The answer, up front
A post-quantum migration plan has five steps: inventory your cryptography, prioritize by data lifespan and exposure, pilot on low-risk systems, migrate in order of risk, and verify that systems use the new algorithms. The UK NCSC expects large organizations to need two to three years for discovery and planning alone 1.
Last verified: Sep. 29, 2026.
The five-phase roadmap
Governments agree on the order of work, even where their dates differ. OMB tells U.S. agencies to move through strategy and discovery in 2026 to 2027, pilots and early migration in 2027 to 2028, prioritized key-establishment migration in 2028 to 2030, signature migration in 2031, and full migration by 2035 2. The NCSC sets the same shape on a UK clock: discovery by 2028, highest-priority migration by 2031, and everything by 2035 1. Canada describes three overlapping phases: preparation, identification, and transition 3.
The table below merges those public timelines into one plan. The owners and private-sector timeframes are our recommendation, not a mandate. Each timeframe cites the public source it follows.
| Phase | What happens | Suggested owner | Timeframe (our recommendation) | What done looks like |
|---|---|---|---|---|
| 1. Inventory | Find every algorithm, key, certificate, protocol, and third-party dependency that uses public-key cryptography | PQC technical lead with security engineering | 2026 to 2027, following OMB phase one 2 and the NCSC 2028 discovery goal 1 | A current inventory with an owner named for each system |
| 2. Prioritize | Rank systems by data shelf life, exposure, and criticality | CISO with data owners | Same window as phase one | A ranked list that explains why each system sits where it does |
| 3. Pilot | Test hybrid TLS or ML-KEM on a low-risk service and measure performance | Platform and architecture teams | 2027 to 2028, following OMB phase two 2 | A written result for each pilot, including latency, handshake size, and rollback |
| 4. Migrate | Move key establishment first, then signatures and PKI, in risk order | System owners with vendors | Key establishment 2028 to 2030; signatures by 2031; remainder by 2035 2 | Quantum-vulnerable algorithms disabled, isolated, or tunnelled, not just supported 3 |
| 5. Verify | Confirm that systems negotiate the new algorithms and do not fall back; track metrics | Security operations | Continuous | A monitored dashboard and a re-scan schedule |
Phase 1: Inventory
Start with an initial, incomplete inventory and improve it. Canada advises teams "to not be overwhelmed in completing the discovery and to begin with an initial, incomplete inventory with actions to iteratively improve the data" 3. The NCSC agrees that this phase does not need a formal asset register; it needs an understanding of what each system is and what cryptography it depends on 1. OMB directs agencies toward automated discovery that feeds a cryptographic bill of materials 2. How to Build a Cryptographic Inventory, covers the method.
Phase 2: Prioritize
Rank each system by three questions. How long must its data stay confidential? Could someone capture that data today and hold it for later decryption? How costly is the system to change? Harvest Now, Decrypt Later, gives the 10-year test for the first two.
For each non-commodity system, the NCSC lists five strategies: migrate in place, re-platform, retire the service, run it to end of life, or tolerate the risk 1. Assign one strategy to each system and record the reason. Tolerating risk is a legitimate choice only when someone with authority accepts it in writing.
Phase 3: Pilot
Pick a service where a rollback costs little, such as an internal API gateway. Canada's transition checklist names four requirements for any change: an impact assessment, a rollback playbook, a staging environment for testing, and monitoring after the change 3. Use that list for every pilot. For internet-facing TLS, Hybrid vs. Pure Post-Quantum Key Exchange, explains the choice of key exchange.
Phase 4: Migrate
Move key establishment first, because captured traffic is the harvest-now risk. Move signatures and PKI second, because a signature attack needs a working quantum computer at the moment of forgery. This order matches OMB's phases, which put key establishment in 2028 to 2030 and signatures in 2031 2. The NCSC expects some rarely used technologies to need longer than 2035 1.
Plan for co-existence. The NCSC expects organizations to run traditional and post-quantum public-key cryptography side by side for a while, which requires cryptographic agility and a clear criterion for retiring the old algorithms 1. Crypto-Agility, covers the design patterns.
Phase 5: Verify
Supporting a post-quantum algorithm is not the same as using one. Canada defines completion as vulnerable algorithms being disabled, isolated, or tunnelled 3. Check that connections negotiate the new algorithms, that no client silently falls back to the old ones, and that new systems do not reintroduce vulnerable cryptography. Re-scan on a schedule.
