Cryptography Baseline Assessment
CBA — a read on what your crypto is, from the outside.
Get an external, attacker's-eye view of your exposure and a prioritized plan to close the gap. Expert-led, done in 4–8 weeks.
Who this is for
CISOs, heads of security, and compliance leads at organizations running critical infrastructure who:
- Want to prepare for an audit or a compliance deadline.
- Realize cryptographic hygiene is a priority before committing to a migration plan.
- Want a clear, manageable roadmap they can act on.
What you get
- An outside view, from the attacker's angle.
- Expert interpretation of your exposure.
- A remediation roadmap, ranked by business risk: high-impact systems first, then medium, then low.
- Clear next steps.
How it works
- 1. Interviews and questionnaires, scoped to your organization's size.
- 2. An external perimeter scan — no access to your systems needed.
- 3. A report and remediation roadmap, delivered in 4–8 weeks for €10–15K.
Sample finding: "TLS 1.0 still active on 3 externally-facing endpoints."
What the scan looks at
Three things, in that order, because each one narrows the next.
- Inventory. Which algorithms, key sizes, protocols and implementations run on your perimeter, where they are and how they are configured. This is where ancient algorithms still in production, mismatched key sizes across identical systems and protocols deprecated years ago turn up.
- Vulnerability. Which of those create real, exploitable risk in your environment rather than in theory: weak cipher suites, legacy protocol fallbacks, misconfigured TLS endpoints, and gaps in key management and rotation.
- Comparison. How the estate measures against the relevant standard, your stated policy and its own majority behaviour. This turns a list of findings into an order to work through.
Why the timing matters
Crypto agility is the ability to inventory, assess and change cryptography without redesigning the whole estate. It matters because algorithms, dependencies and regulatory expectations change at different speeds.
The assessment does not make that work disappear. It gives you the order: which exposed paths to address first, what evidence is missing and where a broader migration needs design work.
CMB vs CBA
The CMB is self-reported and tells you what you believe your cryptography is. The CBA reveals what it truly is.
Questions only the CBA answers:
- Which certs are exposed?
- Which protocols are negotiable?
- What looks vulnerable to recon?
CBA — Cryptographic Baseline Assessment. Expert-led external perimeter scan. Paid engagement.
Spec
CMB vs CBA
Assessment inputs
Drivers
Quantum computing against RSA and ECC; NIST post-quantum standardisation; regulatory quantum-safe timelines; zero-trust requiring dynamic, granular cryptography.
Answers only CBA gives
- Which certificates are exposed.
- Which protocols are negotiable.
- What is vulnerable to reconnaissance.