ASVS 5.0 V11.1.4 (Level 3) requires a maintained cryptographic inventory together with a documented plan for migrating to new cryptographic standards, such as post quantum cryptography (PQC), so the team can react before a threat becomes urgent.
Why it matters
Algorithms age. Data encrypted today with a key exchange that a future quantum computer could break may be harvested now and read later. The teams that cope well are the ones that already know where every algorithm sits and who owns the change.
How to implement it
- Start from your inventory (see V11.1.2). Each row needs algorithm, key size, library, owner and data protected.
- Mark each row with a risk class: broken today, weak against future attacks, fine.
- Write the target state for each class, for example moving key exchange to a hybrid scheme once your TLS library ships a vetted one.
- Add dates, an owner and a rollback step per migration.
- Review the plan twice a year and after any major standards announcement.
How to test it
Ask for the plan and pick one row. Can the owner tell you the replacement algorithm, the date, and how the data would be re encrypted? If the answer lives only in someone's head, the control is not met.
Common mistakes
- Treating PQC as a future problem with no inventory today
- A plan with no dates or owners
- Hard coded algorithm names that make a swap a rewrite (see V11.2.2)
Quick check
Does V11.1.4 require you to deploy PQC today?
No. It requires an inventory and a documented path so you can migrate when approved standards are mature.
Sources
- OWASP ASVS
- NIST Post Quantum Cryptography project
