[{"data":1,"prerenderedAt":393},["ShallowReactive",2],{"blog-\u002Fblog\u002Fpqc-migration-where-to-start":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":324,"date":325,"description":326,"draft":327,"extension":328,"faqs":329,"findingsSource":7,"geo":342,"howto":7,"howtoTitle":7,"image":344,"industries":345,"keyFindings":7,"meta":347,"modified":348,"navigation":349,"path":350,"pullquote":7,"recommendations":7,"references":351,"related":364,"seo":377,"seoTitle":378,"signposts":7,"slug":379,"stats":380,"stem":383,"tags":384,"tldr":391,"__hash__":392},"blog\u002Fblog\u002Fpqc-migration-where-to-start.md","PQC Migration: Where to Start When Everything Feels Urgent","ArcQubit Team",null,{"type":9,"value":10,"toc":310},"minimark",[11,16,32,38,42,49,52,61,65,74,81,87,135,138,142,145,150,153,162,166,169,191,194,198,206,212,220,224,227,242,246,260,264,290,298,302,307],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,24,28,31],"p",{},"Post-quantum urgency is a prioritization problem, not a reason to freeze or to migrate everything at once. Build a cryptographic inventory, rank systems by exposure and tractability, take the quick wins, and use hybrid deployments only where full migration has to wait ",[21,22,23],"span",{},"2",", ",[21,26,27],{},"3",[21,29,30],{},"4",".",[17,33,34],{},[35,36,37],"em",{},"Last verified: Sep. 30, 2026.",[12,39,41],{"id":40},"why-everything-feels-urgent","Why everything feels urgent",[17,43,44,45,48],{},"NIST finalized its first three post-quantum standards in August 2024 and encouraged administrators to start integrating them immediately, because full integration takes time ",[21,46,47],{},"1",". Governments now publish timelines. Vendors publish roadmaps. The message is clear, but \"migrate now\" does not say what to do first.",[17,50,51],{},"Post-quantum migration touches every system that uses public-key cryptography: authentication, encrypted communications, signatures, certificates, VPNs, APIs, cloud integrations, and hardware security modules. Two reactions fail. One is to freeze. The other is to attack everything at once.",[17,53,54,55,57,58,60],{},"The timelines help. They run for years. The NCSC asks for discovery and planning by 2028, highest-priority migrations by 2031, and full migration by 2035 ",[21,56,27],{},". OMB phases federal work the same way, starting with inventory in 2026 to 2027 ",[21,59,23],{},". You have time to sequence the work, but not time to skip the sequencing.",[12,62,64],{"id":63},"rank-by-exposure-and-tractability","Rank by exposure and tractability",[17,66,67],{},[35,68,69,70,24,72,31],{},"The matrix below is ArcQubit guidance. No standard prescribes it. It applies the risk-based approach that OMB and the NCSC describe, which prioritizes sensitive, high-impact systems first ",[21,71,23],{},[21,73,27],{},[17,75,76,80],{},[77,78,79],"strong",{},"Exposure"," measures the damage if a system's cryptography falls to a quantum attack. Data that must stay confidential for 15 years carries more exposure than a session token that expires in hours. Regulated data, critical infrastructure controls, and high-value financial transactions also rank high.",[17,82,83,86],{},[77,84,85],{},"Tractability"," measures how hard the migration is. A library you can update through configuration is tractable. Algorithms embedded in hardware, legacy protocols, or third-party integrations are not.",[88,89,90,105],"table",{},[91,92,93],"thead",{},[94,95,96,99,102],"tr",{},[97,98],"th",{},[97,100,101],{},"High tractability",[97,103,104],{},"Low tractability",[106,107,108,122],"tbody",{},[94,109,110,116,119],{},[111,112,113],"td",{},[77,114,115],{},"High exposure",[111,117,118],{},"Move first",[111,120,121],{},"Plan now, execute as dependencies clear",[94,123,124,129,132],{},[111,125,126],{},[77,127,128],{},"Low exposure",[111,130,131],{},"Move opportunistically",[111,133,134],{},"Deprioritize, revisit at refresh",[17,136,137],{},"Low-exposure systems wait regardless of how easy they are. A quick win on a system that protects nothing sensitive uses effort you need elsewhere.",[12,139,141],{"id":140},"you-cannot-rank-what-you-cannot-see","You cannot rank what you cannot see",[17,143,144],{},"Prioritization needs an inventory. Most organizations cannot yet say where public-key cryptography runs across the enterprise. That gap is your first project.",[17,146,147,148,31],{},"A useful inventory records the algorithm and key size, the location, the purpose, whether the cryptography sits in hardware or