NIST FIPS 203 / 204 / 205 ALIGNED
PQC Readiness Assessment
Consulting-led cryptographic inventory, algorithm-exposure analysis, and phased migration planning — with continuous outside-in crypto assurance via NST Assure.
Cryptographically relevant quantum computers will break RSA, ECC, and DH key-exchange. We deliver a consulting-led PQC Readiness Assessment — cryptographic discovery, dependency analysis, algorithm-exposure scoring, and phased NIST FIPS 203/204/205-aligned migration planning — complemented by NST Assure, our outside-in Digital Trust capability that continuously monitors externally exposed cryptographic posture from an adversary's perspective.
01
ENTERPRISE-WIDE CRYPTOGRAPHIC INVENTORY
Cryptographic Discovery & Inventory
Automated and manual enumeration of every cryptographic primitive, key size, and protocol dependency across the enterprise stack.
Application crypto mapping — TLS termination points, in-app encryption calls (AES, RSA, ECDH, HMAC), and key-derivation functions across web, mobile, and API layers
Infrastructure & cloud KMS — algorithm inventory across AWS KMS, Azure Key Vault, GCP Cloud KMS, and on-prem HSM clusters including key-length and curve parameters
Network protocol enumeration — TLS 1.2/1.3 cipher suites, IPsec IKEv2 transforms, SSH key-exchange algorithms, and MACsec configurations on every gateway
CI/CD & code-signing chains — GPG, Sigstore, and X.509 signing schemes in build pipelines, container image signatures, and SBOM attestation integrity
Certificate & trust-chain graph — full CA hierarchy mapping, signature-algorithm distribution (RSA-2048 vs ECDSA P-256 vs Ed25519), and expiry-risk heatmap
Let's Start →
DISCOVERY SURFACE
Application & API Crypto Usage
App
Infrastructure & Cloud Platforms
Infra
Network & Security Device Config
Net
CI/CD & Code-Signing Schemes
Build
INVENTORY
TLS/SSL
CERTIFICATES
KEY SIZE
02
LIBRARIES, SDKS, FIRMWARE & VENDOR ROADMAPS
Cryptographic Supply Chain & Dependencies
Maps quantum-vulnerable cryptographic primitives inherited through third-party libraries, firmware, and managed-service dependencies.
Library & SDK deep-scan — OpenSSL, BoringSSL, Bouncy Castle, libsodium, and language-native crypto modules pinned to quantum-vulnerable algorithms
OS & runtime crypto modules — FIPS-validated modules in RHEL, Windows CNG, Java Security Providers, and .NET CryptoServiceProviders with upgrade-path analysis
Firmware & embedded crypto — RSA/ECC primitives hard-coded in HSM firmware, TPM chips, IoT secure elements, and network-appliance ASICs
Vendor PQC roadmap validation — SaaS/IaaS provider migration timelines cross-referenced against NIST deprecation schedules and contractual SLA commitments
Transitive dependency risk — quantum-vulnerable call-chains ranked by data-sensitivity, HNDL exposure window, and remediation complexity
Let's Start →
DEPENDENCY EXPOSURE
Third-Party Library Crypto Primitives
Lib
Firmware & Hardware-Bound Algorithms
HW
SaaS / PaaS Vendor PQC Roadmaps
Vendor
Container & OS Crypto Modules
OS
SUPPLY CHAIN
FIRMWARE
VENDOR
SDK
03
RSA/ECC EXPOSURE, LEGACY PROTOCOLS & HNDL
Algorithm & Crypto-Agility Assessment
Quantifies quantum-vulnerable algorithm exposure and evaluates the organisation's ability to swap primitives without application re-architecture.
RSA / ECC / DH / ECDH exposure — key-exchange and signature-algorithm usage mapped per asset with Shor-vulnerability classification
Legacy protocol triage — TLS 1.0–1.2 RSA-kex suites, SSH diffie-hellman-group14, IKEv1 main-mode, and S/MIME v3 RSA-OAEP dependencies
HNDL risk scoring — data-retention periods x classification level x intercept likelihood to prioritise harvest-now-decrypt-later remediation
Crypto-agility gap analysis — hard-coded OIDs, missing algorithm-negotiation hooks, static key-wrapping, and abstraction-layer readiness for ML-KEM / ML-DSA swap-in
PQC performance modelling — ML-KEM-768 vs X25519 handshake latency, ML-DSA-65 signature sizes, and bandwidth impact on constrained links and embedded endpoints
Let's Start →
QUANTUM VULNERABILITY MAPPING
RSA / ECC / DH Key-Exchange Exposure
Critical
Harvest-Now-Decrypt-Later Risk
HNDL
Hard-Coded Algorithms & Agility Gaps
Agility
Legacy Protocol Dependencies
Legacy
RSA / ECC
HNDL
AGILITY
LEGACY
04
KMS, HSM, CERTIFICATES & HYBRID READINESS
Key Management, PKI & Certificate Lifecycle
Assesses whether KMS platforms, HSM firmware, and PKI hierarchies can support ML-KEM / ML-DSA key sizes and hybrid certificate issuance.
HSM & KMS readiness — FIPS 140–3 Level 3 module firmware versions, ML-KEM / ML-DSA algorithm support, and hardware upgrade or replacement roadmap
Key lifecycle under PQC — generation entropy for lattice-based keys, secure storage of larger key material, rotation cadence, and zeroisation compliance
Certificate scalability — ML-DSA-65 signature overhead (~2.4 KB) impact on certificate chains, OCSP stapling, and CRL distribution points
Hybrid & composite certificates — X.509 dual-signature issuance (e.g., ECDSA + ML-DSA), backward-compatible negotiation, and client-stack compatibility testing
CA hierarchy migration — root and intermediate CA re-keying strategy, cross-signed bridge certificates, and CT-log readiness for PQC OIDs
Let's Start →
PKI & KEY MGMT READINESS
HSM Algorithm Support & Upgrade Path
HSM
Certificate Scalability for PQC Sizes
PKI
Hybrid & Composite Key Handling
Hybrid
Root CA & Trust-Chain Preparedness
CA
PKI
HSM
HYBRID
KMS
05
NIST FIPS, ROADMAP & GOVERNANCE
Migration Strategy, Governance & Compliance
Delivers a phased migration roadmap with governance controls, compliance mapping, and executive-ready risk quantification.
NIST FIPS alignment — gap analysis against FIPS 203 (ML-KEM / Kyber), FIPS 204 (ML-DSA / Dilithium), FIPS 205 (SLH-DSA / SPHINCS+), and draft FIPS 206 (FN-DSA)
Three-phase migration roadmap — Phase 1: crypto-agility enablement -> Phase 2: hybrid classical + PQC deployment -> Phase 3: full PQC cut-over with deprecation gates
HNDL-prioritised sequencing — systems ranked by data-retention period, regulatory classification, and intercept exposure to drive migration order
Cryptographic governance framework — algorithm-approval registers, SDLC crypto-review gates, procurement language for PQC-ready vendors, and exception-management process
Executive risk dashboard — maturity scoring across 5 domains, quantum-risk quantification in financial terms, and board-ready investment-prioritisation model
Let's Start →
NIST PQC STANDARDS
FIPS 203 — ML-KEM (Kyber)
KEM
FIPS 204 — ML-DSA (Dilithium)
DSA
FIPS 205 — SLH-DSA (SPHINCS+)
Hash
Phased Roadmap — Agility -> Hybrid -> PQC
Plan
FIPS 203
FIPS 204
FIPS 205
ROADMAP
06
NST ASSURE — OUTSIDE-IN CRYPTO ASSURANCE
NST Assure — Continuous Digital Trust
Outside-in, continuous monitoring of every externally exposed cryptographic asset — enumerating TLS handshakes, certificate chains, cipher negotiation, and protocol configurations from an attacker's vantage point.
External TLS handshake analysis — continuous probing of all internet-facing endpoints for key-exchange algorithms, detecting RSA-kex / ECDHE fallback and absence of ML-KEM hybrid negotiation
Certificate signature-algorithm tracking — monitoring leaf, intermediate, and root certificate signatures for quantum-vulnerable OIDs (RSA-SHA256, ECDSA-P256) and flagging hybrid / ML-DSA adoption gaps
Cipher-suite drift detection — alerting on regression to deprecated suites (TLS_RSA_WITH_AES_128_CBC_SHA), weak DH parameters (<2048-bit), and missing PQC-capable cipher offers
External API crypto posture — enumerating mTLS configurations, JWT signing algorithms (RS256 vs EdDSA), and OAuth token-exchange key types across publicly exposed API surfaces
PQC migration progress scoring — real-time dashboard tracking percentage of external assets offering PQC-hybrid handshakes, quantum-safe certificate chains, and forward-secrecy with ML-KEM
Automated regression alerts — instant notification when configuration changes, certificate renewals, or CDN updates reintroduce quantum-vulnerable cryptographic paths on any monitored endpoint
Let's Start →
NST ASSURE — OUTSIDE-IN CRYPTO ASSURANCE
TLS Handshake & Key-Exchange Probing
KEX
Certificate Signature-Algorithm Monitor
Cert
Cipher-Suite Drift & Regression Alerts
Drift
API mTLS & JWT Signing Posture
API
PQC Migration Progress Dashboard
Score
NST ASSURE
OUTSIDE-IN
ML-KEM
CONTINUOUS

