Post-Quantum Cryptography Migration Plan: Locking Down Your Data

Quick answer: This guide lays out a five-step plan for migrating to post-quantum cryptography (PQC): build a cryptographic inventory (CBOM), assess and prioritize risk, deploy hybrid algorithms like ML-KEM and ML-DSA, and roll out changes in time to meet the 2030 and 2035 compliance deadlines.

Quantum computers are coming fast, and they could crack the encryption we rely on, like RSA and ECC, which protect your online banking, emails, and sensitive files. With quantum tricks like Shor’s algorithm, your data could be vulnerable to attacks that unravel codes we thought were solid. Post-Quantum Cryptography (PQC) is the new shield to keep your information safe from these future threats.

What is a PQC migration plan? A post-quantum cryptography (PQC) migration plan is a structured, multi-year program that inventories an organization’s existing encryption, prioritizes systems by risk and data sensitivity, and phases in NIST-standardized quantum-resistant algorithms like ML-KEM and ML-DSA, using hybrid cryptography to maintain compatibility and crypto-agility throughout the transition.

This guide draws on the Migration Roadmap and NIST’s latest algorithm updates to walk you through deciding whether to buy ready-made solutions or build your own, and rolling out changes without disruptions. It’s packed with timelines, tool recommendations, and tailored advice for industries like finance, healthcare, telecom, and small businesses, plus real-world examples and tips on avoiding common pitfalls. For the full 9-phase version of this plan, see EC’s PQC Migration Guide.

Key Takeaways

• PQC migration is a 10-to-20-year program, not a single upgrade, so starting the cryptographic inventory now matters more than picking a final algorithm today.
• NIST has finalized three algorithms, ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), with FN-DSA (FIPS 206) and HQC still in draft.
• A Cryptographic Bill of Materials (CBOM) is the mandatory first step; you cannot migrate encryption you cannot see.
• Hybrid cryptography, pairing a classical algorithm with a PQC one, is the recommended way to migrate without breaking compatibility.
• Federal and national-security deadlines (2030 to 2035) are now backed by binding policy, including a 2026 executive order, so procurement and compliance teams need this on the roadmap, not just IT.

Why PQC Is Critical Now

Quantum computers are expected to hit a major milestone by 2030 to 2035, becoming “cryptographically relevant.” This means they could use Shor’s algorithm to break current encryption, exposing sensitive data. Hackers might be grabbing encrypted data today, like bank records, health files, or government secrets, waiting to decrypt it later with a “Harvest Now, Decrypt Later” attack. This is a huge risk for data that needs to stay safe for years, like financial contracts, medical records, or trade secrets.

Governments are pushing hard: the NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) demands PQC for national security systems by 2030, and U.S. federal agencies have until 2035 under National Security Memorandum 10 (NSM-10). In June 2026, Executive Order 14412 went further, making PQC migration a binding legal obligation for U.S. federal civilian agencies and their contractors, with a deadline of December 31, 2030. The EU and UK are also aiming for 2035 to phase out old, vulnerable algorithms. Switching to PQC can take 10 to 20 years, or longer for complex setups like global corporations, government networks, or critical infrastructure, so starting now is essential to stay ahead and keep your data locked down.

Key Fact: By 2030, RSA, ECC, Diffie-Hellman, ECDSA, and EdDSA (with 128-bit security or higher) will be phased out for U.S. national security systems, with a full stop by 2035.

The gap between awareness and action is widening: The 2026 Global State of Post-Quantum and Cryptographic Security Trends study, conducted by the Ponemon Institute and sponsored by Entrust (published January 27, 2026), surveyed more than 4,100 IT and security professionals worldwide and found that 67% of organizations are still not preparing to transition to post-quantum cryptography, even though 75% of respondents believe a quantum computer capable of breaking today’s public-key cryptography will exist within five years.

