Everyday Security Workflows

Use these workflows to establish a cryptographic asset inventory, assess the detected use, and maintain evidence as your application changes. PostQ supplies inventory and assessment reports, review views, comparison, and exports. Track ownership, approvals, exceptions, and deadlines in your team's existing work-management system.

Establish an application baseline

1. Check language and library coverage for the application.
2. Run a project scan with an identifiable application version and record the source revision.
3. Open Crypto Functions and Operation Groups to review the detected calls, algorithms, libraries, and related operations against the application's known cryptographic use.
4. Open Assessment for security findings, quantum exposure, and unresolved configuration.
5. Retain the complete report folder, including the CBOM and manifest, as your baseline.
6. Associate the inventory with application ownership in your existing asset records. Import the CBOM into a compatible inventory tool when your process requires it.

The baseline records what PostQ found in that source and scan scope. Keep the scanner version, language selection, and exclusions available for later comparisons.

Review day-to-day security posture

1. Scan the current source using the team's agreed scope.
2. Open Assessment and review risks, weaknesses, recommendations, and manual-review counts.
3. Use Review gaps to identify items that need application-owner input.
4. Inspect priority groups and their source evidence.
5. Export the review selection and assign follow-up work in your tracking system.

In VS Code or Eclipse, compare completed scans to investigate changes from the baseline. Review scanner and scope changes when explaining differences in totals.

These reports describe source at scan time, not continuous monitoring of a deployed application. Keep operational security monitoring and runtime checks in your existing processes.

Investigate a cryptographic weakness

1. Filter findings by the relevant CWE, anti-pattern, or risk.
2. Open the affected function and its operation group.
3. Review the algorithm, parameters, confidence, and source locations.
4. Use the remediation guidance to define a change with the application owner.
5. Rescan the changed source and run the application's functional and security tests.

Keep the original and follow-up evidence with the work item. A finding disappearing can result from changed scope or lost evidence as well as a fix, so check the operation in both reports.

Prepare a PQC migration backlog

1. Select PQC priority and review quantum-broken and quantum-weakened operations.
2. Inspect each group's algorithm, purpose, parameters, and available migration guidance.
3. Separate operations with enough evidence for planning from those requiring manual review.
4. Add application ownership, data-protection lifetime, interoperability, and release dependencies in your planning system.
5. Export the selected groups or CBOM to support the migration inventory.

PostQ helps locate and assess cryptography. Application testing and implementation review are still needed to confirm that a proposed replacement meets your requirements.

Review crypto agility

1. Select a migration candidate from the cryptographic inventory or PQC review.
2. Inspect its operation groups for algorithm-specific calls, explicit configuration, and reported anti-patterns that can affect replacement.
3. Identify missing configuration and ask the application owner which deployment settings apply.
4. Review key and data formats, protocol compatibility, and dependent applications separately; source API use alone does not establish these dependencies.
5. Record the proposed change, dependencies, and required migration tests in your planning system.

Use this review to identify investigation and implementation work. The scanner's indicators do not measure migration effort or demonstrate that the application can switch algorithms safely.

Prepare compliance review evidence

1. Run a scan of the source revision in scope for the review.
2. Use FIPS review to locate source-level findings and evidence gaps.
3. Inspect the relevant groups and capture unresolved questions for the application owner.
4. Retain the complete scan with your review records.
5. Collect the required module and deployment evidence through your compliance process.

Use the assessment scope when describing the results. PostQ source assessment does not certify FIPS compliance.

Review cryptography during code changes

1. Run an IDE file scan for an initial review of changed source.
2. Open problem indicators and follow source links to investigate reported issues.
3. Inspect related operation groups before modifying a setup or completion call.
4. Run a project scan when the change needs wider source context.
5. Compare completed reports and retain the evidence required by your team's review process.

This workflow focuses on cryptographic coding and configuration. Continue using the team's existing tests and code review for application behavior and broader code quality.