Europol publishes a method for prioritizing post-quantum migration
21 JANUARY 2026, THE HAGUE
Europol published a method for prioritizing post-quantum migration on 21 January 2026. The method ranks systems by three factors: the shelf life of the data they protect, the system's exposure, and the business impact of a compromise. It then weighs that risk against the time each system needs to migrate.
Weighing risk against migration time is the method's key insight. A system that is both high-risk and slow to migrate must start earliest, because it needs urgency and a long runway at once. Ranking this way stops an organization from leaving its hardest, most important systems until last, when there may be too little time left to finish them.
The method answers a practical problem for security leaders. No organization can migrate every system at once, so the order matters. By giving CISOs and their teams a structured way to rank systems on data shelf life, exposure, business impact and migration time, the method turns an overwhelming estate-wide task into a defensible, sequenced plan.
Why it matters. Europol's method gives security teams a concrete way to decide what to migrate first, rather than guessing. Its core idea, that high-risk and slow-to-migrate systems must start earliest, is one of the most useful planning rules for a long migration. CISOs can apply the shelf-life, exposure, business-impact and migration-time factors to their own inventory to produce a prioritised, time-aware roadmap.