Preparing Your Organization for the Quantum Era

Preparing an organisation for the quantum era is a multi-year programme of people, process and technology. Here is a practical framework for getting your organisation ready.

1. Establish Governance

Quantum readiness needs executive ownership. Without it, the work stalls.

• Appoint a quantum-readiness lead (often within the CISO organisation).
• Secure budget for discovery, tooling and migration.
• Make cryptographic posture a board-level metric.
• Align with risk management and compliance functions.

2. Discover Your Cryptographic Estate

You cannot protect what you cannot see.

• Inventory every use of cryptography: TLS, VPNs, SSH, code signing, databases, backups, archives, APIs, IoT.
• Identify the data protected by each and its confidentiality lifetime.
• Find hardcoded algorithms and keys that resist change.
• Use automated crypto-discovery tools to scan binaries, configs and traffic.

3. Assess and Prioritise

Rank by risk = sensitivity × longevity × exposure:

• Highest: long-lived, high-value data protected by RSA/ECC (root CAs, archives, IP, state secrets).
• High: short-lived but high-volume (TLS traffic).
• Medium: internal tooling, low-sensitivity data.

4. Build Crypto-Agility

Before swapping algorithms, make systems adaptable:

• Abstract algorithm choices behind interfaces.
• Version protocols and data formats.
• Remove hardcoded key-size assumptions.
• Make algorithm rotation a configuration change, not a rewrite.

5. Pilot Post-Quantum Technologies

• Deploy hybrid post-quantum TLS on a non-critical service.
• Test ML-DSA code signing in a CI pipeline.
• Evaluate post-quantum VPN and SSH.
• Measure performance, compatibility and operational impact.

6. Protect Data at Rest Now

• Standardise on AES-256 for all encryption at rest.
• Use strong key derivation (PBKDF2, Argon2) for password-based keys.
• Encrypt sensitive files independently with a zero-knowledge tool before storing or transmitting.

7. Plan Key and Certificate Migration

• Shorten certificate lifetimes during transition.
• Issue post-quantum or hybrid root CAs for new hierarchies.
• Rotate long-lived signing keys toward ML-DSA / SLH-DSA.

8. Train Your People

• Educate developers on post-quantum algorithms and crypto-agility.
• Train operations on new key sizes and formats.
• Brief leadership on risk and progress.
• Document standards and playbooks.

9. Engage Suppliers

• Ask vendors for their quantum-readiness roadmaps.
• Prefer suppliers with named post-quantum plans.
• Include quantum-readiness in procurement criteria.

10. Monitor and Adapt

• Track NIST, ENISA, NCSC and sector guidance.
• Watch for cryptanalytic breaks of post-quantum schemes.
• Re-run discovery as systems change.
• Keep the roadmap living, not a one-off project.

Bottom Line

Quantum readiness is not a single project — it is a permanent capability. Organisations that build that capability now will move calmly when the technology shifts; those that do not will scramble under deadline pressure. The work is substantial but well-defined, and the standards and tools to do it already exist.