CycloneDX 2.0 Points Beyond a Static CBOM Toward Governed PQC Migration
CycloneDX 2.0 is expected to connect cryptographic inventory with owners, risks, evidence, target dates, and migration status. The preview shows why a…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
Author: Justin Morse
Analysis, field notes, and product thinking for this topic.
-
-
The UK DWP Key-Management Policy Makes Cryptographic Inventory an Operating Control
The UK DWP’s updated key-management policy links inventories to ownership, supplier contracts, incident response, audits, and lifecycle controls—a practical model for governing…
-
Singapore’s Quantum-Safe RFI Shows Why PQC Procurement Needs Verifiable Evidence
Singapore is testing the market for quantum-safe products and services. Buyers should use the same moment to demand precise capability boundaries, cryptographic…
-
The HAWK Result Is a Case for Cryptographic Status, Not PQC Paralysis
HAWK’s withdrawal from NIST consideration shows why cryptographic inventories must distinguish candidates, standards, implementations, and deployments.
-
The Quantum-GUARD Act Treats Grid PQC as an IT and OT Migration Problem
The proposed Quantum-GUARD Act emphasizes realistic testing, cryptographic discovery, and coordinated PQC migration across electric-grid IT and OT.
-
Hybrid PQC Key Exchange Is Progress—Not Complete Quantum Readiness
A 2026 Internet measurement study found substantial hybrid key-exchange support but no observed hybrid PQC certificates, highlighting an incomplete transition.
-
RFC 10024 Turns Hybrid PQC TLS into an Inventory and Interoperability Task
The IETF’s new hybrid TLS 1.3 RFC standardizes ML-KEM combinations and makes negotiated groups, obsolete experiments, and interoperability part of cryptographic inventory.
-
Europe’s New QKD Program Reinforces a Practical Lesson: Quantum Communications Still Need PQC Governance
A new EuroHPC research call requires QKD integration with classical networks, enterprise key management, and hybrid QKD-PQC demonstrations.
-
Federal Identity Is Becoming a Post-Quantum Inventory Problem
GSA’s quantum-resistant identity work demonstrates why agencies need a living inventory of algorithms, credentials, systems, vendors, and dependencies.
-
The UK’s 2028 PQC deadline is really a cryptographic discovery deadline
The UK NCSC expects discovery and an initial migration plan by 2028, priority migrations by 2031, and completion by 2035. Here is…