FREE EXECUTIVE RESOURCE
Enterprise Cryptographic Exposure & Control Readiness Checklist
Twenty-four questions to make your evidence gaps, operating boundaries and next decisions visible.
Use the checklist to frame a better conversation.
For each question, record one of four states: evidenced, partially evidenced, unknown, or not applicable with rationale. Identify the source, review date, accountable owner and next action. Do not turn the number of checked items into a compliance score.
Download the readiness checklist01 / CONTROL QUESTIONS
Business scope & ownership
- Can you name the business services that rely on cryptography?
- Is there an accountable owner for each system and key domain?
- Are assessment boundaries, permitted evidence and exclusions agreed?
- Are business impact, data retention and recovery needs documented?
02 / CONTROL QUESTIONS
Inventory & evidence quality
- Are algorithms, purposes, platform versions and dependencies inventoried?
- Can each material assertion be traced to a source and review date?
- Are advertised, supported, enabled and observed-used capabilities separated?
- Are missing, stale or conflicting records labeled as unresolved?
03 / CONTROL QUESTIONS
HSM & key lifecycle controls
- Are access rights and separation of duties reviewed?
- Are dual control and split knowledge verified for the actual procedure?
- Are generation, import, rotation and retirement documented?
- Is recovery evidence current, with tested owners and authorization paths?
04 / CONTROL QUESTIONS
Payment & tokenization boundaries
- Are sensitive-data and token flows mapped across applications and APIs?
- Are detokenization privileges and exception paths explicit?
- Have logs, backups and downstream copies been considered?
- Are PCI DSS scope assumptions distinguished from assessor determinations?
05 / CONTROL QUESTIONS
Post-quantum & crypto-agility
- Are quantum-vulnerable public-key dependencies identified?
- Are target algorithms matched to key-establishment or signature purpose?
- Are vendor capability claims tied to exact-version evidence?
- Does prioritization include validation, change windows and rollback?
06 / CONTROL QUESTIONS
Governance & executive decisions
- Does every material finding have an owner and a next action?
- Are limitations and residual risks visible in executive reporting?
- Are remediation plans separate from production authorization?
- Can leadership explain why each investment or change is prioritized?
What to do with the unknowns
Separate the absence of evidence from evidence of a failing control. Both can require attention, but they lead to different next actions. Name the owner who can obtain the missing record or validate the operating path, then prioritize according to business consequence.
Bring the decision—not the evidence—to the first conversation
If the questions reveal a difficult boundary, a migration dependency or an operating-control gap, describe the business objective at a high level. We can agree the appropriate advisory scope and secure evidence handling separately.
YOUR NEXT STEP
Let’s define the decision before the engagement.
Start with a high-level business conversation. Evidence handling, scope and operating boundaries come next.