Who owns what
OMB's sample role allocation gives a template for a private organization 2:
| Role | Responsibility in the OMB memo 2 |
|---|---|
| CIO and CISO | Accountable for prioritization, risk acceptance, and resource allocation |
| Program office or requirement owner | Ensures vendor requirements include PQC readiness and crypto-agility provisions |
| CFO | Works with the CIO and CISO so migration resource requirements are accurately represented |
| PQC migration program manager | Coordinates migration activities across the organization and reports to senior leadership |
| PQC technical lead | Oversees inventory, algorithm selection, testing, and deployment |
| Security architect | Integrates PQC into zero trust components and supports interoperability planning |
| Application and system owners | Implement crypto-agile and PQC-compatible technologies |
Canada names two comparable roles: an executive lead and a technical lead 3.
What your written plan should contain
OMB requires an initial agency plan to include nine elements 2. A private-sector plan benefits from the same list: a system prioritization strategy with risk-based justification; timelines and milestones for all migration phases; timelines for TLS 1.3 support; the methods and automated tools used for inventory; a plan for a crypto-agile architecture; a third-party coordination plan; an estimate of funding and personnel; a risk management strategy for the migration period; and a section on governance roles.
Where the deadlines come from
The U.S. executive order sets end-of-2030 and end-of-2031 targets for federal key establishment and signatures on the highest-priority systems 4. Global Post-Quantum Mandates and Deadlines, compares all five jurisdictions. To test where you stand today, take the 10-Question Readiness Self-Assessment.
What this means for executives and the board
This roadmap is a management program, not a technology project. Your board owns the risk appetite. Your CEO decides whether the program gets funding and a named leader. Your CISO owns the ranked risk list. Your CFO owns the budget line that OMB expects the CIO and CISO to represent accurately 2. Your general counsel owns the question of what the company has promised customers and regulators about protecting long-lived data.
Frame the risk in one sentence: data that must stay confidential for years can be captured today and read later, so the clock starts now, not on the day a quantum computer works. Then separate what you can control from what you cannot. You control your inventory, your priorities and your vendor requirements. You do not control when your suppliers ship post-quantum support. Every phase of this roadmap reduces that dependence or makes it visible.
Decisions for the next 90 days
ArcQubit guidance, not a mandate. Leadership needs to make five decisions early, because each one unblocks the technical work:
- Name the accountable executive and the migration lead. Use the role table above as a starting point 2.
- Approve discovery. Phase one needs access to code, networks, certificates and supplier lists. Your CISO cannot start without your sponsorship.
- Set the risk-acceptance rule. Decide who may accept the risk of leaving a system on old cryptography, and require that person to sign in writing.
- Add post-quantum requirements to procurement. OMB expects requirement owners to include PQC readiness and crypto-agility provisions in vendor requirements 2. Do the same in your contracts and renewals.
- Fund the first two phases only. Commit to inventory and prioritization now. Let the results size the migration budget.
What it costs to wait
Waiting does not save money. It moves cost to a worse moment. Your inventory takes time because the work depends on other teams and on suppliers who answer slowly. The NCSC expects large organizations to need two to three years for discovery and planning alone 1, so a late start compresses every later phase.
Waiting also leaves data exposed. Information captured now stays captured, and you cannot recall it. Supplier dependence grows too: if you add new systems without post-quantum requirements, you create more work for phase four. Finally, audit exposure rises. Public deadlines now exist 2, 4, and "we have not started" is a hard answer to give once they do.
How to brief your board
ArcQubit guidance. Keep the briefing to five points:
- The exposure: long-lived data is at risk from capture today, and we have identified which data that is (or we are identifying it now).
- The plan: five phases with named owners, following public government timelines 1, 2.
- The ask: a named executive, discovery funding, and a written risk-acceptance rule.
- The dependency: our migration finishes when our key suppliers finish, so we are putting requirements into contracts.
- The report-back: a short progress view each quarter showing inventory coverage, systems ranked, pilots completed and exceptions accepted.
Common mistakes
ArcQubit guidance. Four errors recur:
- Waiting for a perfect inventory. Canada and the NCSC both say to start incomplete and improve 1, 3.
- Treating support as completion. A system that supports a post-quantum algorithm but negotiates the old one is not migrated 3.
- Skipping the owner. A finding with no named owner does not get fixed.
- Ignoring suppliers. Your vendors control a large share of the timeline, so ask them for their plans early.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the guidance above.
ArcQubit maps this roadmap to its eight-phase Crypto-Agility Lifecycle Model (CALM). The eight phases are governance and awareness, discovery and inventory, risk assessment and planning, testing and pilot execution, key establishment migration, signature migration, active migration and monitoring, and continuous crypto-agility. QuCode covers governance and awareness and discovery and inventory, supports pilot testing, and returns in phase seven to re-scan as new cryptography appears. QuTrust keeps the risk assessment, action plan, and migration roadmap current, and builds crypto-agility into the existing cyber program. ArcQubit sells QuCode directly as fixed-scope discovery work. Contact ArcQubit to scope a discovery scan.