PQC Migration Needs One Risk Queue, Not a Separate Scorecard
New research proposes expressing classical and harvest-now-decrypt-later exposure as a common cost of delay. The useful idea is one governed backlog—with uncertainty…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
Cryptographic Governance insights
Operating models for inventory, ownership, policy, remediation, and defensible evidence.
-
-
JOSE Deprecation Shows Why Algorithm Names Belong in the Inventory
An IETF draft would deprecate JOSE “none” and RSA1_5. Finding affected systems requires inventorying protocol identifiers, library behavior, configuration, and observed use—not…
-
India’s Telecom PQC Agenda Makes Testing Infrastructure a Migration Dependency
India’s Fourth Quantum Communication Conclave put roadmaps, product readiness, testing infrastructure, routers, and 5G/6G standards on one agenda. That is the right…
-
GAO’s Quantum Readiness Review Makes Inventory a Funded Process
GAO found that none of 24 selected federal agencies fully addressed key PQC preparation practices. The gap is not merely a missing…
-
Harvest Now, Decrypt Later Turns Data Lifetime Into a Crypto Priority
Europol’s new assessment makes a practical point: quantum migration priority should reflect how long data must remain secret, not just the system’s…
-
TLS 1.3 Is Now a Design Dependency for Post-Quantum Readiness
RFC 9852 requires new TLS-based protocols to default to TLS 1.3. That baseline matters because current PQC standardization work targets TLS 1.3…
-
A Quantum-Safe Center Should Be Measured by Migration Outcomes
Sarawak AI Centre and IBM plan a regional quantum-safe hub. Its value will depend on measurable discovery coverage, owned remediation, skills transfer,…
-
Threshold Cryptography Changes What a Key Inventory Must Record
NIST’s current Threshold Call previews span post-quantum and traditional schemes. Distributed authority improves resilience only when participants, shares, protocols, recovery, and evidence…
-
A Telecom CBOM Must Map Cryptography Across Organizational Boundaries
ATIS’s telecom-specific CBOM profile highlights the hardest 5G inventory problem: cryptographic dependencies cross network functions, interfaces, suppliers, and operational owners.
-
A CBOM Profile Should Extend the Standard Without Hiding the Boundary
The Applied Quantum CBOM Profile 1.0 release candidate adds migration and governance context to CycloneDX. Its design highlights how extensions should remain…