Which Regulators Require A Cryptographic Inventory?

Almost every post-quantum roadmap starts with the same step: find out where your organisation uses cryptography. A cryptographic inventory records the algorithms, protocols, keys and certificates in use, where they sit and what they protect. Without one, a migration plan is guesswork.

It is often said that regulators now require such an inventory everywhere. That is not accurate. As of October 2026, an inventory is binding under a short list of instruments, and recommended under many more. A cryptographic bill of materials (CBOM), a structured machine-readable inventory, is named by even fewer. This article sets out who requires what, using the status labels explained in the overview. It is general information, not legal advice.

Where An Inventory Is Binding Today

Five instruments make some form of cryptographic inventory a requirement, each with a different scope.

PCI DSS v4.0.1 requirement 12.3.3 expects a current list of the cipher suites and protocols in use, showing what each does and where it runs, plus an active watch on whether each stays safe and a written plan for reacting to cryptographic weaknesses that can be seen coming. The whole set is revisited at least every 12 months. Requirement 4.2.1.1 adds an inventory of the trusted keys and certificates that protect card numbers in transit. Both were best practices until 31 March 2025 and have been required since then, binding through card scheme contracts.¹

The DORA technical standard for ICT risk requires EU financial entities under DORA’s full ICT risk framework to keep a register of all certificates and certificate-storing devices, at least for assets that support critical or important functions, and to keep it current.² It does not name an algorithm inventory, but the same standard requires entities to update cryptography as cryptanalysis develops, which is hard to do without one.

SAMA Circular 482021280 requires Saudi financial institutions to make their procedures for identifying and classifying all cryptographic assets accurate and comprehensive by the end of Q4 2026.³ The UAE National Encryption Policy requires federal and emirate government entities and non-government critical infrastructure operators to keep a record of every system and application that relies on public key cryptography.⁴ The Council’s Information Assurance Standard v2.1 repeats that duty as a sub-control of control T3.4.4, but the control applies according to each entity’s risk assessment, and an entity may vary or skip its sub-controls with documented justification and accepted risk.⁵ In the United States, the Quantum Computing Cybersecurity Preparedness Act requires federal agencies to keep a current inventory of IT that is vulnerable to quantum decryption.⁶

India’s securities regulator, SEBI, sits between binding and recommended. Its Cybersecurity and Cyber Resilience Framework, which binds SEBI-regulated entities, lists indicative measures for quantum risk, and the first says that entities shall maintain an inventory of cryptographic assets, putting critical assets first for post-quantum migration.⁷ The wording is mandatory in form but presented as indicative, so how strictly it applies is a question for SEBI.

Where It Is Expected But Not Required

A longer list of regulators and agencies recommends an inventory without making it a rule. The EU NIS Cooperation Group says NIS2 entities should, at a minimum, build an inventory of cryptographic assets and dependency maps.⁸ FINMA in Switzerland recommends a risk analysis and inventory that prioritises data exposed to harvest now, decrypt later (Supervisory). In June 2025 the Japanese FSA told banks to start roadmap, inventory and risk assessment work immediately and said it would follow up through monitoring. OSFI’s quantum readiness bulletin in Canada makes inventory its second phase, and the UK NCSC advises a full discovery exercise by 2028.⁹

Singapore’s CSA asks critical infrastructure owners to submit a migration plan by 31 March 2027, which cannot be written without an inventory.¹⁰ The handbook calls its milestones requirements for these owners, but it also describes itself as informational and not mandatory, so this group labels them Supervisory. MAS’s 2024 advisory lists an inventory of cryptographic solutions among measures firms should consider.¹¹ These are supervisory expectations or guidance, and the regional articles give the details.

Which Rules Name A CBOM

No regulator found requires private firms to produce a CBOM as of October 2026. The term appears in US federal policy and in India. OMB M-26-15 says agency inventory data should populate a central CBOM, and Executive Order 14412 directs CISA and NIST to publish the minimum elements of a CBOM within 270 days, which falls on 19 March 2027.¹² India’s national quantum roadmap recommends that organisations request CBOMs from vendors from FY 2026-27 and make them mandatory in procurement from FY 2027-28. The RBI’s Q-SAFE committee will assess the financial sector’s cryptographic inventory through a CBOM.¹³

Does A Binding Inventory Apply To You

The flowchart below is a first screen against the binding duties above. It does not cover every sector rule, and a no at the end does not mean an inventory is optional in practice: most supervisors now expect one.

What A Combined Inventory Should Capture

The binding rules ask for overlapping fields. PCI DSS wants a current record of the cipher suites and protocols in use. DORA wants every certificate and the device that stores it. SAMA wants assets classified, which in practice means by data sensitivity and migration priority. The UAE policy wants every system that uses public key cryptography, the part a quantum computer would break.

An inventory built for PCI DSS, extended with certificate and key store data and with classification fields, covers most of the binding duties found in this research. The Preparing For Migration group explains how discovery works and what fields to record, and Cryptography Compliance covers the PCI and DORA wording in depth.