Post-quantum security is often described as a distant cryptography problem. For most companies, the first challenge is much closer to home: no one has a complete map of the cryptography already protecting their systems, data and suppliers.
A cryptographically relevant quantum computer does not exist today, but migration cannot begin the day one appears. Standards, software, certificates, contracts and operational habits all take time to change. NIST also highlights a “harvest now, decrypt later” risk: data captured today may become readable later if it is protected by vulnerable public-key cryptography and needs to remain confidential for many years.
CISA makes the operational point plainly: moving to post-quantum cryptography takes time to plan and conduct. That is why a useful first step is a bounded discovery exercise that produces an owner, a priority and an evidence trail—not a broad promise that the whole estate is already safe.
Start with discovery, not an algorithm.
A sensible first question is not “Which post-quantum algorithm should we buy?” It is “Where do we rely on cryptography, and who owns each decision?” A useful discovery pass should cover more than a public TLS endpoint.
Turn the map into a short pilot.
A small team does not need to inventory its entire estate in one week. Choose a bounded scope: one public domain, one critical application, one data store or one supplier path. Record the current protocol, certificate chain, key lifecycle, owner, dependency and business importance. Then mark what is known, what is assumed and what still needs evidence.
A FOUR-WEEK STARTER PLAN
- Map. List the systems, data flows and cryptographic touchpoints inside the agreed boundary.
- Prioritise. Rank assets by data lifetime, business impact, exposure and supplier dependency.
- Verify. Confirm observations with system owners and capture evidence that another person can review.
- Roadmap. Separate quick controls, compatibility tests, procurement decisions and longer migrations.
What good evidence looks like.
Good evidence is specific enough to support a decision. It identifies the asset, the cryptographic mechanism, the owner, the source and the date checked. It also records uncertainty honestly. A public scan can provide a useful signal, but it does not prove that every internal service, backup, dependency or supplier is ready. The goal is a defensible queue of next actions—not a reassuring score with no owner.
BEFORE YOU CALL THE PILOT READY
- Have we agreed the boundary and the business owner?
- Can we name the long-lived data that deserves priority?
- Have we recorded algorithms, certificates, keys and dependencies without collecting private keys?
- Does each open issue have a next action and a review date?
This is the starting point for the Q-Ready series: make the unknown visible, keep the scope safe and build a migration plan that engineering, security and leadership can use together. Start with the Q-Ready Check for one public endpoint, then use the evidence to decide whether a wider pilot is justified.
WATCH · NIST
Why the migration deserves a plan.
This short NIST explainer introduces post-quantum cryptography, the risks around future quantum attacks and why standards-based preparation belongs on today’s roadmap.
Watch the NIST videoRESEARCH NOTE
Use evidence as the hand-off.
The strongest pilot record connects an observed asset to its owner, risk, test result and next action. That is how technical discovery becomes a decision leaders can fund and teams can repeat.
Read the NIST NCCoE FAQ