Scope
NCII systems, applications and services in scope.
Cryptographic Inventory for NACSA Directive No. 9
A cryptographic inventory records where an organisation uses cryptography, which algorithms and key lengths, and what depends on them, as NACSA Directive No. 9 requires of NCII entities. NACSA Directive No. 9 requires NCII entities to provide data on their post-quantum cryptography migration, starting with an inventory of where cryptography is used. We build the inventory and prepare the submission. Migration engineering is out of scope.
Cryptographic Inventory for NACSA Directive 9
What it is
A documentation service that identifies where cryptography is used across NCII systems, applications and services, records algorithms and dependencies, and prepares the data NACSA requests.
Why organisations need it
Directive No. 9, in force since 22 September 2025, requires NCII entities to provide post-quantum cryptography migration data within three months of a written notice from NACSA, using NACSA's form, starting with a cryptographic inventory. Most organisations have never catalogued their cryptography, and three months is short for a first inventory.
What the engagement covers
Discovery
Where encryption, signatures and certificates are used.
Algorithm records
Algorithms, key lengths and libraries.
Dependencies
Vendors and third-party components.
Prioritisation
Systems most exposed to quantum risk.
Submission
Data prepared in NACSA's format.
What the business gets out of it
Deadline met
Inside the three months.
A reusable inventory
Foundation for later migration.
Vendor clarity
Know what depends on suppliers.
Priorities set
Where migration matters most.
Scoped sensibly
Inventory, not engineering.
How it works
How the engagement runs
01
Notice review
Understanding the request.
02
Discovery
Interviews, documents and tooling outputs.
03
Inventory
Building the register.
04
Validation
Review with system owners.
05
Submission
Preparing the NACSA data.
Deliverables
What you receive
Cryptographic inventory
Systems, algorithms and owners.
Vendor dependency list
Third-party components.
Priority list
Exposure ranking.
NACSA submission data
In the requested format.
Next steps note
What migration will involve.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
NCII entities that receive a written notice from NACSA must provide post-quantum cryptography migration data within three months of the notice, using NACSA's form. Directive No. 9 has been in force since 22 September 2025, so notices can arrive at any time.
No. We build the cryptographic inventory and prepare the submission NACSA requests. Migration engineering, replacing algorithms in live systems, is specialist work beyond our basic-to-mid cybersecurity scope, and the inventory is what that later work starts from.
Where cryptography is used across NCII systems, applications and services; the algorithms and key lengths; the libraries and vendors involved; and how important each system is. Together that shows which systems are most exposed and hardest to migrate.
Usually six to ten weeks, depending on the number of systems. Three months from a NACSA notice is short for a first inventory, which is why starting before a notice arrives is the safer course.
Directive No. 9 names the Malaysian cryptology technology and management centre as the coordinator under NACSA. Submissions follow NACSA's form, and we prepare the data in that format.