Our Approach

Our Remote Access Infra Security Assessment includes an in-depth assessment of critical components of Remote Access infrastructure like NAC, AAA solutions, MFA, VPN Gateways, and software applications. Our tried and tested Assess-Validate-Respond (AVR) model-based assessment leverages a unique hybrid approach for identifying all possible remote access security issues.

Work Process Image

Configuration Review

We begin by understanding the organization's Remote Access goals, strategies and control objectives and then review the device security posture to identify how the current logical controls protect critical assets, sensitive data stores, and business-critical interconnections in accordance with the organization’s business and security objectives. The review covers Rule Sets, Policies, Logging and Auditing, and Compliance and delivers a comprehensive Risk Assessment report with remediation advisory.

Work Process Image

Passive Control Validation

Our comprehensive configuration review focuses exclusively on evaluating rules and configurations within the context of your specific solution. While configurations are examined, the effectiveness of the implemented controls and rules raises questions. To address this, we leverage the Control Validation exercise, a crucial step in ensuring the Solution's robustness. In this approach, we conduct an in-depth assessment without actively testing the Solution. Instead, we tactfully explore device-contextual techniques to challenge the existing controls, aiming to identify any potential weak points and bypass RA rules configured within.

Work Process Image

Active Penetration Testing

Active Penetration Testing involves rigorous, intrusive testing directly against the Solution itself. By subjecting the Solution to deliberate attempts to overwhelm or breach it, we gain valuable insights into its resilience and capacity to withstand attacks, ultimately enhancing its ability to enforce controls effectively.

Ready to assess your quantum readiness?
Share your requirements — we'll scope a PQC readiness engagement aligned to your cryptographic landscape.