How to Perform a Cryptographic Inventory: A Discovery Method Field Guide
Nine discovery methods, what each one actually finds, where each one goes blind, and how to layer them so one tool's gap is another…
Crypto-Agility When You Can’t Swap the Algorithm
Algorithm swaps almost never happen cleanly. A more useful definition of crypto-agility, and the four mitigation patterns architects can deploy before a full replacement…
Turning NIST SP 1800-38 Into a Governance Work Plan
NIST's practice guide on post-quantum migration is a lab record, not a mandate. A GRC reading of its three volumes, and the four artifacts…
FIPS 140 and What Validation Actually Certifies
A FIPS 140 certificate names one module, one version, one tested environment and one mode of operation. Here is how to read one, and…
Quantum Random Number Generation: Where QRNG Fits in a Key Management Stack
QRNG turns quantum indeterminacy into bits. Here is what that fixes in a key management stack, what it leaves untouched, and how to evaluate…