Post-Quantum Cryptography Audit as a Service: CBOM, Mosca's Theorem, and a Roadmap to NIST PQC Standards

Quantum computers will not break your encryption tomorrow. But the migration deadline is already set: NIST's final IR 8547 (October 2026) deprecates all quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035. Google and Cloudflare both target their own migrations by 2029. The question is no longer whether to migrate — it is whether your cryptography inventory is ready.

I offer a structured post-quantum cryptography audit for organisations that need to know where they stand and what to migrate first.

What you get

• CBOM cryptographic inventory — a complete bill of materials for your cryptography: algorithms, keys, certificates, libraries, and protocols in scope.
• Shor/Grover risk analysis — which assets a quantum adversary can break, and which only lose security margin.
• Mosca's theorem (X+Y>Z) — shelf life of your data, plus migration time, versus time to a cryptographically relevant quantum computer, to prioritise what moves first.
• Migration roadmap — prioritised steps to NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA), including hybrid migration where appropriate.
• Written client report — findings, priorities, and next actions, based on a 29-point methodology across 6 phases.

Tooling

liboqs, oqs-provider, CBOMkit, PQCscan — plus a purpose-built audit parser with a 140-record knowledge base covering tools, standards, national programs, and published audit cases.

Timeline

Six weeks: weeks 1–2 inventory, week 3 risk analysis, weeks 4–5 roadmap, week 6 report and review.

Hire me

Find me on LaborX — freelancer profile Muse Notes (Writing and Translation).

You can also leave a comment here and I will reply.