Cryptographic Discovery Sprint: The First Defensible Step in PQC Migration

Executive Order 14412, signed on 22 June 2026 under the title "Securing the Nation Against Advanced Cryptographic Attacks," gives federal agencies until 31 December 2030 to transition high-value assets to post-quantum key establishment. Section 1 of the order describes the risk of adversaries collecting encrypted data now for decryption once large-scale quantum computers become operational. The question confronting every organisation subject to that timeline, and every critical infrastructure operator now receiving PQC migration guidance from its Sector Risk Management Agency, is not whether to migrate. It is whether the organisation can demonstrate, under scrutiny, that it knows what it needs to migrate.

That question is answered by a cryptographic discovery sprint.

The Inventory Gap No Migration Plan Can Bridge

NIST Special Publication 1800-38B, the National Cybersecurity Center of Excellence's preliminary draft on migration to post-quantum cryptography published in December 2023, identifies discovery as the first step in PQC migration planning. The document recommends a combination of active and passive discovery techniques across code development pipelines, operational systems and applications, and transport protocols and network services, all feeding a cryptographic inventory that supports an organisation's overall cybersecurity risk management strategy.

Without a verified inventory of cryptographic dependencies, an organisation cannot prioritise which systems face the highest exposure, articulate residual risk to a board, or submit a credible migration plan to a regulator. A migration plan built without discovery is a document of assumptions. Assumptions do not survive examination.

What a Cryptographic Discovery Sprint Covers

A cryptographic discovery sprint is a time-bounded diagnostic, typically running 20 to 30 days, that establishes three foundational outputs.

Cryptographic Visibility Across the Digital Estate

The sprint maps public-key cryptographic dependencies across the organisation's infrastructure: certificates, key material, protocol configurations, libraries, and embedded algorithm choices. It identifies where TLS termination occurs, what key lengths are in use, which signing algorithms underpin software supply chains, and which legacy systems depend on RSA or ECDSA with no documented upgrade path.

Exposure Analysis Under a Post-Quantum Threat Model

Visibility alone is insufficient without a threat model that accounts for the collect-now, decrypt-later risk that EO 14412 Section 1 describes. The sprint translates cryptographic findings into risk metrics a board can act on: which data assets have protection periods extending beyond the expected arrival of cryptanalytically relevant capability, and which systems face operational disruption from algorithm deprecation.

A Defensible, Risk-Prioritised Migration Pathway

The third output is a risk-prioritised transition plan: a sequenced programme of work aligned with governance structures and regulatory deadlines. For organisations subject to EO 14412, this means mapping each high-value asset against the December 2030 (key establishment) and December 2031 (digital signature) deadlines, with dependency chains and resource estimates attached.

Why the Sprint Format Matters

NIST SP 1800-38B describes PQC migration as a process that can take years, or even decades, to complete. That assessment reflects the depth of cryptographic embedding in modern digital infrastructure: TLS configurations, HSM firmware, code-signing pipelines, and IoT device certificates all carry dependencies that must be catalogued before they can be sequenced for transition.

A time-bounded sprint addresses the failure mode that stalls migration: indefinite scoping. Organisations that attempt open-ended cryptographic audits often cycle through discovery without progressing to action. The sprint format imposes a deadline, forces prioritisation, and produces a deliverable for a board or regulator at the conclusion of the engagement.

Regulatory Pressure Is Already Bearing Down

EO 14412 required each federal agency head to name a PQC migration lead within 30 days, with that role carrying explicit responsibility for "agency-wide cryptographic inventory management." Within 90 days, OMB was directed to issue guidance requiring agencies to review their high-value asset and high-impact system inventories. Within 270 days, the Secretary of Homeland Security, through CISA and in coordination with NIST, was required to publish minimum elements for a cryptographic bill of materials designed to "enable the automated assessment of the cryptographic assets" in use.

For critical infrastructure operators, Section 5 directs Sector Risk Management Agencies to help owners develop PQC migration plans. That assistance presupposes the operator knows what cryptographic assets it holds. Without discovery, the conversation cannot begin.

NIST's publication of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024 moved the standards from draft to final, removing the last argument that migration planning was premature. The NSA's CNSA 2.0 guidance adds further pressure, setting transition requirements for national security systems.

The Discovery Sprint as a Governance Instrument

A completed discovery sprint produces a governance artefact: a risk registry that links cryptographic dependencies to business-critical systems, maps exposure to regulatory deadlines, and sequences remediation within operational constraints.

For organisations engaging with SITG-Consulting's cryptographic agility services or preparing for a PQC readiness assessment, the discovery sprint is the prerequisite that grounds subsequent work in empirical data rather than inherited assumptions. The sprint output feeds directly into structured engagements: a FIPS 140-3 gap analysis for organisations in the cryptographic module supply chain, or a full QCAS assessment for those seeking independent assurance of their cryptographic posture.

The question is not whether your organisation will need to demonstrate cryptographic visibility. It is whether you can demonstrate it before the deadline arrives.