See the artifact before the briefing.

CBOM excerpt — CycloneDX 1.7

Machine-readable inventory: every algorithm bound to where it was seen negotiating, scored with its NIST quantum security level, dependencies mapped.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:████",
  "version": 4,
  "metadata": {
    "timestamp": "2026-07-14T02:11:09Z",
    "component": { "type": "application",
      "name": "core-banking-gw" }
  },
  "components": [
    { "type": "cryptographic-asset",
      "name": "TLS1.2 · RSA-2048 · AES-128-CBC",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": { "type": "tls" },
        "nistQuantumSecurityLevel": 0 },
      "evidence": { "occurrences": [
        { "location": "10.█.█.█:443" },
        { "location": "10.█.█.█:8443" } ] } },
    { "type": "cryptographic-asset",
      "name": "SSH · sntrup761x25519",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem" },
        "nistQuantumSecurityLevel": 3 } }
  ],
  "dependencies": [
    { "ref": "svc-payments",
      "dependsOn": [ "TLS1.2 · RSA-2048" ] } ]
}

Readiness scorecard

Per-framework position driven by your migration-roadmap progress — every control Met, Partial or Gap, with evidence behind each row. PQCA scores per-control evidence across every framework it tracks — including SAMA (Saudi Central Bank) and the FIPS 140-3 / CMVP module transition (tracking). For FIPS 140-3 specifically, PQCA tracks your plan to move onto CMVP-certified modules. It does not validate modules, and it is not a substitute for CMVP.

One readiness number per framework, decomposable to the control — the format auditors ask to keep.

Roadmap extract — owner-assigned, budget-tracked

The migration as the board funds it: phased, owned, priced in your currency, tracked against the deadline clock.

Budgets redacted here — in your copy they carry real figures in your own currency.

تقرير مجلس الإدارة بالعربية — Arabic board report

The same board PDF, typeset in Arabic: contextual letter shaping, the lam-alef ligature (لا), right-to-left reordering, an Arabic organisation name and a classification footer — rendered from a bundled font, so it looks identical on an air-gapped server.