Q-Day Readiness: Five Actions IT Teams Can Take Now
Preparing for quantum risk begins with understanding your environment—not predicting a deadline.
For IT teams, the practical task is to identify dependencies on quantum-vulnerable public-key cryptography and build a realistic migration plan. Start with these five actions.
1. Give the work an owner
Assign someone to coordinate quantum readiness across security, infrastructure, applications, and procurement. Start with a defined scope, such as remote access, public-facing applications, or systems handling long-lived confidential data.
Take action: Schedule an initial planning session and identify the system owners who need to participate.
2. Build an initial cryptographic inventory
Your asset inventory is a starting point, but it probably does not describe how each system uses cryptography. Investigate TLS, VPNs, SSH, certificates, code signing, identity integrations, and third-party services.
Record the product, version, owner, cryptographic function, and algorithms where known. Mark unknowns explicitly so they become investigation tasks.
Take action: Inventory one important service from end to end, including its clients, gateways, and external dependencies.
3. Identify information that needs lasting protection
Some information must remain confidential for many years. Assess which systems handle that information and how difficult they will be to migrate.
Consider both the required confidentiality period and the time needed to change the underlying technology. Use those findings to prioritize further assessment.
Take action: Ask data owners to document confidentiality requirements for your most sensitive information.
4. Ask vendors specific questions
A broad “quantum-safe” statement does not tell you whether your deployment is covered. Ask about exact products, versions, algorithms, supported protocols, and availability.
- Is the capability generally available, in preview, or planned?
- Which cryptographic functions does it protect?
- Are new hardware, licenses, or application changes required?
- What compatible clients and peers are needed?
- How can we test and verify the protection?
Take action: Send a consistent questionnaire to your key vendors and record their answers with supporting documentation.
5. Plan a controlled pilot
Choose a limited test environment and a vendor-supported implementation. Define success before testing: interoperability, performance, monitoring, fallback behavior, and rollback all need attention.
Use the findings to estimate migration effort and identify dependencies that could delay a production rollout.
Take action: Write a pilot proposal with a system owner, test scope, acceptance criteria, and rollback plan.
Your first milestone
Aim for a named owner, an initial inventory, documented priorities, vendor responses, and a pilot proposal. These give your organization a concrete foundation for planning and budgeting.
Sources and further reading
NIST: Post-Quantum Cryptography
NIST NCCoE: Migration to Post-Quantum Cryptography
CISA, NSA, and NIST: Quantum-Readiness Factsheet (2023)
This article provides a starting framework. Follow current vendor documentation and the requirements applicable to your organization when planning implementation.