Challenges of PQC Migration

Switching to PQC is like upgrading a plane’s engines while it’s flying. It’s doable, but it takes careful planning. The Migration Roadmap highlights the main hurdles:

• Tech Challenges: Encryption is tucked into everything: networks, apps, cloud services, backups, and smart devices like IoT sensors in smart homes or factories. Tracking it all is a huge task. PQC algorithms use bigger keys (for example, ML-KEM needs 800 to 1600 bytes compared to RSA’s 256 bytes) and more computer power, which can slow systems or require new hardware, like upgraded servers or specialized chips. Making old systems work with new PQC setups without breaking apps or services is a big challenge.
• Long Timeline: Updating encryption across an organization can take 10 to 20 years, especially for legacy systems like old banking mainframes or complex setups like power grid controllers. Some industries, like aerospace or utilities, may need even longer due to strict safety and regulatory requirements.
• Blind Spots: Many organizations don’t know where all their encryption is, especially in vendor-supplied software, hardware, or supply chains. For example, a hospital might not realize its MRI machines use outdated encryption, or a retailer might miss it in third-party payment systems. This makes spotting risks tricky. EC calls this out in detail in The Cryptographic Blind Spot Hiding in Your Own Infrastructure.
• Lack of Experts: PQC is a niche field, and skilled pros are rare. In the 2026 Ponemon/Entrust study cited above, 38% of respondents cited a lack of in-house expertise as a barrier, up from 28% the year before, and budget concerns rose from 31% to 39% over the same period. Finding staff who understand both quantum-safe algorithms and your specific systems is tough.
• Extra Complications: You need to watch for side-channel attacks, like timing issues in Kyber that could leak data if not coded properly. Some algorithms, like SLH-DSA, produce huge signatures (up to 40 KB), eating up storage and bandwidth, which is a problem for devices like smartwatches or sensors. New regulations, like PCI DSS 4.0 for payment systems, push for quantum-safe practices, adding pressure. Crypto-agility, the ability to swap algorithms quickly, is critical to keep up with new threats or standards without rebuilding everything.

Classical Cryptography vs. Post-Quantum Cryptography: Quick Comparison

Before diving into the algorithm toolkit, it helps to see how classical and post-quantum approaches actually differ in practice. Here’s the side-by-side:

Factor	Classical (RSA / ECC)	Post-Quantum (ML-KEM / ML-DSA)
Underlying hard problem	Integer factorization, discrete log	Structured lattices, hash-based constructions
Quantum resistance	Broken by Shor’s algorithm on a cryptographically relevant quantum computer	Designed to resist known quantum attacks
Typical key size	RSA-2048: ~256 bytes	ML-KEM-768: ~1,184 bytes (public key)
Signature size	ECDSA: ~64-72 bytes	ML-DSA-65: ~3,300 bytes; SLH-DSA up to ~40 KB
Performance overhead	Low, decades of hardware optimization	Moderate; larger payloads, more CPU/bandwidth
Standardization status	Long-standing (RFC/FIPS legacy standards)	ML-KEM, ML-DSA, SLH-DSA finalized (FIPS 203-205); FN-DSA and HQC in draft
Migration path	Being phased out for national security use by 2030, all use by 2035	Deployed today in hybrid mode alongside classical algorithms

The practical takeaway: PQC algorithms aren’t a drop-in replacement. Bigger keys and signatures mean you have to test performance and compatibility before you cut over, which is exactly why hybrid deployment (covered in the five-step plan below) exists as a bridge.

NIST’s PQC Algorithms: Your Security Toolkit

Since 2016, NIST has been developing quantum-safe algorithms to replace vulnerable ones. It finalized three in August 2024 and selected HQC in March 2025 to add diversity and reduce risk if one algorithm has issues. Here’s a detailed look at these tools and their practical uses:

Algorithm	Primary Use	Strengths	Challenges	Ideal Applications	Standardization Status
ML-KEM	Key exchange over public networks	Fast, small keys	Susceptible to timing attacks if not coded carefully	Web servers, VPNs, e-commerce, cloud services	FIPS 203 (Finalized)
ML-DSA	Digital signatures for data verification	Strong security, good performance	None noted	PKI (SSL certificates), banking apps, software updates	FIPS 204 (Finalized)
SLH-DSA	High-security data verification	High security	Large signatures require more storage and bandwidth	Government communications, secure firmware updates	FIPS 205 (Finalized)
FN-DSA	Digital signatures for resource-constrained devices	Low memory and power usage; smallest signatures of the four	Floating-point Gaussian sampling makes constant-time implementation difficult	IoT, smart meters, wearables, automotive systems	Initial Public Draft submitted Aug 2025; final FIPS 206 expected late 2026 / early 2027
HQC	Key exchange (backup to ML-KEM)	Different math (code-based) than ML-KEM, useful as a fallback	Larger keys, more compute than ML-KEM	High-speed networks (e.g., 5G)	Draft standard expected 2026; finalization expected 2027

