Your organization's encryption is on a countdown. Every encrypted file, authenticated session, and protected data stream could soon be readable by adversaries with quantum computing capabilities. The threat is real.
The Call to Action
The Cybersecurity and Infrastructure Security Agency (CISA) and the G7 Cyber Security Working Group have issued a joint call to action titled "Preparing for the Post-Quantum Era." They urge organizations and governments to start transitioning to post-quantum cryptography (PQC). The document outlines five priorities: raising awareness of quantum risks, developing national PQC strategies, advancing quantum-safe technology research, fostering public-private partnerships, and integrating PQC into cybersecurity requirements and procurement processes.
This isn't just technical advice. It's a regulatory signal that the compliance landscape for cryptographic controls is shifting.
The Urgency of the Timeline
The timeline for quantum risk isn't about when quantum computers will arrive. It's about when adversaries will start harvesting your encrypted data now to decrypt it later. This "harvest now, decrypt later" approach means your current encryption failures are already setting the stage for future breaches.
The G7's call to action creates an immediate compliance expectation. Organizations must demonstrate they're planning for cryptographic transition. If you're undergoing SOC 2 audits, ISO 27001 certification, or regulatory examinations, expect questions about your PQC readiness strategy within the next 12-18 months.
Identifying Control Gaps
Current cryptographic controls weren't designed with quantum resistance in mind. Here's what's at risk:
Cryptographic inventory gaps. Most organizations can't fully inventory where they use public-key cryptography. Your team might know about TLS certificates and VPN tunnels, but what about embedded cryptography in IoT devices, legacy applications, or third-party integrations? Without this inventory, you can't assess quantum exposure.
Procurement process blind spots. Your vendor risk assessments likely don't include questions about cryptographic agility or PQC roadmaps. When you sign multi-year contracts for security tools, authentication systems, or cloud services, you're locking in cryptographic dependencies without exit strategies.
Key management lifecycle controls. Current key management practices assume adversaries need real-time access to decrypt data. Quantum computing breaks that assumption. Controls focusing on key rotation frequency or secure storage miss the harvest-now-decrypt-later threat model entirely.
Architecture review scope limitations. Security architecture reviews typically check if encryption is present, not if it's quantum-resistant. Your change advisory board isn't asking whether new systems support cryptographic agility.
Standards and Requirements
Current frameworks don't explicitly mandate post-quantum cryptography yet, but they lay the groundwork you'll need:
NIST Cybersecurity Framework requires you to identify and protect sensitive data (PR.DS-1, PR.DS-5). This protection obligation extends to future threats you can reasonably anticipate. Once NIST finalizes PQC standards, your risk assessment must account for quantum vulnerability.
ISO/IEC 27001:2022 Control 8.24 demands cryptographic key management throughout the entire lifecycle. The standard requires you to define when cryptographic methods become inadequate and plan for replacement. Quantum computing is exactly the scenario this control anticipates.
SOC 2 Trust Services Criteria CC6.1 requires logical and physical access controls that remain effective over time. If your encryption will become ineffective within your data retention period, you're not meeting the control objective.
CMMC 2.0 Practice SC.3.177 requires FIPS-validated cryptography. As NIST releases quantum-resistant algorithms, DoD contractors will face updated validation requirements. Your compliance timeline starts when NIST publishes, not when DoD updates the standard.
The G7's call to action adds another layer: integrating PQC into procurement processes creates an implicit standard for vendor due diligence. If you're selecting new security tools without evaluating their quantum readiness, you're creating technical debt that auditors will question.
Action Items for Your Team
Build your cryptographic inventory now. You can't transition what you can't see. Document every system that uses public-key cryptography: authentication mechanisms, encrypted storage, digital signatures, VPN concentrators, PKI infrastructure, API security, and embedded devices. Include third-party services and cloud platforms. This inventory becomes your transition roadmap.
Update your vendor risk assessment template. Add specific questions: Does the vendor have a PQC transition plan? Which cryptographic libraries do they use? Can they support hybrid cryptographic modes during transition? What's their timeline for implementing NIST-approved quantum-resistant algorithms? Make these questions mandatory for any vendor handling sensitive data or providing security functions.
Revise your key management procedures. Document how long your encrypted data must remain confidential. If you're protecting data that must stay secret for 10+ years, you're already in the quantum threat window. Prioritize those datasets for early PQC adoption.
Establish a cryptographic agility requirement. For any new system procurement or development project, require the ability to swap cryptographic algorithms without major architectural changes. This means using abstraction layers, avoiding hardcoded algorithm choices, and selecting platforms that support cryptographic modularity.
Create a cross-functional PQC working group. Your CISO can't solve this alone. Include procurement, enterprise architecture, application development, infrastructure teams, and legal. The G7 explicitly calls for public-private partnerships because transition requires coordination across organizational boundaries.
Map your compliance timeline. Track when NIST finalizes PQC standards, when major frameworks update their requirements, and when your industry regulators issue guidance. Federal contractors face the tightest deadlines. Financial services and healthcare will follow. Build backward from those dates to establish your internal milestones.
Test one pilot transition. Select a non-critical system and implement hybrid cryptography (combining current and quantum-resistant algorithms). Document what breaks, how long it takes, and what skills your team needs. Use this pilot to build realistic transition estimates for your critical systems.
The quantum threat doesn't wait for your budget cycle or your next compliance audit. Your encrypted data is already at risk. The question isn't whether to transition to post-quantum cryptography but whether you'll do it strategically or reactively under regulatory pressure.
Start with the inventory. Everything else follows from knowing what you need to protect.
