Weak today is weaker tomorrow.
Quantum readiness is not only about swapping algorithms. Hard-coded keys, unrotated certificates, legacy TLS versions and home-grown crypto all make migration slower and riskier.
The audit finds the implementation problems that would block or break a post-quantum rollout, so you fix them once, in the right order.
What you get
- Key and certificate lifecycleGeneration, storage, rotation, revocation and ownership.
- HSM and KMS reviewConfiguration, firmware PQC support and vendor roadmaps.
- Protocol configurationTLS, SSH, IPsec and messaging settings against current guidance.
- Code-level findingsMisused APIs, hard-coded secrets, deprecated primitives.
- Crypto-agility ratingHow easily each system can switch algorithms when it needs to.
- Ranked remediation backlogFindings scored and ordered by risk and effort.
The process.
A typical engagement, start to finish. We agree scope and access before any work begins.
- ScopeStart from your CBOM or build one as part of the audit.
- ReviewConfiguration, code and process review against NIST and industry baselines.
- TestTargeted verification of high-risk findings in agreed environments.
- ScoreEvery finding rated for quantum risk, classical risk and effort.
- WorkshopFindings session with engineering and security leads.
Before you ask.
Is this a penetration test?
No. We review design, configuration and code. Any active testing is limited, agreed in advance and run in environments you choose.
Which standards do you audit against?
NIST SP 800-57 for key management, NIST SP 800-52 for TLS, FIPS 203, 204 and 205, FIPS 140-3 module validation, NSA’s CNSA 2.0 where national security systems are involved, and sector rules such as PCI DSS, HIPAA and CMMC.
Do we need a CBOM first?
It helps, but it isn’t required. If you don’t have one, discovery is built into the audit.