These algorithms resist quantum attacks, unlike RSA and ECC, which rely on math problems quantum computers can solve. NIST SP 800-131A and IR 8457 provide settings for 128-bit, 192-bit, and 256-bit security levels to match different risk needs (e.g., 128-bit for commercial data, 256-bit for classified systems). Testing these in a lab, like a virtual server or test network, is crucial to check how they perform with your systems, from cloud platforms to embedded devices in factories or vehicles.

Your Five-Step PQC Plan

The Migration Roadmap outlines four phases: Preparation, Baseline Understanding, Planning and Execution, and Monitoring and Evaluation. We’ve expanded these into five clear steps to make the process easier, aligned with regulatory timelines and practical for any organization, from startups to global enterprises.

Kick Off with a Plan

Start by figuring out how urgent this is. Check how long your data needs to stay secure (e.g., 10+ years for medical or financial records) and what risks your industry faces (like data breaches in finance or regulatory fines in healthcare). Map your encryption setup by listing sensitive data (e.g., customer info, intellectual property), systems (on-site servers, cloud platforms, SaaS tools like Salesforce), and connections to vendors or partners (like payment processors or IoT suppliers).

Appoint a PQC Migration Lead with strong crypto knowledge and project management skills, backed by a team of IT, security, compliance, and business staff. The roadmap emphasizes that this leader must rally everyone, explain why PQC is critical, and secure buy-in from executives to frontline techies. Set a budget, define roles, and create a governance plan to keep things organized. For example, a bank might budget for new hardware, while a hospital might focus on training staff to secure patient data systems.

Requirement	Details
Crypto Expertise	5+ years in cryptography, PKI, or security architecture
Project Management	PMP, PRINCE2, or Agile certification preferred
Team Coordination	Ability to manage IT, security, and business teams
Vendor Skills	Experience working with technology partners
Risk Knowledge	Understanding of enterprise risk assessments
Communication	Can explain complex ideas to executives and tech staff

Outcome: A solid governance plan, a dedicated team, and an approved budget.

Find Your Encryption

Hunt down every bit of encryption in your organization, from networks and apps to databases, pipelines, IoT devices, and industrial gear like Supervisory Control and Data Acquisition (SCADA) systems in factories or utilities. Use automated tools to scan for quantum-vulnerable algorithms (like RSA, ECC, or outdated TLS versions) and build a centralized Cryptographic Bill of Materials (CBOM), as the roadmap recommends. Your CBOM should detail what encryption is used, what data it protects (e.g., customer records, trade secrets), how long it needs to stay secure, and what systems or protocols depend on it (e.g., APIs or VPNs).

Choose tools that cover hardware (like routers or HSMs), software (like web apps or ERP systems), and firmware (like embedded chips in medical devices). For example, a retailer might discover ECC in their point-of-sale systems, while a manufacturer might find it in robotic assembly lines. This step helps you spot gaps, like weak keys or old protocols, that need fixing.

Tool Type	Benefits	Best For
Automated Scanners	Fast, scans large systems quickly	Big organizations with complex networks
Manual Auditing	Finds hidden or undocumented encryption	Small setups or niche systems
Hybrid Approaches	Combines speed and depth for thorough coverage	Mixed environments with diverse tech
Vendor-Specific Tools	Tailored to specific platforms or devices	Uniform setups like single-vendor stacks

Outcome: A prioritized CBOM with risk scores for each system, highlighting what’s most vulnerable.

Assess Risks and Plan

Dive into your CBOM to identify systems using weak encryption and estimate the fallout if quantum attacks hit. For example, a bank could lose millions from stolen transaction data, while a government agency might face national security risks. Map connections to vendors and systems to find roadblocks, like third-party software that’s slow to update or legacy hardware that can’t handle PQC. Prioritize high-risk systems, as the roadmap suggests, such as payment gateways, classified databases, or patient record systems.

