---
title: Start a crypto inventory against NIST IR 8547: where you still terminate RSA/ECDSA, what must live past 2030, and which vendors have a PQC date | ctxsec
url: https://ctxsec.com/items/tip-start-pqc-crypto-inventory-now
description: ""
status: "guidance"
published: 2026-10-28
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-start-pqc-crypto-inventory-now.md)

guidance

2026-10-28

### Start a crypto inventory against NIST IR 8547: where you still terminate RSA/ECDSA, what must live past 2030, and which vendors have a PQC date

With [NIST IR 8547](/items/nist-ir-8547-pqc-transition-roadmap) out:

1. List every place you terminate TLS, sign code/firmware, issue certificates or wrap keys (load balancers, APIs, VPNs, HSMs, IoT).
2. Flag data that must stay confidential past 2030 — that traffic is the harvest-now-decrypt-later priority for hybrid or PQC key establishment.
3. Ask each major vendor for their PQC / hybrid roadmap and whether federal 2030/2031 dates are in scope for your contracts.

Sources: [NIST IR 8547: Transition to Post-Quantum Cryptography Standards (October 2026)](https://doi.org/10.6028/NIST.IR.8547)