[{"data":1,"prerenderedAt":412},["ShallowReactive",2],{"blog-\u002Fblog\u002Fpqc-migration-not-the-whole-story":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":339,"date":340,"description":341,"draft":342,"extension":343,"faqs":344,"findingsSource":7,"geo":357,"howto":7,"howtoTitle":7,"image":359,"industries":360,"keyFindings":7,"meta":362,"modified":363,"navigation":364,"path":365,"pullquote":7,"recommendations":7,"references":366,"related":382,"seo":396,"seoTitle":397,"signposts":7,"slug":398,"stats":399,"stem":402,"tags":403,"tldr":410,"__hash__":411},"blog\u002Fblog\u002Fpqc-migration-not-the-whole-story.md","PQC Migration Is Necessary, But It Is Not the Whole Story","ArcQubit Team",null,{"type":9,"value":10,"toc":325},"minimark",[11,16,25,31,35,41,50,53,80,83,87,90,93,97,100,177,182,186,189,192,214,218,232,236,239,250,253,264,267,271,303,307,310,314,319],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24],"p",{},"Post-quantum cryptography (PQC) migration is necessary, but it covers only half of quantum readiness. It removes the security risk that quantum computers pose to today's encryption. It does nothing about the strategic risk of adopting quantum technology too slowly. ArcQubit calls the pairing Dual Quantum Technology Risk Exposure ",[21,22,23],"span",{},"1",".",[17,26,27],{},[28,29,30],"em",{},"Last verified: Sep. 30, 2026.",[12,32,34],{"id":33},"why-the-security-frame-dominates","Why the security frame dominates",[17,36,37,38,24],{},"The urgency around PQC is justified. A large enough quantum computer would break public-key cryptography such as RSA and elliptic-curve schemes, and CISA states that quantum computers will eventually break many widely used encryption and signature algorithms ",[21,39,40],{},"3",[17,42,43,44,49],{},"Adversaries can collect encrypted data today and decrypt it later. Organizations that keep data for many years, such as government, healthcare and financial services, carry the most exposure. See ",[45,46,48],"a",{"href":47},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later"," for how to test your data against that risk.",[17,51,52],{},"Regulators and standards bodies have responded:",[54,55,56,63,68,74],"ul",{},[57,58,59,60,24],"li",{},"NIST finalized FIPS 203, 204 and 205 in August 2024 and urges administrators to start integrating them immediately, because full integration takes time ",[21,61,62],{},"2",[57,64,65,66,24],{},"CISA says agencies and critical infrastructure entities must begin preparing now ",[21,67,40],{},[57,69,70,71,24],{},"The UK NCSC sets 2028, 2031 and 2035 milestones for discovery, priority migration and completion ",[21,72,73],{},"4",[57,75,76,77,24],{},"U.S. Executive Order 14412 directs OMB guidance that sets Dec. 31, 2030 for key establishment and Dec. 31, 2031 for digital signatures, for federal agencies ",[21,78,79],{},"5",[17,81,82],{},"This guidance is sound. It also comes from agencies focused on defense, so it frames quantum as a threat to neutralize.",[12,84,86],{"id":85},"what-the-defensive-frame-misses","What the defensive frame misses",[17,88,89],{},"Quantum computing is also an emerging capability. Organizations in finance, life sciences and logistics are reported to be exploring quantum approaches to optimization and simulation problems. Most of this work is early-stage, and no one can say yet which uses will pay off or when.",[17,91,92],{},"That uncertainty is the point. Leaders who treat readiness as a synonym for PQC migration will eventually secure their cryptography. They may also start from zero on skills, vendor relationships and use-case knowledge when quantum technology matures. That is the strategic risk.",[12,94,96],{"id":95},"two-dimensions-of-one-challenge","Two dimensions of one challenge",[17,98,99],{},"Security and adoption are not two competing initiatives. They are two dimensions of one challenge, and they draw on the same organizational capabilities.",[101,102,103,119],"table",{},[104,105,106],"thead",{},[107,108,109,113,116],"tr",{},[110,111,112],"th",{},"Capability",[110,114,115],{},"PQC migration track",[110,117,118],{},"Adoption track",[120,121,122,134,145,156,167],"tbody",{},[107,123,124,128,131],{},[125,126,127],"td",{},"Starting point",[125,129,130],{},"Cryptographic inventory and risk assessment",[125,132,133],{},"Use-case identification",[107,135,136,139,142],{},[125,137,138],{},"Early proof",[125,140,141],{},"Pilot migrations",[125,143,144],{},"Proof of concept",[107,146,147,150,153],{},[125,148,149],{},"External work",[125,151,152],{},"Vendor and supplier coordination",[125,154,155],{},"Vendor and cloud-access