Post-Quantum Cryptography Discovery and CBOM Solutions for Federal Agencies
Spice Labs helps federal, state, and local agencies answer a question most of them cannot currently answer: where, across thousands of applications, is cryptography already weak or about to become weak once adversaries have access to quantum computers?
Executive Order 14412 and OMB Memorandum M-26-15 have turned post-quantum cryptography from a long-range concern into a near-term obligation. Civilian agencies must name migration leads, inventory their cryptographic dependencies, and submit migration plans on fixed deadlines. Defense and intelligence organizations face parallel direction. In every case, the first step is the same and the hardest: building an accurate inventory of cryptographic assets across an application estate that was assembled over decades, often without as-built documentation, by contractors and staff who have long since moved on.
Spice Labs Surveyor is built for that first step. It scans applications and their dependencies to identify every instance of cryptographic use, flags algorithms and key lengths that are already deprecated or will be broken by quantum-capable adversaries, and produces a Cryptographic Bill of Materials in the CycloneDX standard that agencies can hand directly to auditors, inspectors general, and OMB. Findings roll up into a single view that a CISO can use to prioritize remediation and that an executive sponsor can use to report progress against the mandate.
The product is designed around public-sector realities. Surveyor IT Pro and Surveyor OT Pro run fully air-gapped, so classified and operational-technology environments can be inventoried without data ever leaving the boundary. Agencies that prefer a managed deployment can run the same capability as a hosted service. Coverage extends across languages and platforms, so a mixed estate of legacy and modern systems can be surveyed in one pass. For agencies that want expert help establishing a baseline, Spice Labs offers a fixed-scope Cryptographic Estate Baseline and PQC Risk Assessment that delivers a mandate-ready inventory and prioritized migration roadmap in ninety days.
The threat is not hypothetical. Adversaries are already collecting encrypted government data and signed artifacts today, knowing they will be able to decrypt or forge them later. Every year an agency delays its inventory is a year of data and software supply chain integrity exposed to that harvest-now-forge-later strategy.
Spice Labs is available to public-sector customers through Carahsoft on established contract vehicles, giving agencies a direct procurement path to begin their PQC transition now.
FAQ
A Cryptographic Bill of Materials is an inventory of every cryptographic algorithm, key, certificate, and library an application uses, expressed in a standard machine-readable format. OMB Memorandum M-26-15 and Executive Order 14412 require agencies to inventory their cryptographic dependencies as the first step in migrating to post-quantum cryptography, and a CBOM is how that inventory is documented and shared with auditors and oversight bodies. Spice Labs Surveyor generates CBOMs in the OWASP CycloneDX standard.
Spice Labs Surveyor automates the cryptographic discovery and inventory work that M-26-15 requires before an agency can produce a credible migration plan. It scans applications across an agency's estate, identifies quantum-vulnerable and already-deprecated cryptography, and produces the inventory and risk-ranked findings that migration leads need to prioritize remediation and report progress. For agencies starting from scratch, a fixed-scope 90-day assessment delivers a mandate-ready baseline.
Yes. Surveyor IT Pro and Surveyor OT Pro are delivered as customer-managed software that runs fully air-gapped, with no data leaving the agency boundary. A hosted option is also available for agencies that prefer a managed deployment for unclassified workloads.
Harvest now, forge later describes an adversary strategy of collecting encrypted data and digitally signed software today in order to decrypt the data or forge the signatures once quantum computers can break current public-key cryptography. Because the data and artifacts being collected now will remain sensitive for years, agencies face exposure well before a cryptographically relevant quantum computer exists, which is why federal mandates set inventory and migration deadlines now rather than later.
Spice Labs products and services are available to public sector customers through Carahsoft on established government contract vehicles. Contact the Carahsoft Spice Labs team for quotes, contract vehicle details, or to schedule a demonstration.