.svg){kind=small}
Your post-quantum transition plan starts with a cryptographic stocktake
Any organisation, public or private, that wants the best cryptographic security available starts in the same place: a full list of its certificates and keys. Non-corporate Commonwealth entities have had to plan under PSPF Requirement 0223 since 1 July 2026.
- to 31 December 2026Systems of Government Significance stocktake, Direction 002-2026
- to 31 March 2027Legacy Technology Stocktake and plan, all non-corporate entities
- to the end of 2030ASD's recommended end for traditional asymmetric cryptography
- PKI specialists since 2011Designing, implementing and operating PKI for government and enterprise
- Common Criteria certified CAJellyfish CA certified against the CA Protection Profile (PP_CA_V2.1), April 2026
- NIAP listedJellyfish CA on the NIAP Product Compliant List
- ISO/IEC 27001:2022Information security management system certified
- Australian owned and operatedHeadquartered in Canberra. Delivery across Australia, New Zealand and internationally.
Where you stand
Find out where you stand today
Answer these and the page tells you which dates apply to you, what the report will ask, and the one thing to do this week. Your answers also fill in the quote form below.
No login, nothing stored. Change an answer at any time.
Where you stand
Answer question 1 to start. Most people finish in under a minute.
What the PSPF now asks for
The dates are set
Two requirements are scored every year. One direction has a date.
Post-quantum cryptography transition plan
A post-quantum cryptography transition plan, developed, implemented and maintained. In force from 1 July 2026 and scored in the annual protective security report.
Post-quantum algorithms on new equipment
Approved post-quantum algorithms supported on newly procured cryptographic equipment and software, in line with the ISM. In force from 1 July 2026 and scored.
Legacy Technology Stocktake
A Legacy Technology Stocktake and risk management plan by 31 March 2027. Entities that operate Systems of Government Significance report the stocktake of those systems by 31 December 2026.
ASD recommends ceasing the use of traditional asymmetric cryptography by the end of 2030 (PSPF Release 2026, section 13.10.2.3).
What the stocktake covers
We locate. Your team assesses and triages on our evidence.
ASD's LATICE framework has five phases: Locate, Assess, Triage, Implement, and Communicate and educate. We locate: automated discovery across the agreed scope records every certificate authority, certificate and key with its algorithm, key size, ownership and expiry. Your team assesses and triages on that evidence, because business impact and migration priorities are yours to set. We provide the inputs your Requirement 0223 plan needs.
- 1We locate
Locate
Automated discovery, within the agreed scope. We find certificate authorities, TLS and network certificates, keys and HSMs, authentication certificates, and SSH and code signing keys, and record each one's algorithm, key size, ownership and expiry.
- 2Your team assesses, on our evidence
Assess
We show which assets rely on RSA or elliptic-curve cryptography. Your system owners rate the business impact.
- 3Your team triages, on our evidence
Triage
We rank findings by technical exposure: algorithm, key size and expiry. Your priorities set the order of migration.
- 4We provide, you decide
Planning inputs
An executive summary, the cryptographic inventory, an exposure summary and recommended next steps, ready to inform your Requirement 0223 plan.
Discovery methods and access requirements are agreed during scoping.
Deployment and assessment options
Choose how it runs and how often
Select the deployment model and assessment frequency that suit your security and operational requirements.
- Executive summaryKey findings, cryptographic exposure and suggested next steps.
- Cryptographic inventoryIdentified assets, algorithms, key sizes and available ownership details.
- Cryptographic exposure summaryTechnical findings requiring further review.
- Recommended next stepsSuggested actions for validation by your technical and business teams.
- PQC planning inputsInventory and findings to inform your organisation's transition plan.
Business impact and migration priorities require your organisation's input.
Then we move your PKI
One domain at a time, while your current authority keeps running
Once the plan is set, we move your public key infrastructure to post-quantum algorithms one domain at a time, while your current certificate authority keeps running.
- Certificate authority certified against PP_CA_V2.1
- Signing keys in FIPS 140-3 Level 3 HSMs
- Hybrid and pure post-quantum algorithms
- Renewal through ACME, SCEP, CMPv3 and Microsoft auto-enrolment
Four certificate authority products in the world are certified against the CA Protection Profile. Three are American. The fourth is ours.
Our information security management system is certified to ISO/IEC 27001:2022. PKI specialists since 2011, Australian owned and operated.
As at October 2026. Sources: NIAP Product Compliant List; Common Criteria Portal.- Common Criteria certified CA: Jellyfish, PP_CA_V2.1, April 2026
- ISO/IEC 27001:2022
- FIPS 140-3 Level 3 HSMs
- PKI specialists since 2011
- Gatekeeper accredited
Why now
December does not move
Requirement 0223 is a question in the annual protective security report. The Accountable Authority signs it and sends it to the Minister by December. Start the stocktake this quarter and the answer is a plan under way. Start next year and the answer is a gap.
Scope it this month. Inventory and findings inside the quarter, in time to inform your Requirement 0223 plan and your next PSPF report.
Delivery weeks depend on your size and the deployment you choose. We confirm them when we scope the assessment.
The same work, with less time to act on what it finds. Certificates nobody listed stay unlisted, and the first the report hears of them is when one expires.
In February 2026, one undocumented certificate took Australian Parliament House web services down for six hours.
Questions
Before you talk to us
Is a post-quantum plan mandatory?
Yes, for non-corporate Commonwealth entities. Requirement 0223 of PSPF Release 2026 applies from 1 July 2026 and is a scored question in the annual protective security report. For corporate Commonwealth entities, the PSPF is better practice.
What does the stocktake cost?
We scope each assessment with you before we quote. Cost depends on your environment, the deployment you choose and how often it runs.
How does discovery reach our systems?
That depends on the deployment you choose. Customer-hosted runs inside your environment, operated by your team. Cogito-managed runs with agreed access and data handling. We agree discovery methods and access during scoping.
Does it help with Direction 002-2026?
It can. The inventory records each certificate authority, certificate and key with its algorithm, key size and expiry, which your team can test against the PSPF legacy criteria. The Direction itself does not mention cryptography.
Which algorithms will you move us to?
The ones the Information Security Manual approves. We confirm the parameter sets with you in the plan.
What happens next?
You request a scoped assessment. We agree a time for a 30-minute briefing to scope it, then send a quote.
Request a scoped assessment
Ten short questions
We use your answers to scope your assessment. About two minutes.
Find every key. Plan for 2030.
A scoped assessment, discovery on the deployment you choose, and findings that inform the plan your team owns.