Post-quantum cryptography readiness assessment.

What is PQC readiness?

Post-quantum cryptography (PQC) is designed to resist attacks from quantum computers. Preparing for a transition begins with understanding which systems depend on cryptography, what they protect and how those dependencies could be changed.

A readiness assessment brings those questions into a defined review. It helps you identify gaps in the available information and plan further discovery, supplier discussions and transition work.

What we review

• Inventory and visibility: available records of cryptographic use, their owners and the gaps that need further investigation.
• Technology dependencies: relevant applications, certificates, identity services, communications, infrastructure and supplier-managed components.
• Data and business priorities: the information being protected, how long it needs to remain confidential and which services are most important to the organisation.
• Transition constraints: supplier roadmaps, legacy systems, compatibility requirements, replacement cycles and change approvals.
• Programme ownership: the people who will make decisions, gather evidence and coordinate the next stages.

How the assessment works

• Agree the boundary. Select the services, systems and business questions for the assessment.
• Review the available information. Examine the agreed inventory and documentation with the responsible teams.
• Identify gaps and dependencies. Distinguish what the evidence establishes from what still requires discovery or supplier confirmation.
• Prepare the roadmap. Propose priorities, responsibilities and dependencies for a phased transition programme.

What you receive

• A readiness summary describing the assessed scope and the evidence available.
• A review of the agreed cryptographic inventory, with information gaps and follow-up questions.
• A prioritised record of dependencies, planning risks and supplier questions.
• A proposed transition roadmap and a discussion of the decisions needed to progress it.

From assessment to migration planning

The engagement focuses on readiness and planning. Automated discovery, replacement of cryptographic components, production migration and interoperability testing are separate activities and are not included in this assessment scope.

For UK and US teams, relevant NIST migration resources can inform the review. UK organisations can also use NCSC migration guidance when discussing their planning priorities. The engagement records which references and assumptions are being used.

Prepare for the first discussion

Bring any existing cryptographic or certificate inventory, an overview of important applications and suppliers, and known constraints around legacy systems or long-lived data. If the inventory is incomplete, describe what is known so we can agree a realistic assessment boundary.

Questions about PQC readiness

Do we need a complete cryptographic inventory to start?

No. We can review the records available within the agreed scope and identify gaps. The resulting plan can define where further discovery is needed; the assessment does not assume that an incomplete inventory represents the whole estate.

Can the scope include OT dependencies?

Yes. Where agreed, the review can include cryptographic dependencies associated with OT systems. Supplier support, operating constraints and equipment replacement cycles form part of the planning discussion.

Does a readiness assessment make our systems quantum-safe?

The assessment provides evidence and a plan for decisions. Changes to systems and validation of those changes are subsequent activities; readiness assessment alone does not complete migration.

References

• NIST NCCoE — Migration to Post-Quantum Cryptography
• UK NCSC — Timelines for migration to post-quantum cryptography