What requirement 12.3.3 asks
PCI DSS 4.0 requirement 12.3.3 asks merchants and service providers to document every cryptographic cipher suite and protocol in use, review that list at least once every twelve months, and keep a plan for responding to anticipated changes in cryptographic vulnerabilities. It became mandatory in March 2025.
That last clause matters. The arrival of quantum computers capable of breaking RSA and elliptic-curve cryptography is the most anticipated cryptographic change on the horizon.
Where a PCI inventory falls short
A cipher-suite list built for PCI usually covers the cardholder data environment and its TLS endpoints. Quantum readiness needs more:
- Cryptography outside the cardholder data environment, such as HR, legal and research systems holding long-lived data.
- Keys, certificates and signing infrastructure, not only negotiated cipher suites.
- Cryptography in application code and third-party libraries.
- Data shelf life, so you can tell which systems face harvest-now risk.
Extending it into a CBOM
The practical move is to treat the PCI inventory as the first slice of a full cryptographic bill of materials. Keep the same owners and annual review cycle, widen the scope to the rest of the estate, and record it in a standard format such as CycloneDX so it can be scanned, diffed and audited.
Next steps
- Pull your current 12.3.3 documentation.
- Run a free code scan on one payment application to see what the list misses.
- Agree a wider scope and timeline for a full CBOM.