Automated Cryptographic Discovery and Inventory

ACDI is CISA’s vocabulary. Its Strategy for Migrating to Automated Post-Quantum Cryptography Discovery and Inventory Tools, dated 15 August 2024, was written because OMB Memorandum M-23-02 directed CISA to produce one, in consultation with NIST and NSA. Its stated purpose is "to support the assessment of FCEB progress towards PQC adoption using automated cryptography discovery and inventory (ACDI) tools".

The strategy’s scope is United States federal civilian agencies, and it covers both cloud-based and on-premises systems. The vocabulary has travelled well beyond that scope, because the underlying problem is the same everywhere: an inventory compiled by hand is out of date by the time it is finished.

CISA names four cryptographic discovery types. In its own words, ACDI tools "either individually or in combination, provide the following cryptographic discovery types: network, file system, database system, or software package", the combination of which covers encryption for data in transit and data at rest. The strategy does not define what each type covers, and it sets no performance requirements for tools.

Three of four, stated plainly, because a capability table that claims everything is worth nothing to somebody running an evaluation. Software package discovery is exactly the type CISA itself flags as hardest, and where it expects vendor engagement and manual tracking to remain necessary.

Every entry in the inventory carries first seen and last seen timestamps, and a rescan updates the entry it matches rather than creating a second one. That is what makes comparison across scans possible at all.

When a rescan finds that an entry has got worse, a crypto drift event is recorded: a weaker algorithm, a lower TLS version, a changed cipher suite, a smaller key, or a higher quantum risk score, with the old and new values kept side by side. Alert rules can watch for drift and for policy violations, scoped to an asset or asset group with a minimum severity, and deliver to Slack, Teams, email or a SIEM over syslog. Alongside that, daily snapshots of the risk-tier distribution give a real trend line rather than a single reading.

Two boundaries worth knowing. Drift is recorded for degradation, so a remediation that improves an entry updates the inventory but does not raise a drift event. And there is no new-versus-removed delta report between two scans: entries absent from a complete rescan are removed from the inventory rather than reported as departures.

What is automated cryptographic discovery and inventory (ACDI)?

ACDI is the use of tooling to discover the cryptography an organisation runs and maintain a current inventory of it, rather than compiling that inventory by hand. CISA introduced the term in its August 2024 strategy for federal civilian agencies, where ACDI tools are described as providing four cryptographic discovery types: network, file system, database system and software package.

Which of CISA’s four discovery types does Quantum Sentinel cover?

Three of the four. Network discovery, file system discovery across SMB and NFS shares, and database system discovery across nine engines are all covered. Software package discovery is not: Quantum Sentinel does not inspect operating system packages, language dependencies or SBOMs. Its repository scanning reads source code, which answers a different question.

Does CISA’s strategy apply to organisations outside the US government?

Its scope is United States federal civilian agencies, excluding national security systems. The vocabulary and the method are useful to anyone building a cryptographic inventory, and the discovery types it names map cleanly onto a commercial estate, but it is not a regulation that applies to private companies.

How often can scans run?

On any schedule a standard five-field cron expression can express, in a timezone you choose, with blackout windows and a maximum runtime per schedule. Scans can also be run once, or started on demand through the API. The scheduler works to a one-minute resolution; this is scheduled scanning, not continuous real-time monitoring.

Does it detect changes between scans?

Yes. Entries carry first seen and last seen timestamps, and a rescan that finds a weaker algorithm, a lower TLS version, a changed cipher suite, a smaller key or a higher risk score records a crypto drift event with the old and new values. Alert rules can watch drift and policy violations and deliver to Slack, Teams, email or a SIEM. Drift is recorded for degradation, not for improvement.

Is discovery agentless?

Network, file share, database, network device, key manager and cloud discovery are all agentless and use each system’s own protocol or API with read-only credentials. Kubernetes discovery is the exception: it injects a read-only sidecar into the pod, because nothing outside a pod can see what is mounted inside it.

What does the inventory export as?

CycloneDX 1.7 JSON, plain JSON or CSV, plus reports in PDF, CSV or DOCX across report types including quantum readiness, NIST IR 8547, DORA, NIS2 and PCI DSS. A REST API and an MCP server provide programmatic access.

Can it run in an air-gapped environment?

Yes. Quantum Sentinel installs offline from a signed, checksum-verified bundle and runs on-premises and in air-gapped environments, including offline scan workers and signed offline updates.