Assess

What does your stack actually rely on?

Eight yes/no questions about what you run today. You'll get a prioritized reading list, not a compliance report — this is a starting point for the conversation, not a substitute for a real cryptographic inventory.

Do you run public-facing HTTPS websites or APIs?

Any server that terminates TLS — a web app, a REST API, a load balancer.

Do you manage SSH access to servers or use SSH for deployment (e.g. git over SSH)?

Do you store user passwords, or issue/verify JWTs or API tokens?

Does any of your data need to stay confidential for 10+ years (health records, legal, government, trade secrets)?

This is specifically about long confidentiality windows, not general sensitivity.

Do you operate VPNs, point-to-point tunnels, or site-to-site encrypted links?

Do you run an internal Certificate Authority, or sign code/releases/firmware?

Does any team write or maintain custom cryptographic code, rather than using a vetted library end to end?

Custom padding, custom random number handling, hand-rolled protocol logic.

Are you already evaluating or budgeting for a post-quantum migration?

0 / 8 answered