Blue Mesh Quantum Safe Talk to us

Solutions · Understand. Prepare. Deliver.

What <CODE> discovers

<CODE> (Cryptographic Discovery for Enterprises) helps you identify, assess and prioritise cryptographic risk across networks, applications, cloud environments and critical systems. Through structured discovery, regulatory assessment and expert consultancy, <CODE> gives you the roadmap to move from quantum vulnerability to quantum readiness.

The same estate we review and protect, from cloud to security tooling.

  • Cloud
  • Data centre
  • Network devices
  • Connected devices
  • Applications
  • Security tooling
Book a conversation See how it works

What <CODE> does

Our ready-to-go consultancy package helps you:

  1. Understand your current cryptographic position
  2. Identify your exposure to quantum threats
  3. Meet emerging regulatory requirements
  4. Build a practical roadmap to crypto-agility
  5. Create an evidence-based transition plan towards quantum safe governance

Why now

The timeline to quantum safe is set.

Data intercepted today can be stored and decrypted once capable quantum computers arrive: “harvest now, decrypt later”. The NCSC and NIST have now set dates for moving away from today’s public-key cryptography: RSA and elliptic-curve cryptography (ECC), including ECDSA signatures and ECDH key exchange, even where ephemeral keys are used.

  1. 2028NCSC

    Complete discovery and assessment, and an initial migration plan.

    This is the step <CODE> delivers.

  2. 2030NIST

    Quantum-vulnerable public-key algorithms are deprecated after 2030.

  3. 2031NCSC

    Complete your highest-priority migration to protect your most critical assets.

  4. 2035NCSC and NIST

    Complete migration to post-quantum cryptography. NIST disallows quantum-vulnerable algorithms after 2035.

Sources: NCSC, Timelines for migration to post-quantum cryptography (March 2025); NIST IR 8547, Transition to Post-Quantum Cryptography Standards (October 2026).

How it works

Consultancy, combined with the best software tooling.

  1. Step 1

    <CODE> Scoping Workshop

    Working in small groups of three or four, we align your stakeholders, map your requirements against regulatory deadlines and scope your domains: cloud, on-premises servers, source code, IoT, and identity and access. You leave with a prioritised list of domains and a draft roadmap.

  2. Step 2

    Automated discovery

    Specialist tooling scans your hybrid and multi-cloud estate. It records the algorithms, key lengths and protocols in use, links keys to the services they protect, and finds the blind spots.

  3. Step 3

    Analysis and roadmap

    We rank the risks and changes needed: quick wins that reduce your exposure fast, and the strategic projects, such as moving key management to crypto-agile software, that make you quantum safe for the long term.

The programme

From discovery to a living CBOM.

<CODE> starts with discovery, builds your Cryptographic Bill of Materials (CBOM) phase by phase, then keeps it current as a managed service. Your picture of your cryptography gets sharper at every phase, and stays accurate as your estate changes.

The CODE programme, phase by phase Before contract: the CODE Scoping Workshop, then the Statement of Work. Programme weeks 1 to 26: full asset discovery, cloud phase, build CBOM number 1 as a test, asset phase, hinterland and undisclosed assets, vendor engagement, build CBOM number 2, and governance handover. Then Living CBOM as a Service for three years: a CBOM refresh in quarters 1, 2 and 3, and an annual CBOM and governance report in quarter 4 of each year. SCOPING PROGRAMME LIVING CBOM AS A SERVICE <CODE> Scoping Workshop Statement of Work Full asset discovery Cloud phase Build CBOM #1 · test Asset phase Hinterland and undisclosed assets Vendor engagement Build CBOM #2 Governance handover Quarterly CBOM refresh Q1 Q2 Q3 Q1 Q2 Q3 Q1 Q2 Q3 Annual CBOM and governance report Y1 Y2 Y3 Wk 1 6 12 18 26 Pre-contract Year 1 Year 2 Year 3
  • Before contract
  • Discovery workstreams
  • CBOM builds
  • Governance
  • Quarterly refresh
Indicative timeline for a large enterprise estate. Not to scale.

