Start a PQC inventory by choosing a small system boundary, collecting cryptographic evidence from supported sources, reviewing what was observed and what was missed, and assigning owners to the dependencies that need investigation. In Vista Platform Core, accepted discoveries feed the canonical inventory, posture evaluation, and scoped CBOM generation.

The aim of the first pass is a defensible baseline. An algorithm list alone does not tell you who can change a service, what depends on it, or where discovery has gaps. Vista connects that evidence to its self-hosted infrastructure inventory, DCIM, and IPAM workspace.

1. Pick one application or environment

For example, start with a lab web application, its TLS endpoint, the host it runs on, and one connected cloud account or device if relevant. This is an illustrative exercise, not a claim about a measured deployment. Write down expected systems, owners, exclusions, and which collection methods can see each part.

Install free Vista Platform Core and follow the Quick Start. Core is free and includes discovery, the DCIM and IPAM workspace, inventory, compliance/PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Infrastructure and operation remain your responsibility.

2. Connect a source that can answer your question

Network observations: register a sensor through Discovery → Sensors & Agents. Use the generated installation command and a platform address reachable from the sensor. Interface placement and traffic visibility determine what it observes.
Device configuration: follow the supported device interrogation path for configuration evidence not visible in traffic.
Cloud resources: connect a supported provider with the documented read-only permissions. Check the accounts, subscriptions/projects, regions, and resource types included.

You do not need every source for a first baseline. Follow the discovery documentation and review active-discovery settings before collection. Passive observation, selected-asset Active Scan, and other discovery jobs are different operations; select only systems and collection behavior you are authorized to use.

3. Approve discoveries and inspect the evidence

Review Discovery → Approvals. Accept the assets that belong in the intended inventory; auto-approval may already apply to some discoveries. Then inspect the relevant Inventory views for certificates, keys, and cryptographic configurations.

For each important dependency, capture or review:

The asset or service and its operational owner.
The observed protocol, algorithm, certificate, or key metadata.
The evidence source and observation time.
The business context and systems that depend on it.
Missing permissions, unreachable sources, and other unassessed areas.

See Inventory and Lenses for navigating the shared dataset. Avoid equating the count of observed components with the number you expected to exist.

4. Evaluate readiness without losing the unknowns

Use Dashboard → PQC for the observed post-quantum exposure and Risk & Compliance → Posture for framework evaluation. Review individual findings and their evidence. Keep unassessed items separate from confirmed acceptable configurations.

Turn findings into questions an owner can act on: Which product or service uses this configuration? Does its supplier support a replacement? Which dependent systems must be tested? What data needs long-term protection? Inventory informs that investigation; it does not prove that a migration is ready to deploy.

5. Preserve the baseline and repeat

Create or review a Scope, preview its membership, and generate a CycloneDX CBOM. Keep the original artifact, its recorded hash, the Scope version, and the collection gaps with the baseline.

Assign work, change the underlying systems, and collect fresh evidence before generating the next artifact. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Enterprise artifact comparison adds a comparison view; free Core can generate and retain separate baselines.

What a useful first pass looks like

You can explain which systems were included, which sources observed them, what findings need follow-up, who owns the next actions, and what remains unknown. You also have a dated artifact tied to that boundary. That is a useful starting point even when the inventory is incomplete.

Source: Vista Platform Core Quick Start. For the broader operating process, read post-quantum readiness and migration planning.