QUANTUM READINESS · POST-QUANTUM CRYPTOGRAPHY
Quantum readiness is a planning task.
The replacement encryption standards exist, and governments have set their own migration dates. Know where you rely on cryptography, which data must stay secret for years, and what your vendors will change, then plan the move in the right order.
What is known
- NIST published the first post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
- Since June 2026, federal agencies have binding migration deadlines, and a federal contracting rule for their suppliers has been ordered.
- Data captured today can be stored and decrypted later, once it becomes possible.
- Most organizations will migrate by upgrading vendor products, so vendors set much of the pace.
What is not known
- When a quantum computer able to break today’s public-key encryption will exist. Nobody can name the year, and we do not.
- Which vendors will ship post-quantum support first. That is why the vendor questions matter.
Every fact on this site is cited, with its status, on Standards and guidance.
What a readiness engagement covers
Cryptographic inventory
Where you rely on public-key cryptography: websites and VPNs, email, remote access, sign-in and signing, backups, databases, cloud and vendor services, and devices on the plant floor. For each: who owns it, what it uses, and who can change it (you, a vendor, or nobody).
Harvest now, decrypt later
Data captured today could be decrypted later. Health, legal, financial and personal records, and public records with long retention, are the data to protect first. This ranks what migrates first.
Migration roadmap
A plan to move to the NIST standards (ML-KEM, ML-DSA, SLH-DSA). For most organizations this means upgrading vendor products in the right order, not writing code.
Crypto-agility and vendors
Requirements that let algorithms change without rebuilding systems, and questions every key vendor should answer in writing.
Board reporting
One page for the board or council: exposure, the plan, progress, and the decisions only leadership can make.
Who should start now
- You hold data that must stay confidential for years: health, legal, financial or personal records, or public records with long retention.
- You sell to the federal government, or receive federal funds that carry security requirements.
- You run critical infrastructure, such as a water or wastewater utility.
- You are buying or renewing systems that you will keep for five years or more.
Ten readiness questions
Answer what you can. We work through the rest with you in the free results review.
- 1Do we know which of our systems and services use public-key encryption or digital signatures?
- 2Who owns each of those systems, and who can change the encryption it uses: us, a vendor, or nobody?
- 3Which of our data must stay confidential for more than five years?
- 4Do we send that data over networks or store it with third parties today?
- 5Have our key vendors told us, in writing, when their products will support the NIST post-quantum standards?
- 6Do our contracts and purchasing require post-quantum support or a roadmap for it?
- 7Could we change an algorithm or certificate across the organization without rebuilding systems?
- 8Do we have an up-to-date list of our certificates and encryption keys, and when they expire?
- 9Do we sell to the federal government, or receive federal funds, that may bring post-quantum requirements?
- 10Has leadership been told what quantum risk means for us, and who owns the plan?
Questions for every key vendor
Ask for the answers in writing. Use them freely.
- 1Which of your products and services that we use rely on public-key cryptography, and for what?
- 2Do they support ML-KEM (FIPS 203) today? If not, by when?
- 3Do they support ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) for signatures? If not, by when?
- 4Will the change come as a normal update, or does it need a new version, new hardware or a migration project?
- 5Can we choose or change the algorithms ourselves, or only you can?
- 6Do you use hybrid modes (current plus post-quantum algorithms) during the transition?
- 7Which of your own suppliers must change first, and are they on track?
- 8Will you put your post-quantum roadmap and dates in our contract?
How we help
We lead and plan. Partners or your own IT and vendors make the technical changes, against requirements we write and check.
Quantum Readiness Assessment
A cryptographic inventory, the data that must stay confidential for years, answers from your key vendors, a prioritized migration roadmap and a one-page board summary.
PQC Migration Program Leadership
Ownership of the migration roadmap over 3, 6 or 12 months: vendor follow-up, milestones, decisions and quarterly board reporting. Usually run inside an existing SMC vCISO program.
Also available as targeted engagements: a board or council briefing, a vendor questionnaire, or crypto-agility requirements for one procurement.
Start with the free assessment
Free 30-minute call, free assessment, gap report and free results review. No obligation. Or write to support@securitymedic.com.
Book a free 30-minute call