software, the data it protects, and an owner. The owner field matters most for supplier-controlled systems, because your fix depends on their roadmap. OMB asks agencies to address vendor and third-party software in their plans ",[21,149,23],{},[17,151,152],{},"In ArcQubit's view, a large share of exposure sits in code your team did not write. We have no measured figure for that share, so treat it as a working assumption to test in your own environment. Give supplier-owned findings an owner and a follow-up date.",[17,154,155,156,161],{},"The ",[157,158,160],"a",{"href":159},"\u002Fblog\u002Fcryptographic-inventory-cbom","cryptographic inventory and CBOM guide"," explains how to build one.",[12,163,165],{"id":164},"take-quick-wins","Take quick wins",[17,167,168],{},"Not every migration needs a multi-year plan. Early wins reduce risk and build the skills harder migrations need. Look for:",[170,171,172,179,185],"ul",{},[173,174,175,178],"li",{},[77,176,177],{},"Configurable libraries."," Well-maintained libraries where an algorithm change is a configuration update, not a rewrite.",[173,180,181,184],{},[77,182,183],{},"New builds."," Systems still in development, where you can choose post-quantum algorithms from the start.",[173,186,187,190],{},[77,188,189],{},"External-facing services."," Endpoints where a hybrid deployment adds protection without breaking compatibility.",[17,192,193],{},"Each win teaches your team the process, exposes hidden dependencies, and produces a playbook for the next system.",[12,195,197],{"id":196},"use-hybrid-deployments-to-buy-time","Use hybrid deployments to buy time",[17,199,200,201,203,204,31],{},"Hybrid cryptography runs a traditional algorithm and a post-quantum algorithm together. NIST explains that a well-designed combination stays secure if at least one component stays secure ",[21,202,30],{},". OMB describes the same idea: an attacker must break both schemes ",[21,205,23],{},[17,207,208,209,211],{},"Hybrid is a bridge, not a destination. OMB calls it an intricate and resource-intensive stopgap that carries its own risks, and tells agencies to evaluate the tradeoffs ",[21,210,23],{},". Two stacks cost more to run and to keep current.",[17,213,214,215,219],{},"Use it where it earns its cost: high-exposure systems that cannot complete full migration soon, often because a vendor update or hardware refresh is out of your hands. The ",[157,216,218],{"href":217},"\u002Fblog\u002Fhybrid-vs-pure-post-quantum","hybrid vs pure post-quantum"," article compares the options.",[12,221,223],{"id":222},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,225,226],{},"Urgency becomes manageable when leadership asks for a sequence, not a slogan. ArcQubit guidance for the next review:",[228,229,230,233,236,239],"ol",{},[173,231,232],{},"Ask for the inventory status and its coverage of high-value systems.",[173,234,235],{},"Ask which systems are high exposure and what blocks each one.",[173,237,238],{},"Approve a small set of quick wins with owners and dates.",[173,240,241],{},"Require a supplier list showing which vendors have published post-quantum roadmaps.",[12,243,245],{"id":244},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[170,247,248,251,254,257],{},[173,249,250],{},"Which systems protect data that must stay confidential beyond 2035?",[173,252,253],{},"Which of those can we update by configuration?",[173,255,256],{},"Which findings depend on a supplier, and who is talking to that supplier?",[173,258,259],{},"Where would a hybrid deployment reduce risk fastest?",[12,261,263],{"id":262},"common-mistakes","Common mistakes",[170,265,266,272,278,284],{},[173,267,268,271],{},[77,269,270],{},"Skipping the inventory."," Teams migrate the wrong systems first or find critical gaps mid-program.",[173,273,274,277],{},[77,275,276],{},"Ranking by ease alone."," Easy systems feel productive, but exposure decides priority.",[173,279,280,283],{},[77,281,282],{},"Treating hybrid as the finish line."," It adds protection now and operational cost later.",[173,285,286,289],{},[77,287,288],{},"Ignoring supplier-owned cryptography."," A finding with no owner never gets fixed.",[17,291,292,293,297],{},"Read the ",[157,294,296],{"href":295},"\u002Fblog\u002Fpqc-migration-roadmap","migration roadmap"," for the phased plan that follows prioritization.",[12,299,301],{"id":300},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,303,304],{},[35,305,306],{},"This box describes ArcQubit's own method.",[17,308,309],{},"ArcQubit's