Post-quantum cryptography is the rare security program where the deadline is unknown but the work is perfectly knowable today. A cryptographically relevant quantum computer doesn't exist yet; adversaries recording encrypted traffic now to decrypt later already do. That asymmetry — harvest now, decrypt later — makes PQC migration a present-tense infrastructure program, not a future-tense research topic. Having run infrastructure modernization across regulated enterprises, here is the playbook we recommend.
The standards question is settled — stop waiting
NIST finalized the core standards: ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for signatures, with SLH-DSA as a hash-based conservative option. Browsers and major cloud providers already ship hybrid key exchange (classical + ML-KEM) in TLS. The "standards aren't ready" excuse expired. What remains is your estate.
Phase 1 — Cryptographic inventory (the real project)
Every PQC program lives or dies on the cryptographic bill of materials (CBOM). You cannot migrate what you cannot enumerate. Inventory across four layers:
- Transport: TLS termination points, VPNs, SSH fleets, MQTT/messaging brokers — including the appliances nobody owns.
- Data at rest: backup encryption (your Rubrik/Commvault key hierarchies), storage-array encryption, KMS/HSM root keys and their algorithms.
- Identity & signing: PKI hierarchies, code signing, document signing, JWT/OIDC infrastructure, firmware signing — signatures are where long-lived trust hides.
- Embedded & vendored: crypto buried inside vendor products, libraries pinned years ago, hardware with baked-in algorithms.
Tooling helps (network scanners, code scanners, CycloneDX CBOM formats), but expect this to be 60% archaeology and stakeholder interviews. Tag every finding with two numbers: data lifetime and migration difficulty. An asset protecting data that must stay confidential for 15+ years behind a hard-to-change appliance is your priority quadrant.
Phase 2 — Triage by harvest exposure
Rank by a simple product: confidentiality lifetime × interception exposure. External TLS carrying long-lived secrets (health records, IP, citizen data) migrates first via hybrid key exchange — it's also the easiest win because major TLS stacks support it now. Internal east-west traffic follows. Signatures migrate on a different clock: forging them requires the quantum computer to exist at attack time, so they're urgent mainly where verification longevity matters — firmware, long-lived certificates, archival document signing.
Encryption migrates against the harvest clock. Signatures migrate against the hardware clock. Confusing the two clocks misallocates years of effort.
Phase 3 — Build crypto-agility, not a one-time swap
The deeper lesson: this won't be the last algorithm transition. Architect so the next one is a config change — centralize crypto in services and libraries rather than scattering primitives through application code, abstract via providers/KMS, negotiate algorithms in protocols, and put algorithm choice under configuration management with telemetry. Organizations that treat PQC as a forcing function for crypto-agility convert a compliance burden into a permanent capability.
Phase 4 — Vendor pressure and proof
Most of your estate is other people's code. Add PQC roadmap questions to procurement and renewals now; demand dates for hybrid TLS, ML-DSA-capable PKI, and HSM firmware support. Internally, stand up a pilot enclave — one service path running hybrid TLS end-to-end — to surface the real-world issues early: certificate size bloat, handshake latency, middlebox breakage, HSM throughput. Every one of these is cheaper discovered in a pilot than in an incident review.
Sequencing reality
For a mid-size enterprise we typically see: one to two quarters for credible inventory, hybrid TLS on external perimeter within the following two quarters, PKI and signing strategy over 12–24 months, and long-tail embedded systems stretching years. Regulators are converging on the same shape — financial and government frameworks increasingly ask for CBOMs and migration plans, not finished migrations. Showing a governed, sequenced program is the present-day deliverable.
Start the inventory this quarter. It is the only step with zero regret under every quantum timeline — including the timeline where the computer arrives late, because everything above is also just good cryptographic hygiene.