Practitioner: Discovery, CBOM and the migration roadmap

Discovery, CBOM and the migration roadmap

Locate before replacing

Cryptography is embedded in applications, networks, cloud services, firmware, libraries and third-party platforms. A Cryptographic Bill of Materials (CBOM) helps record algorithms, keys or certificates, systems, owners and dependencies.

Capability versus use

A cryptographic library may implement an algorithm without actively using it. Inventory work should distinguish available capabilities from actual runtime dependencies and record the evidence behind each finding.

Assess and triage

Prioritisation should consider data confidentiality lifetime, system criticality, exposure, vendor readiness, operational constraints and applicable policy obligations. HNDL can make long-lived sensitive data a higher priority.

Plan and test

Assign owners, ask vendors for migration plans, test protocol interoperability and performance, then deploy in controlled waves. Maintain the inventory as systems change.

Founder video: Discovery, CBOM and the migration roadmap

This is a timed production outline, not a recorded video. The finished video will be no longer than five minutes.

1. 0:00–1:00 — Show a simple cryptographic inventory.
2. 1:00–2:00 — Explain CBOM fields and ownership.
3. 2:00–3:15 — Prioritise using data lifetime and system criticality.
4. 3:15–4:35 — Describe vendor engagement, testing and migration waves.

Three things worth remembering

1. Locate before replacing: Cryptography is embedded in applications, networks, cloud services, firmware, libraries and third-party platforms. A Cryptographic Bill of Materi
2. Capability versus use: A cryptographic library may implement an algorithm without actively using it. Inventory work should distinguish available capabilities from actua
3. Assess and triage: Prioritisation should consider data confidentiality lifetime, system criticality, exposure, vendor readiness, operational constraints and applica

Explain, don't guess

Show what you can do

Build a five-row CBOM sample and rank three systems for review. Explain the evidence and uncertainty behind each priority.

Self-assessment only. A score or completion here is not a professional certification.