Quantum readiness starts with knowing what you depend on

A board does not need to predict the arrival date of a powerful quantum computer to ask a useful question about readiness. It can ask management which important services depend on cryptography that may need to change.

That question connects an emerging technical risk to work the organisation can begin to assess. The answer should inform a proportionate plan, with relevant technical expertise and visibility of provider dependencies.

Understand the specific issue

Sufficiently capable quantum computers could undermine some widely used public-key cryptographic methods. Post-quantum cryptography concerns methods designed to resist that threat and to run on conventional computing systems. It is distinct from buying a quantum computer. NIST released its first three finalised post-quantum cryptography standards in 2024. [1]

The implications vary across systems and information. Management needs specialist advice about which dependencies are affected. Avoid treating all encryption as having the same exposure or assuming that one product update resolves the organisation's entire position.

The timing also depends on what must remain protected. Information expected to stay confidential for many years deserves a different assessment from information with a short useful life. The migration time of the systems involved matters as well.

Establish visibility before a large commitment

NIST's migration work identifies a cryptographic inventory as a starting point for understanding where and how cryptography is used. [2] For leadership, the useful result is a view connected to important systems, services and information.

Ask who owns the inventory, which critical areas it covers and where knowledge remains incomplete. Include dependencies in purchased services and products. The inventory should describe the relevant assets and arrangements without becoming a collection of secret key material.

Use the findings to prioritise further assessment. A long list of algorithms without owners or business context will be difficult to turn into an investment decision.

Ask providers for a credible transition plan

For important services, establish what the provider plans to change, what the customer will need to do and which assumptions affect timing. Ask about testing, compatibility and support for existing systems.

Coordinate this work with renewal and replacement decisions. A long-lived purchase made today can create a future migration dependency. Procurement needs a way to bring that question to the appropriate technical specialists.

The first board request can be modest: identify the most consequential dependencies, the work needed to understand them and the next decision requiring funding. Set a review date based on that work. Progress should be measured through better visibility and tested plans rather than confidence in a speculative deadline.

[1] NIST What Is Post Quantum Cryptography Read the source

[2] NIST Migration to Post Quantum Cryptography Read the source

Nasaq Partners works with a network of experts on governance, strategy and execution. Explore our advisory services.