Assess
Eight yes/no questions about what you run today. You'll get a prioritized reading list, not a compliance report — this is a starting point for the conversation, not a substitute for a real cryptographic inventory.
Do you run public-facing HTTPS websites or APIs?
Any server that terminates TLS — a web app, a REST API, a load balancer.
Do you manage SSH access to servers or use SSH for deployment (e.g. git over SSH)?
Do you store user passwords, or issue/verify JWTs or API tokens?
Does any of your data need to stay confidential for 10+ years (health records, legal, government, trade secrets)?
This is specifically about long confidentiality windows, not general sensitivity.
Do you operate VPNs, point-to-point tunnels, or site-to-site encrypted links?
Do you run an internal Certificate Authority, or sign code/releases/firmware?
Does any team write or maintain custom cryptographic code, rather than using a vetted library end to end?
Custom padding, custom random number handling, hand-rolled protocol logic.
Are you already evaluating or budgeting for a post-quantum migration?