Step 1: Inventory Current Certificates

Assess your automated discovery, PQC readiness mapping, and CBOM export coverage across all environments.

Asset Discovery Coverage

0%
Percentage of all certificates and keys discovered (on-prem, cloud, endpoints, containers, IoT)

Algorithm, Key Size & PQC Readiness Mapped

0%
% of certs/keys with algorithm, key size, and PQC-suitable or hybrid-capable flag documented

Expiration & Chain Mapped

0%
% of certificates with expiration dates, chain info, and automated expiration alerts

HSM Location & PQC Firmware Version Mapped

0%
% of keys with HSM location, usage, and PQC-capable firmware version documented

Primary Discovery Tool

Select your primary tool

Living CBOM Exported

Cryptographic Bill of Materials generated and maintained

Automated CBOM Refresh Frequency

Select refresh frequency

CBOM Export Format

Select export format

Continuous Delta Scanning Enabled

Real-time change detection for new, modified, or revoked certificates and keys

Risk Heat-Map Dashboard Live

Dashboard with risk heat-map auto-populated from CBOM data

Target: ≥95% asset coverage with 100% of certs/keys having algorithm, size, PQC readiness, expiration (with alerts), chain, HSM location & firmware mapped. Living CBOM with daily delta scans.

Live Readiness Preview

Maturity Level

3% PQCMM L1
Initial

Risk Heat Map

  • Inventory: Critical
  • PQC Assets: Critical
  • Trust Stores: Critical
  • Hybrid Pilot: Critical
  • Rotation: Critical
  • Timeline: Critical
  • PQC CAs: Critical
  • CA Routing: Critical

Quick Wins (90 Days)

  1. Run Full Discovery Scan + Daily Delta
    Target ≥80% asset coverage + enable CBOM + Risk Dashboard
  2. Activate PQC Risk Classification
    Auto-classify ≥70% assets + assign owners + export backlog
  3. Centralize Trust Stores – Phase 1
    Deploy central console on highest-volume platforms + ≤30-min root push
  4. Launch 10% Hybrid Certificate Pilot
    Issue hybrid certs on 10% non-prod + validate latency <20% & HSM
  5. Enable PQC-Ready ACME + Short-Lived Certs
    Activate ACME with algo negotiation on ≥50% endpoints + 60% renewal