Align with regulations like PCI DSS 4.0 for payment data, HIPAA for health records, or GDPR for EU customer data, all of which are starting to emphasize quantum-safe practices. Identify gaps in tools, skills, or budget, and create a detailed plan balancing cost, urgency, and complexity. Use hybrid cryptography, mixing PQC (like ML-KEM) with current methods (like ECDH), to maintain security and compatibility during the transition. For instance, a telecom company might use hybrid setups to secure 5G networks while still supporting older 4G infrastructure.

Outcome: A risk-based migration plan with allocated resources.

Roll It Out

Build teams to handle technical upgrades, ensure business operations keep running, and train staff on PQC. Work closely with vendors to confirm their PQC readiness, checking timelines for updates, software patches (e.g., for web servers or firewalls), or hardware needs (like new processors for faster PQC processing), and how these changes affect system performance (e.g., latency in apps or CPU usage in IoT devices), as the roadmap advises.

Decide whether to buy off-the-shelf solutions for standard systems like cloud services (e.g., AWS, Azure), VPNs, or email encryption, or build custom solutions for legacy systems like old banking platforms, industrial controllers, or proprietary software. For example, a hospital might buy a PQC-ready patient portal from a vendor, while a manufacturer might build custom PQC firmware for factory robots.

Option	Buy	Build
Best For	Vendor-supported systems (e.g., cloud, VPNs)	Legacy or custom systems (e.g., old mainframes)
Pros	Quick setup, less internal effort	Full control, tailored to your needs
Cons	Tied to vendor schedules, integration risks	Time-intensive, requires expert staff

Roll out changes carefully, starting with pilot tests on low-risk systems like internal HR apps or test servers. Monitor for issues, like slowdowns or compatibility glitches, ensure old systems stay functional, and document everything for audits or compliance checks (e.g., for ISO 27001, GDPR, or SOC 2). For instance, a government agency might pilot SLH-DSA for internal emails before rolling it out to classified systems.

Outcome: Pilot deployments on low-risk systems, with critical systems fully PQC-ready well ahead of the 2030-2035 regulatory deadlines.

Monitor and Improve

Verify that new PQC systems work smoothly with legacy setups and fully quantum-safe ones, updating your CBOM with details on algorithms, key sizes, and implementation notes (e.g., which servers use ML-KEM or which IoT devices use FN-DSA). Track key metrics, as the roadmap recommends, like the percentage of systems using PQC, the amount of sensitive data protected by quantum-safe encryption, and any issues after the switch (like performance dips or security alerts).

Stay updated on regulations from NIST, NSA, ENISA, and ETSI, which may release new standards or guidance (e.g., updates to FIPS or EU cybersecurity rules). Train your team regularly with workshops or certifications to keep their PQC skills sharp and build crypto-agility into your systems so you can swap algorithms fast if new threats or standards emerge. For example, a bank might switch from ML-KEM to HQC if a vulnerability is found. Keep tabs on quantum computing and cryptanalytic developments through industry reports, conferences (like RSA Conference), or threat intelligence feeds to stay ahead.

Your Timeline and Must-Haves

Here’s the schedule to aim for, updated for the current standards and policy landscape:

• Now through 2026: Finalized standards are in hand (ML-KEM, ML-DSA, SLH-DSA), FN-DSA and HQC are in draft. Build your CBOM, secure budgets, and train your team. Start with small-scale tests, like PQC for internal apps.
• 2027 to 2029: Work with vendors to integrate PQC solutions and launch pilot projects in low-risk systems, like employee portals or backup systems.
• 2030: CNSA 2.0 deadline for national security systems, and the deadline set by Executive Order 14412 for U.S. federal civilian agencies and contractors.
• 2030 to 2033: Tackle risks as quantum computers get closer, focusing on critical systems like financial transaction platforms or government networks.
• 2035: NSM-10 deadline for full migration to quantum-safe encryption across all U.S. federal systems, from cloud servers to IoT devices; the EU and UK are targeting the same horizon.