  1. Before contract

    Scoping Workshop and Statement of Work

    We work with your team to understand your estate and agree exactly what we will find, and how.

    • <CODE> Scoping Workshop with your stakeholders
    • Agree what “100% of the estate” means for you
    • Statement of Work with clear phases and milestones

    You get: an agreed scope, plan and price.

  2. Programme · Weeks 1–26

    Build the <CODE> CBOM

    Tooling, owner contacts and vendor research build one validated CBOM, tested with you halfway through.

    • Full asset discovery, then the cloud phase
    • CBOM #1 test build checks the reporting is what you want, and that it repeats
    • Asset phase, including hinterland and undisclosed assets
    • Vendor engagement on post-quantum readiness
    • CBOM #2 and a risk-prioritised roadmap aligned to NIST FIPS 203, 204 and 205

    Every asset ends in one of four statuses:

    Observed by toolsConfirmed by ownerVendor statementResidual list

    You get: the final CBOM, roadmap and governance handover.

  3. Managed service · Years 1–3 and beyond

    Living CBOM as a Service

    Your estate keeps changing. As a managed service, we keep your CBOM current so it stays a working GRC asset, not a one-off report.

    • CBOM refreshed in quarters 1, 2 and 3
    • Annual CBOM and governance report in quarter 4, reflecting the NCSC Cyber Assessment Framework and ready for ISO 27001
    • Migration progress and new vendor PQC statements tracked
    • Delivered by Blue Mesh, directly or through MSP partners

    You get: evidence that stays current to 2035.

What you get

The evidence your leadership team needs for informed governance.

  • Cryptographic Bill of Materials

    A standardised C-BoM of the algorithms, key lengths and protocols across your estate.

  • Cryptographic inventory

    A detailed metadata inventory, including algorithms, protocols and expiry dates, to support your Cyber Assessment Framework (CAF) status.

  • Post-quantum readiness score

    A clear measure of how ready each part of your estate is for post-quantum cryptography.

  • Regulatory compliance report

    The legislation and financial liability risks that affect your organisation.

  • Consultancy plan and roadmap

    A full execution roadmap with agreed timelines, costs and a stakeholder RACI matrix.

  • Board presentation

    A concise summary for executive decision-makers.

Standards alignment

Built around the NCSC CAF and ISO 27001.

  1. <CODE>Finds and validates the cryptography across your estate
  2. CBOMThe evidence: algorithms, keys, certificates and protocols
  3. CAFFindings mapped to principles A3, A4, B3, B4 and C1
  4. ISO 27001Audit-ready policy and evidence for crypto-agility

NCSC Cyber Assessment Framework (CAF)

We map your findings to the CAF principles that depend on knowing your cryptography. That helps you evidence “Achieved” status, including justified confidence in the cryptography that protects data in transit and data at rest.

  • A3 Asset management
  • A4 Supply chain
  • B3 Data security
  • B4 System security
  • C1 Security monitoring

ISO 27001

<CODE> works from the bottom up. Your C-BoM informs the audit actions and roadmap, structured by the CAF, which then becomes the auditable evidence for your ISO 27001 crypto-agility policy. Policy statements and evidence are ready for audit.

Who it is for

For organisations that must show their cryptography is under control.

  • CISOs and security leaders
  • Boards and risk committees
  • Managed service providers
  • Critical suppliers
  • Critical national infrastructure

Resellers and MSPs: <CODE> is channel ready, with strong margins. Partners can support asset discovery, while Blue Mesh delivers and signs off every engagement through our in-house CISSP-certified consultants. Partner with us →

Contact us

Let’s talk about your quantum safe journey.

Contact us for any conversation about quantum safe consultancy, Quantropi’s solutions, or a proof of concept or pilot you wish to develop as a business.

Book a conversation