A cryptographic inventory is useful only if an organization can keep it current and turn its findings into funded action. On October 6, the U.S. Government Accountability Office released Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat. GAO reported that none of 24 selected Chief Financial Officer Act agencies fully addressed the preparatory practices in its evaluation framework.
The public report identifies gaps in cryptographic expertise, processes for developing inventories, identification of migration funding, and plans for post-quantum testing. GAO says its earlier sensitive report made 89 recommendations to 23 agencies. The finding is broader than government: an inventory project can look complete while the organization remains unable to prioritize, finance, test, or prove migration.
An inventory is a process, not a delivery date
A one-time collection quickly decays. Certificates renew, cloud services change, libraries update, vendors replace components, teams deploy new APIs, and unmanaged assets appear. If discovery has no accountable owner, refresh cadence, coverage measure, or reconciliation method, the resulting list becomes historical evidence rather than an operating control.
A durable process should define expected scope, discovery sources, evidence provenance, normalization rules, ownership, update triggers, and review intervals. It should distinguish assets known to exist from assets cryptographically characterized. It should also show unsupported, inaccessible, and excluded environments. Unknown values and coverage gaps are findings; they are not proof that vulnerable cryptography is absent.
Funding starts with migration units
“Replace RSA” is not a budget line. Migration cost attaches to applications, devices, trust services, contracts, validation requirements, operating windows, and supplier dependencies. A cryptographic record becomes budget evidence when it identifies where a mechanism is used, what business service depends on it, who controls the change, and which constraints shape the target state.
Teams can group records into migration units: for example, a certificate hierarchy and its relying parties, a product family that shares firmware, or an API ecosystem that must change clients and servers together. Each unit can carry an owner, decision, dependency map, testing plan, procurement need, target window, and estimated cost range.
This structure helps leaders distinguish work that can be handled through routine upgrades from work requiring replacement capital, contract changes, specialist support, or coordinated partner action. It also makes unfunded risk explicit instead of burying it in a technical backlog.
Testing plans belong beside inventory records
GAO highlights the absence of plans to guide PQC testing. That matters because algorithm support does not prove deployability. Packet sizes, latency, memory, certificate chains, hardware acceleration, protocol negotiation, fallback, key management, and validation requirements can all affect results.
A test record should specify:
- the asset, connection, or component under test;
- the exact algorithm or hybrid construction and implementation version;
- the protocol, configuration, and trust model;
- client, server, intermediary, and partner populations included;
- performance and security acceptance criteria;
- fallback, failure, and rollback behavior;
- limitations and populations not covered; and
- production evidence required to close the migration item.
Keeping this evidence linked to the underlying cryptographic dependency prevents a successful laboratory pilot from being mistaken for enterprise-wide completion.
Expertise must be distributed through ownership
A central cryptography team cannot remediate every system. It can define schemas, policy, evaluation rules, patterns, and evidence standards. Application, infrastructure, identity, procurement, data, and supplier-management teams still need enough understanding to own decisions and execute changes.
Organizations should name both a cryptographic governance owner and accountable owners for migration units. Exceptions should state why a target cannot yet be reached, what compensating controls apply, which dependency blocks progress, and when the decision will be revisited. This turns expertise into a scalable operating model rather than a queue for a small specialist group.
What organizations should do next
First, measure inventory coverage against expected scope. Report discovered, characterized, unknown, excluded, and stale records separately.
Second, convert high-priority findings into owned migration units with explicit dependencies, test plans, target states, and funding assumptions.
Third, align procurement and supplier evidence with the same records. Ask for supported algorithms, protocols, implementation versions, deployment prerequisites, validation status, and timelines—not a generic “quantum safe” label.
Fourth, require proof after remediation. Configuration intent, vendor documentation, and test results answer different questions; retain all three with provenance.
Finally, treat the inventory as recurring infrastructure. Refresh it when systems change and use coverage, evidence age, owned backlog, testing progress, and verified closure as management measures.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps teams move from observations to accountable decisions, remediation, and auditable evidence.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted, not indiscriminate network scanning. Vista is not a vulnerability scanner, and incomplete discovery is not proof of absence.
Explore Vista’s cryptographic inventory and CBOM and compliance resources.
Where uncertainty remains
The public GAO report omits sensitive agency-specific detail, and agency responses to recommendations varied. It does not establish a single commercial maturity model. It does provide unusually clear evidence that inventories, expertise, testing, and funding are interdependent. Counting algorithms without building that operating process will not produce a defensible migration.
Source
- Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, U.S. Government Accountability Office, October 6, 2026.