evaluation",[107,157,158,161,164],{},[125,159,160],{},"Rollout",[125,162,163],{},"Phased implementation",[125,165,166],{},"Integration planning",[107,168,169,172,175],{},[125,170,171],{},"Both need",[125,173,174],{},"Executive sponsorship, cross-functional coordination, sustained funding",[125,176],{},[17,178,179,180,24],{},"Teams that build governance, technical skill and change management for one track execute the other faster. ArcQubit defines quantum readiness as the sustained capability to leverage quantum technologies and secure against quantum-era threats in pursuit of strategic value. The definition is dual on purpose ",[21,181,23],{},[12,183,185],{"id":184},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,187,188],{},"ArcQubit guidance: fund migration as the non-negotiable floor, then add a small, deliberate adoption track.",[17,190,191],{},"Three points for the board:",[193,194,195,202,208],"ol",{},[57,196,197,201],{},[198,199,200],"strong",{},"Migration is a floor, not a strategy."," Deadlines set the minimum. They do not tell you where quantum creates value.",[57,203,204,207],{},[198,205,206],{},"One sponsor should see both risks."," Split ownership produces two programs that never compound.",[57,209,210,213],{},[198,211,212],{},"Adoption starts small."," A literacy effort and one scoped experiment cost little and teach a lot.",[12,215,217],{"id":216},"decisions-to-make-this-quarter","Decisions to make this quarter",[54,219,220,223,226,229],{},[57,221,222],{},"Name one executive accountable for quantum readiness across security and adoption.",[57,224,225],{},"Confirm that a cryptographic inventory is under way and has an owner.",[57,227,228],{},"Choose one or two candidate business problems and define what a quantum experiment would need to show.",[57,230,231],{},"Decide who builds quantum literacy in your organization.",[12,233,235],{"id":234},"questions-to-ask-your-team","Questions to ask your team",[17,237,238],{},"On the security side:",[54,240,241,244,247],{},[57,242,243],{},"Where does quantum-vulnerable cryptography exist in our environment?",[57,245,246],{},"What is our migration timeline, and does it meet the dates that apply to us?",[57,248,249],{},"Can we produce audit-ready evidence of progress?",[17,251,252],{},"On the adoption side:",[54,254,255,258,261],{},[57,256,257],{},"Which business problems could benefit from quantum approaches?",[57,259,260],{},"What would a proof of concept teach us about feasibility, cost and integration?",[57,262,263],{},"Who is building quantum literacy today?",[17,265,266],{},"If the second list feels premature, remember that the organizations asking these questions now are the ones who will help define good practice later. That is ArcQubit's view, not a forecast.",[12,268,270],{"id":269},"common-mistakes","Common mistakes",[54,272,273,279,285,291,297],{},[57,274,275,278],{},[198,276,277],{},"Treating the deadline as the goal."," Compliance dates are a floor.",[57,280,281,284],{},[198,282,283],{},"Running two disconnected programs."," Shared governance saves effort.",[57,286,287,290],{},[198,288,289],{},"Waiting for certainty."," Adoption learning takes time to accumulate, so a small start beats a late large one.",[57,292,293,296],{},[198,294,295],{},"Starting adoption before discovery."," Do not divert the security team. Staff the tracks separately.",[57,298,299,302],{},[198,300,301],{},"Reading one agency's guidance as the whole picture."," Defensive guidance answers the defensive question only.",[12,304,306],{"id":305},"a-generic-example","A generic example",[17,308,309],{},"Consider a mid-sized financial institution. Its security team finishes a cryptographic inventory and ranks systems by data shelf life. Its strategy team picks one optimization problem, runs a small, time-boxed experiment using cloud-based quantum access, and records what it learned. Both teams report to one sponsor. The bank now has a migration plan and a view of where quantum could matter, from a single governance structure.",[12,311,313],{"id":312},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,315,316],{},[28,317,318],{},"This box describes ArcQubit's own method. Keep it separate from the guidance above.",[17,320,321,322,324],{},"ArcQubit built its work around both dimensions. QuCode provides enterprise cryptographic discovery, sold directly, and QuTrust serves as the migration system of record. The AI & Quantum Consulting team supports the adoption path through expert-led engagements. The underlying definition comes from peer-reviewed research by ArcQubit's founders, presented at IEEE QCNC 2026 ",[21,323,23],{},". Most organizations will need both