Must-haves for a successful migration, per the Migration Roadmap:

• A thorough check of all encryptions in your organization, covering software, hardware, and third-party systems.
• A custom migration plan tailored to your industry and infrastructure, like a bank focusing on transaction security or a hospital prioritizing patient data.
• Vendor checks to confirm PQC support, timelines, and performance impacts (e.g., latency or storage needs).
• Hybrid cryptography setups for smooth transitions, ensuring compatibility with existing systems.
• Lab testing to catch performance or compatibility issues early, like testing ML-KEM on a test server before live deployment.
• Crypto-agility to quickly update algorithms as new standards or threats emerge, like swapping to HQC if ML-KEM faces issues.
• Ongoing team training through workshops, certifications, or online courses (e.g., Coursera or SANS Institute) to build PQC expertise.
• Alignment with regulations like PCI DSS 4.0, HIPAA, GDPR, or CNSA 2.0 to avoid penalties.
• Audits after implementation to verify security and compliance, using frameworks like NIST 800-53 or ISO 27001.
• Continuous monitoring to track progress (e.g., percentage of PQC-ready systems) and watch for emerging threats via threat intelligence feeds or industry reports.

Helpful Resources

• NIST: Check FIPS 203 to 205 for algorithm details (e.g., key sizes, performance metrics) and NCCoE playbooks for industry-specific guidance, like PQC for healthcare or finance.
• Vendor Tools: Explore PQC-ready solutions from major cloud providers, like AWS Key Management Service (KMS), which now supports ML-DSA signing keys directly through its standard Sign/Verify API, or Microsoft Azure’s quantum-safe VPNs, which support ML-KEM and ML-DSA.
• Open-Source Tools: OpenSSL 3.5+ now ships ML-KEM, ML-DSA, and SLH-DSA natively, with hybrid post-quantum key exchange enabled as the TLS default, so most applications built on a current OpenSSL version can turn on PQC support with configuration changes rather than a code rewrite. The Open Quantum Safe project’s liboqs remains useful for testing algorithms not yet in mainline OpenSSL, and Bouncy Castle covers Java-based integrations.
• Migration Roadmap: Dive into the Migration Roadmap and inventory workbook for practical templates, like CBOM spreadsheets or vendor questionnaires. Their case studies, like PQC in banking or IoT, offer real-world insights.

How Encryption Consulting Can Help

Building a comprehensive cryptographic inventory is a significant undertaking, but you do not have to do it alone. We are a globally recognized leader in applied cryptography, offering Post-Quantum Cryptography (PQC) Advisory Services specifically designed to help organizations navigate the quantum shift.

Our services are built on a structured, end-to-end approach:

• PQC Assessment: We perform cryptographic discovery and inventory using CBOM Secure to locate all your keys, certificates, and dependencies. This delivers a clear Quantum Threat Assessment and a Quantum Readiness Gap Analysis that identifies your vulnerabilities and most urgent priorities.
• PQC Strategy & Roadmap: Based on the inventory data, we help you develop a custom, phased PQC migration strategy aligned with NIST and other industry standards. This includes creating a Cryptographic Agility Framework to ensure you are prepared for future changes.
• Vendor Evaluation and PoC: We assist in selecting the best PQC solutions by defining evaluation criteria, shortlisting vendors, and executing proof-of-concepts (PoCs) on your critical systems to validate their effectiveness.
• PQC Implementation: We help you seamlessly integrate PQC algorithms into your CertSecure Manager-managed PKI and other security ecosystems, including the deployment of hybrid cryptographic models for a secure and disruption-free transition.

With our deep expertise and proven framework, you can build, assess, and optimize your cryptographic infrastructure, ensuring a smooth and secure transition to a post-quantum future. For a deeper, phase-by-phase breakdown of what a 2026-ready migration actually looks like in production, see PQC Migration in 2026: Building a Roadmap That Survives Contact With Production.

