Your quantum readiness roadmap
Start with visibility. Build a plan. Prepare your infrastructure for post-quantum security.
Quantum readiness is a coordinated effort across security, infrastructure, applications, and procurement. This roadmap helps IT professionals organize that work into manageable stages.
What does Q-day mean?
“Q-day” is an informal term for the point when a sufficiently capable quantum computer could break widely used public-key cryptography, including RSA and elliptic-curve cryptography. It is not a confirmed calendar date. Preparing means understanding your dependencies and planning their transition to post-quantum cryptography.
Long-lived confidential information deserves particular attention: an attacker could collect encrypted information today and attempt to decrypt it later. This is often called “harvest now, decrypt later.”
1. Establish ownership
Assign a program owner and bring together security, infrastructure, application owners, procurement, and risk management. Define the scope, reporting process, and business priorities.
Your first deliverable: A short project charter with named owners and an agreed starting scope.
2. Discover your cryptographic dependencies
Identify where hardware, software, and services depend on cryptography. Include TLS connections, VPNs, certificates, public-key infrastructure, SSH, code signing, identity systems, and third-party integrations.
Record the product, version, owner, cryptographic purpose, algorithms where known, and upgrade path. Include cloud services and appliances as well as applications you manage directly. Mark unknowns for investigation.
Your first deliverable: An initial cryptographic inventory linked to your asset register.
3. Prioritize by business risk
Consider how long information must remain confidential, the importance of each service, and how long migration will take. Give attention to sensitive long-lived data and systems that are difficult to upgrade or replace.
Your first deliverable: A ranked list of systems with documented reasons for their priority.
4. Engage your vendors
Ask each vendor which specific products and versions support standardized post-quantum cryptography, which functions are covered, and whether support is available now, in preview, or planned.
Request documentation on interoperability, licensing, performance, hardware requirements, and migration procedures. A general “quantum-safe” claim is not enough to establish readiness for your deployment.
Your first deliverable: A vendor readiness register with evidence, gaps, and follow-up dates.
5. Test before migrating
Select a limited pilot using supported implementations. Test compatibility with clients, gateways, certificates, monitoring, and dependent applications. Measure performance and verify fallback behavior and rollback procedures.
Your first deliverable: A pilot report with acceptance criteria and an approved migration approach.
6. Make readiness an ongoing practice
Build migration work into refresh cycles and procurement requirements. Update your inventory as systems change, track vendor developments, and review progress regularly. Favor designs that allow cryptographic algorithms to change without extensive rebuilding—an approach known as crypto agility.
Your first deliverable: A maintained roadmap with owners, dependencies, milestones, and review dates.
Start with official guidance
NIST: Post-Quantum Cryptography
Standards and background on post-quantum cryptography.
NIST NCCoE: Migration to Post-Quantum Cryptography
Resources on cryptographic discovery and migration.
CISA, NSA, and NIST: Quantum-Readiness Factsheet (2023)
Foundational planning guidance. Published before NIST finalized its first PQC standards in 2024.
This roadmap is a starting framework. Tailor implementation decisions to your environment, vendor documentation, and applicable requirements.