paths.",{"title":326,"searchDepth":327,"depth":327,"links":328},"",2,[329,330,331,332,333,334,335,336,337,338],{"id":14,"depth":327,"text":15},{"id":33,"depth":327,"text":34},{"id":85,"depth":327,"text":86},{"id":95,"depth":327,"text":96},{"id":184,"depth":327,"text":185},{"id":216,"depth":327,"text":217},{"id":234,"depth":327,"text":235},{"id":269,"depth":327,"text":270},{"id":305,"depth":327,"text":306},{"id":312,"depth":327,"text":313},"Research","2026-01-23","PQC migration is necessary but covers only half of quantum readiness. Learn why security risk and strategic adoption risk need one joint plan.",false,"md",[345,348,351,354],{"q":346,"a":347},"Is post-quantum cryptography migration enough for quantum readiness?","No. Migration neutralizes the security risk, which is necessary. Quantum readiness also covers the strategic risk of adopting quantum technology too slowly. ArcQubit defines it as the capability to use quantum technologies and secure against quantum-era threats together. Organizations need a plan for both dimensions [1].",{"q":349,"a":350},"What is dual quantum technology risk exposure?","It pairs two risks: the security risk that a quantum computer breaks today's cryptography, and the strategic risk of deciding too slowly in an AI-driven world. Peer-reviewed research by ArcQubit's founders, presented at IEEE QCNC 2026, frames them as one exposure to manage together [1].",{"q":352,"a":353},"Should we start quantum adoption before PQC migration is finished?","Yes, at small scale. ArcQubit guidance is to run both tracks in parallel. Migration keeps its priority and funding. Adoption starts with literacy and one scoped experiment. The two tracks share governance, sponsorship and skills, so shared effort compounds instead of competing.",{"q":355,"a":356},"What should PQC migration teams do first?","Find where quantum-vulnerable cryptography lives. NIST urges administrators to begin integrating its standards immediately because full integration takes time [2], and CISA says agencies and critical infrastructure must begin preparing now [3]. Discovery comes first because you cannot migrate what you cannot see.",[358],"global","\u002Fblog\u002Fpqc-not-whole-story.jpg",[361],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fpqc-migration-not-the-whole-story",[367,370,373,376,379],{"label":368,"url":369},"S. Maldonado Rosado, T. Bowman, A. Shebanow, A. Smallwood, and W. Butler, \"Quantum technology readiness adoption model: A TOE-aligned framework for addressing dual quantum technology risk exposure,\" IEEE Int. Conf. Quantum Commun., Netw., Comput. (QCNC), Kobe, Japan, Apr. 2026","https:\u002F\u002Fwww.ieee-qcnc.org\u002F2026\u002Faccepted-papers.php",{"label":371,"url":372},"National Institute of Standards and Technology, \"NIST Releases First 3 Finalized Post-Quantum Encryption Standards,\" NIST, Aug. 13, 2024","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2024\u002F08\u002Fnist-releases-first-3-finalized-post-quantum-encryption-standards",{"label":374,"url":375},"Cybersecurity and Infrastructure Security Agency, \"Quantum,\" CISA","https:\u002F\u002Fwww.cisa.gov\u002Fquantum",{"label":377,"url":378},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":380,"url":381},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",[383,386,389,390,393],{"label":384,"url":385},"Post-Quantum Cryptography Explained","\u002Fblog\u002Fpost-quantum-cryptography-explained",{"label":387,"url":388},"Quantum Readiness Self-Assessment","\u002Fblog\u002Fquantum-readiness-assessment",{"label":48,"url":47},{"label":391,"url":392},"PQC Migration Roadmap","\u002Fblog\u002Fpqc-migration-roadmap",{"label":394,"url":395},"Accelerating Quantum Adoption: Readiness, Not Hardware","\u002Fblog\u002Faccelerating-quantum-adoption-readiness-not-hardware",{"title":5,"description":341},"PQC Migration Is Only Half of Quantum Readiness","pqc-migration-not-the-whole-story",[400,401],"NIST released its first three finalized post-quantum encryption standards, FIPS 203, 204 and 205, on Aug. 13, 2024 (NIST, 2024).","The UK NCSC sets migration milestones of 2028 for discovery, 2031 for priority migration and 2035 for completion (NCSC, Mar. 20, 2025).","blog\u002Fpqc-migration-not-the-whole-story",[404,405,406,407,408,409],"quantum readiness","post-quantum cryptography","PQC migration","quantum risk","for enterprises","industry analysis","Post-quantum cryptography migration removes the security risk from quantum computing, but quantum readiness also means managing the strategic risk of adopting quantum technology too slowly, so leaders need to plan for both.","XLUWcGDhvBiZrpevgkioELFUvnK85hboR2PJbeFZP3k",1792182884525]