Our Take: Start With Visibility, Not an Algorithm

Most PQC conversations jump straight to “which algorithm should we pick,” but that’s the wrong first question. The organizations that stall out are the ones that skip discovery and try to plan a migration around encryption they haven’t actually inventoried. Our recommendation: treat the CBOM as the deliverable that unlocks everything else, budget, vendor conversations, and pilot scope, rather than as paperwork to produce after the real work starts. Teams that get a CBOM in place early consistently move faster through pilots, because they aren’t discovering unknown dependencies mid-rollout.

Conclusion

Switching to PQC is critical to protect your data from future quantum threats, whether you’re securing bank transactions, patient records, or smart city networks. This detailed, easy-to-follow plan, built on the Migration Roadmap, helps you assess your encryption, make a smart plan, and roll out changes while staying compliant with regulations like PCI DSS, HIPAA, or CNSA 2.0. With practical steps, industry-specific tips, and resources to guide you, starting now ensures your data stays locked down for the long haul. Don’t wait for quantum computers to catch up; take the first step today to build a quantum-safe future.

Frequently Asked Questions

What is a post-quantum cryptography (PQC) migration plan?

A PQC migration plan is a structured, multi-year program for replacing quantum-vulnerable encryption (RSA, ECC) with NIST-standardized quantum-resistant algorithms. It typically covers cryptographic discovery, risk-based prioritization, vendor evaluation, hybrid deployment, and ongoing monitoring, rather than a single software update.

Why can’t organizations just wait until quantum computers actually arrive?

Because migration itself takes 10 to 20 years for complex environments, and attackers can harvest encrypted data today to decrypt later once a cryptographically relevant quantum computer exists. Waiting means your longest-lived sensitive data, financial records, health data, trade secrets, is exposed the moment that threshold is crossed.

What does Harvest Now, Decrypt Later mean, and why does it matter for timing?

It’s an attack pattern where adversaries collect encrypted traffic or files today, store them, and decrypt them once quantum computing makes it possible. It matters for timing because it means the deadline for protecting long-lived data isn’t 2030 or 2035, it’s today, whenever that data is captured.

Which NIST algorithms should a migration plan target first?

Start with the three finalized standards: ML-KEM (FIPS 203) for key exchange, and ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) for digital signatures. FN-DSA (FIPS 206) and HQC are still in draft, so plan for crypto-agility rather than building around them yet.

How long does a typical enterprise PQC migration take?

Most estimates put full migration at 10 to 20 years for large or legacy-heavy organizations, though a good discovery-and-pilot phase can be completed in the first 12 to 18 months. Regulatory deadlines (2030 for national security systems, 2035 for broader federal systems) are the outer bound, not the starting point.

What is hybrid cryptography, and why is it used during migration?

Hybrid cryptography pairs a classical algorithm (like ECDH or RSA) with a post-quantum one (like ML-KEM) so a connection or signature stays secure even if one of the two algorithms is later broken. It’s the recommended way to deploy PQC today because it preserves compatibility with systems that don’t yet support PQC natively.

What is a Cryptographic Bill of Materials (CBOM), and why is it the first step?

A CBOM is a structured inventory of every cryptographic algorithm, key, certificate, and library in use across an organization, including where it lives and what data it protects. It’s the mandatory first step because you cannot prioritize, budget for, or migrate encryption you don’t know exists.

Which regulations require post-quantum cryptography readiness?

CNSA 2.0 mandates PQC for U.S. national security systems by 2030. NSM-10 sets a 2035 deadline for broader federal systems, and Executive Order 14412 (June 2026) makes migration binding for federal civilian agencies and contractors by December 31, 2030. PCI DSS 4.0, HIPAA, and GDPR are also beginning to reference quantum-safe practices.

Should organizations buy PQC-ready solutions or build their own?

Buy for vendor-supported systems like cloud platforms, VPNs, or standard email encryption, where providers such as AWS, Azure, and major CAs already offer PQC or hybrid support. Build custom solutions for legacy or proprietary systems, like old mainframes or industrial controllers, where no vendor path exists yet.

What is crypto-agility, and why does a migration plan need it?

Crypto-agility is the ability to swap cryptographic algorithms across your systems quickly, without a ground-up rebuild, as standards evolve or vulnerabilities emerge. A migration plan needs it because two of NIST’s five selected algorithms (FN-DSA and HQC) are still in draft, and the standards landscape will keep shifting for years.