QuCode is enterprise discovery and inventory, sold directly as fixed-scope work. It produces a Quantum Exposure Report that names the software, algorithm, location, exposure score, and owner, whether your team or a supplier, for each finding. QuTrust then serves as the migration system of record, keeping the roadmap current so sequencing follows structured prioritization.",{"title":311,"searchDepth":312,"depth":312,"links":313},"",2,[314,315,316,317,318,319,320,321,322,323],{"id":14,"depth":312,"text":15},{"id":40,"depth":312,"text":41},{"id":63,"depth":312,"text":64},{"id":140,"depth":312,"text":141},{"id":164,"depth":312,"text":165},{"id":196,"depth":312,"text":197},{"id":222,"depth":312,"text":223},{"id":244,"depth":312,"text":245},{"id":262,"depth":312,"text":263},{"id":300,"depth":312,"text":301},"Security","2026-02-17","Post-quantum migration feels urgent everywhere. Rank systems by exposure and tractability, take quick wins, and use hybrid deployments to buy time.",false,"md",[330,333,336,339],{"q":331,"a":332},"Where should a post-quantum migration start?","Start with a cryptographic inventory, because you cannot rank systems you cannot see. Then rank them by exposure and tractability. The NCSC tells organizations to begin with discovery and planning by 2028, and OMB directs agencies to prioritize high-impact systems and high value assets first [2], [3].",{"q":334,"a":335},"What should I migrate first?","As ArcQubit guidance, migrate first the systems with high exposure and an easy migration path, meaning long-lived sensitive data and updatable libraries. Plan now for high-exposure systems with hard dependencies. OMB similarly tells agencies to prioritize high-impact systems, high value assets, and data expected to stay sensitive in 2030 [2].",{"q":337,"a":338},"What is hybrid cryptography?","Hybrid cryptography combines a traditional algorithm with a post-quantum one. NIST notes that a well-designed combination stays secure if at least one component remains secure [4]. OMB also calls hybrid an intricate, resource-intensive stopgap, so evaluate the tradeoffs before deploying it [2].",{"q":340,"a":341},"Do I need to migrate every system at once?","No. Government timelines run for years, not months. The NCSC sets milestones at 2028, 2031, and 2035 [3], and OMB describes phased migration starting with inventory in 2026 to 2027 [2]. Sequence the work by risk instead of attempting everything at the same time.",[343],"global","\u002Fblog\u002Fpqc-migration-start.png",[346],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fpqc-migration-where-to-start",[352,355,358,361],{"label":353,"url":354},"National Institute of Standards and Technology, \"NIST Releases First 3 Finalized Post-Quantum Encryption Standards,\" NIST, Aug. 13, 2024","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2024\u002F08\u002Fnist-releases-first-3-finalized-post-quantum-encryption-standards",{"label":356,"url":357},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":359,"url":360},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":362,"url":363},"National Institute of Standards and Technology, \"Recommendations for Key-Encapsulation Mechanisms,\" NIST SP 800-227, Sep. 2025","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F227\u002Ffinal",[365,368,370,372,374],{"label":366,"url":367},"PQC Migration Hub: The Complete Guide","\u002Fpqc-migration",{"label":369,"url":159},"Cryptographic Inventory and CBOM",{"label":371,"url":217},"Hybrid vs Pure Post-Quantum",{"label":373,"url":295},"Migration Roadmap",{"label":375,"url":376},"Global Mandates and Deadlines","\u002Fblog\u002Fpqc-mandates-deadlines",{"title":5,"description":326},"PQC Migration: Where to Start When All Is Urgent","pqc-migration-where-to-start",[381,382],"NIST released its first three finalized post-quantum standards, FIPS 203, 204, and 205, on Aug. 13, 2024 (NIST, 2024).","The UK NCSC sets three migration milestones: discovery and planning by 2028, highest-priority migrations by 2031, and full migration by 2035 (NCSC, Mar. 2025).","blog\u002Fpqc-migration-where-to-start",[385,386,387,388,389,390],"PQC migration","post-quantum cryptography","quantum readiness","cryptographic inventory","hybrid key exchange","for CISOs","Post-quantum urgency is a prioritization problem: inventory your cryptography, rank systems by exposure and tractability, take quick wins, and use hybrid deployments only where full migration must wait.","VDymdaI7b6Ps3gus6U1EyDGgVrYqrB1C1xvaM5t4cTs",1792182884402]