Post-Quantum Readiness: Protect What Must Remain Secure
Quantum computing may eventually undermine widely used public-key cryptography. But the business exposure can begin much earlier.
Sensitive, and encrypted information may be collected today and retained for future decryption. Digital signatures, identities, certificates, software, devices, and trust infrastructures may also require years to identify and migrate.
DVC helps organizations understand where the real exposure lies, determine what must be addressed first, and develop a vendor-independent path toward post-quantum resilience.
Why act now?
The relevant deadline is not simply the arrival of a quantum computer
The critical question is whether information protected today must remain confidential or trustworthy for longer than the organization needs to discover, assess, and replace vulnerable cryptography.
For some data, the required protection period may be short. For intellectual property, strategic plans, personal information, legal records, machine identities, and long-lived infrastructure, the period may extend over many years.
The first three principal NIST Post-Quantum Cryptography Standards were finalized in 2024. Current migration guidance calls on organizations to begin identifying vulnerable cryptography and planning their transitions.
Evidence strip
“The first three principal NIST post-quantum cryptography standards, ML-KEM, ML-DSA, and SLH-DSA, were finalized in August 2024. The standards provide a foundation for implementation, but do not remove the need for enterprise discovery, architecture, and migration planning.”
Discovery must start now
NIST’s migration programme emphasizes cryptographic visibility, risk management, interoperability and benchmarking. Organizations need to identify where vulnerable public-key cryptography is used before they can prioritize and plan migration.
Migration is a multi-year undertaking
The UK NCSC calls for migration goals, discovery and initial planning by 2028, priority migration activities by 2031, and completion by 2035. These are planning milestones, not predictions of when a cryptographically relevant quantum computer will arrive.
Technical Impact
Function | Common mechanisms | Quantum concern | Broad response |
Key establishment | RSA, DH, ECDH | A sufficiently capable quantum computer could undermine the mathematical problems on which security relies. | Migrate to standardized quantum-resistant key-establishment mechanisms. |
Digital signatures | RSA, DSA, ECDSA | Long-term signature and trust models become vulnerable. | Migrate signature schemes and associated PKI and trust processes. |
Symmetric encryption | AES | Grover’s algorithm changes exhaustive-search economics, but not in the same way that Shor affects RSA and ECC. | Review key strength, data lifetime and use case. |
Hash functions | SHA-2, SHA-3 | Quantum effects differ from those affecting public-key cryptography. | Review output length and application. |
Why not start with a vendor?
PQC affects many technology layers:
- applications and APIs
- cloud and SaaS platforms
- networks and remote access
- identity and privileged access
- PKI, certificates, keys, and secrets
- software and firmware signing
- operational technology and connected devices
- suppliers and managed services.
No single product provides a complete enterprise view.
A premature technology decision can result in fragmented discovery, overlapping investments, incompatible approaches, or unnecessary supplier dependency. DVC begins with business exposure, digital assets, cryptographic dependencies, and architecture requirements before evaluating products.
The DVC Quantum Readiness Pathway
1. Frame
Identify critical information, business services, trust relationships, protection periods, and governance requirements.
2. Discover
Locate vulnerable cryptography across applications, infrastructure, platforms, devices, and third parties.
3. Assess
Connect cryptographic findings to business impact, data lifetime, exposure, ownership, and migration lead time.
4. Design and validate
Evaluate transition patterns, crypto-agility requirements, interoperability, performance, operational impact, and supplier options.
5. Orchestrate
Build and govern a phased roadmap across technology, risk, procurement, legal, business, and supplier stakeholders.
Start with decision-quality evidence
DVC’s initial offers help organizations answer five questions:
- What information and digital trust mechanisms require long-term protection?
- Where is vulnerable cryptography being used?
- Which exposures warrant early action?
- Which technology and supplier decisions are required?
- How can migration be phased without unnecessary disruption or lock-in?
FAQs
Why should organizations prepare for post-quantum cryptography now?
What is harvest-now-decrypt-later risk?
Is post-quantum readiness only a technology issue?
No. PQC readiness involves cybersecurity, enterprise architecture, data governance, procurement, suppliers, legal, risk, and executive decision-making. Cryptography is embedded across many systems and business processes.
Engineers who want to coach Scrum Masters in their roles
What is the first practical step toward PQC readiness?
The first step is to identify long-lived sensitive information, critical systems, cryptographic dependencies, and accountable owners. This creates the evidence needed to prioritize discovery and migration planning.
Can our vendors handle PQC migration for us?
Vendors are important, but they usually see only part of the environment. Organizations still need their own view of the information lifecycle, cryptographic usage, supplier dependencies, business risk, and migration priorities.
What does the readiness check provide?
The readiness check gives a directional view of current PQC preparedness and suggests a practical next step. It is not a technical audit or compliance
![[:en]cmc_logo_gold[:]](https://drvieweg.net/wp-content/uploads/elementor/thumbs/cmc_logo_gold-qmg2crjzwnou0e3z2s9vkv0i2343gnthvtai9c4vl4.jpg "[:en]cmc_logo_gold[:]"){kind=logo}
