectations
ASD guidance emphasises maintaining a complete cryptographic asset register and eliminating hardcoded RSA-2048/ECDSA assumptions in long-lived systems ahead of 2030 transitions.
Actionable takeaway: Include certificate lifecycle automation (ACME / short-lived certs) in annual Essential Eight and ISO 27001 internal audits.
#CBOM#NIST-IR-8547
CycloneDX v1.6 Formalises Standardized CBOM Crypto-Asset Object Taxonomy
OWASP CycloneDX v1.6 standardised assetType=crypto-asset records covering algorithms, certificates, key lifetimes, and protocol cipher suites.
Actionable takeaway: Mandate automated CBOM generation alongside SBOM artifacts in release pipelines for regulated workloads.
Reviewed by Eleanor Vance, Principal Cryptographic Governance & Audit Editor
Specialises in ISO 27001 cryptographic controls, CycloneDX CBOM governance, and federal PQC transition mandates.
Last reviewed:
Synced via primary-source advisory watcher and verified by human editor
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- NSA CNSA 2.0 Cybersecurity Advisory (CNSA-2.0, 2026-10-28)
- Australian Cyber Security Centre ISM Guidelines for Cryptography (ASD-ISM, 2026-09-14)
- OWASP CycloneDX CBOM Specification (CBOM, 2025-05-19)
Save Your Email for Verified Q-Day Audits Briefings
Enterprise CBOM & PQC Audit GovernanceStore your email to receive verified primary-source guides and advisories once dispatches begin. No automated emails are sent yet.