NCSC MILESTONE · DISCOVERY & PLAN DUE 2028
CipherMap inventories the cryptography running across your network — every algorithm, key length, certificate and negotiated protocol parameter, bound to the asset using it. Each asset is scored for exposure to future quantum attack, then compiled into a prioritised, standards-based migration plan aligned to the UK national timeline.
14 days
TYPICAL TIME TO FIRST FULL INVENTORY
0
KEYS OR PAYLOAD DATA LEAVING YOUR NETWORK
2035
NCSC DEADLINE FOR COMPLETED MIGRATION
01 — HOW IT WORKS
Four stages: discover, classify, score, plan.
Each stage takes the output of the one before it. No stage requires a change to a production configuration.
STAGE 01
Discover
Passive collectors read handshakes, key agreement, certificate stores and live configuration without changing a production setting.
TLS · IKEV2 · MACSEC · NETCONF · GNMI
STAGE 02
Classify
Every finding resolves to an asset, owner, network domain and data-protection purpose — the inventory describes the network, not just protocols.
ASSET BINDING · HNDL · AGILITY · FIRMWARE
STAGE 03
Score
A 0–100 exposure score weights algorithm break class, harvest-now-decrypt-later exposure, lifetime, blast radius and agility.
SHOR · GROVER · LIFETIME · RADIUS · LEAD TIME
STAGE 04
Plan
Findings become dated migration waves with target algorithm, governing standard, procurement dependencies and NCSC milestone.
2028 · 2031 · 2035 · FIPS 203–205 · CBOM
02 — LIVE SCAN
Scan of a reference operator network.
A representative scan modelled on a mid-size UK operator: two core sites, a regional transport ring, and the 5G core. The terminal above is a working sample — use it to inspect findings by severity.
18
ASSETS INVENTORIED
5
CRITICAL EXPOSURE
6
HIGH EXPOSURE
5
MEDIUM EXPOSURE
2
ALREADY PQ-READY
SEPP-LDN-01
TLS 1.2 · ECDHE P-256 · RSA-2048
CRITICAL
96 / 100
IPSEC-AGG-BHM-04
IKEV2 · DH GROUP 14 · PSK
CRITICAL
89 / 100
API-GW-OSS-01
TLS 1.3 · X25519MLKEM768 HYBRID
PQ-READY
14 / 100
03 — COVERAGE
Protocols and assets covered.
General-purpose discovery tools parse enterprise IT protocols. CipherMap parses the protocols that carry traffic, signalling and timing in an operator network.
Transport network
OPTICAL, AGGREGATION AND IP/MPLS BACKBONE
OPTICAL LAYER-1 ENCRYPTION KEY AGREEMENT + AEAD
MACSEC LINK PROTECTION CAK · SAK · CIPHER SUITE
IPSEC BACKHAUL & PEERING DH GROUP · AUTH METHOD
MANAGEMENT PLANE SSH · NETCONF · GNMI
ROUTING & TIMING RPKI · NTS-KE · PTP
Core network
5GC, EPC, SIGNALLING, SUBSCRIBER DATA AND PKI
SERVICE-BASED INTERFACES TLS 1.2 / 1.3 · CERT CHAINS
ROAMING SECURITY EDGE JWE · PRINS · TLS
SUBSCRIBER CREDENTIAL STORE KEY WRAP · HSM SLOTS
OPERATOR PKI & FIRMWARE SIGNATURE ALG · KEY LENGTH
OSS / BSS AND API ESTATE MTLS · CLIENT CERT INVENTORY
04 — NATIONAL TIMELINE
NCSC migration milestones, and where discovery sits.
The NCSC timeline sets three fixed milestones for UK organisations. CipherMap is built to complete the first and de-risk the two that follow.
NOW
CURRENT POSITION
Partial spreadsheets and undocumented knowledge. No authoritative inventory, therefore no defensible plan.
2028
DISCOVERY & PLAN DUE
Complete a full discovery exercise and produce a costed initial plan. This is CipherMap’s design milestone.
2031
HIGHEST-PRIORITY COMPLETE
Highest-priority activities completed as vendor support matures. Wave 1 and Wave 2 assets close out here.
2035
FULL MIGRATION COMPLETE
All systems, services and products migrated to post-quantum cryptography. Hardware refresh cycles are planned backwards from this date.
05 — OUTPUT
Migration plan output.
Every line names the asset, the target algorithm, the standard it derives from, and the prerequisite work. Waves are dated against the national milestones.
PQC MIGRATION PLAN / UK-REF-OPERATOR / REV 01
18 ASSETS · 6 DOMAINS · PDF / XLSX / CBOM
WAVE 01 — IMMEDIATE
BY 2028
Harvest-now-decrypt-later exposure
Traffic recorded today can be decrypted once a capable machine exists. Address classical key exchange first with hybrid ML-KEM alongside the existing curve, so protection improves without relying on a single new algorithm.
5 ASSETS
11 INTERFACES
WAVE 02 — PRIORITY
BY 2031
Trust anchors and long-lived signatures
Root CAs, firmware-signing services and device credentials need post-quantum trust anchors issued and distributed years before existing anchors expire.
7 ASSETS
24 INTERFACES
WAVE 03 — SCHEDULED
BY 2035
Hardware-bound and refresh-cycle assets
Assets governed by vendor roadmaps or implemented in silicon are replaced rather than patched. Plan procurement backwards from 2035 and set PQC requirements at tender.
6 ASSETS
19 INTERFACES
06 — DRONE OPERATIONS DEPENDENCY
Drone operations inherit the network’s cryptography.
DroneOD runs beyond-visual-line-of-sight operations over commercial cellular. Command and control, telemetry, and inspection imagery of national infrastructure transit the same transport and core network as every other subscriber.
WHAT A DRONE OPERATOR INHERITS FROM THE NETWORK
C2 LINK OVER CELLULAR APN
DTLS 1.2 / P-256
TELEMETRY BACKHAUL
IPSEC / MODP-2048
INSPECTION IMAGERY UPLOAD
HNDL / 25-YEAR LIFETIME
AIRFRAME FIRMWARE UPDATES
ECDSA P-384 SIGNING
07 — DEPLOYMENT
Deployment and data handling.
The tool operates read-only. It requires no privileged write access to production systems and stores no payload data or private key material.
COLLECTORS
Passive by default
Virtual or 1U collectors observe copied traffic and pull read-only configuration through existing accounts. Active probing is optional and rate-limited.
DATA HANDLING
Metadata only
CipherMap records algorithm identifiers, key lengths, certificate metadata and negotiation parameters. Payloads, private keys and subscriber data are never stored.
INTEGRATION
Exports to existing systems
The inventory exports as a CycloneDX cryptographic bill of materials, synchronises to your CMDB, and posts scoring changes to a SIEM.
08 — QUESTIONS
Common questions.
Why start now if quantum computers cannot break current cryptography yet?
We have already surveyed our vendors. Does that constitute discovery?
Which algorithms does the plan target?
Does every asset require migration?
What operational impact does the scan have?
What is produced for a board or a regulator?
09 — NEXT STEP
A scoped pilot on a single core site takes one week and produces a complete inventory for that site, with the scoring model and plan output applied to real findings.
Sample asset names, algorithms and scores shown on this page are illustrative, modelled on typical UK operator architecture.