Notifications
Clear all
Topic starter
25/08/2026 9:13 am
TL;DR: EO 14412 turns post-quantum migration into an inventory problem, not just a crypto upgrade, because most organisations still track only public TLS certificates while SSH keys, code-signing keys, HSM-backed assets, embedded cryptography, and machine identity credentials remain partially or entirely invisible, according to Thryam. The real deadline pressure comes from the gap between certificate lifecycle tooling and a complete cryptographic system of record.
NHIMG editorial — based on content published by Thryam: What EO 14412 Actually Requires You to Inventory (And Why Your Certificate Manager Won’t Find It)
Questions worth separating out
Q: What breaks when organisations rely on certificate managers for post-quantum readiness?
A: They miss most of the cryptographic estate.
Q: When should organisations prioritise cryptographic inventory over algorithm migration?
A: They should prioritise inventory first, because migration plans are only as good as the trust fabric they map.
Q: What do security teams get wrong about quantum-safe migration?
A: They often treat it as an encryption-library refresh.
Practitioner guidance
- Expand inventory scope beyond certificates Map public TLS, internal PKI, SSH keys, signing keys, workload identity credentials, and embedded cryptography into one owned register.
- Classify by confidentiality lifetime Prioritise assets that protect data needing confidentiality past the early 2030s, then sequence lower-lifetime data and signature dependencies after that.
- Separate remediation by change type Split the queue into configuration changes, development work, and hardware refreshes.
What's in the full article
Thryam's full blog covers the operational detail this post intentionally leaves for the source:
- A complete breakdown of which cryptographic asset classes EO 14412 puts in scope, including edge cases that teams often miss in early discovery.
- The article's 90-day starting plan with sequencing guidance for scoping, classification, and remediation planning.
- Specific discussion of FIPS 140-3 implications, procurement timing, and how hardware constraints affect migration options.
- The vendor's explanation of how commercial supply-chain pressure will push the requirement into security questionnaires and contract terms.
👉 Read Thryam's analysis of EO 14412 cryptographic inventory requirements →
Cryptographic inventory under EO 14412: what IAM teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/08/2026 9:14 am
Cryptographic inventory is now a machine identity governance discipline. EO 14412 makes it clear that certificate management is only one slice of the problem. The real governance gap is the inability to answer where cryptography lives, who owns it, and which identities depend on it. That pushes cryptographic posture into the same operating model as NHI inventory, ownership, and lifecycle control.
A few things that frame the scale:
- Average time to detect a compromised machine identity: 214 days, according to The Critical Gaps in Machine Identity Management report.
- Certificate expiry is the leading cause of outages for 45% of organisations, which is why lifecycle visibility has to extend beyond public-facing assets.
A question worth separating out:
Q: Who is accountable for cryptographic inventory under EO 14412?
A: Accountability sits with the organisation that owns the cryptographic trust chain, even when vendors terminate TLS, manage HSMs, or sign assertions on its behalf. For federal agencies and contractors, EO-driven requirements also cascade into procurement and supplier oversight, so ownership has to span internal and third-party dependencies.
👉 Read our full editorial: EO 14412 makes cryptographic inventory a machine identity problem
