How to evaluate a post-quantum cryptography provider: 10 questions to ask

Post-quantum cryptography (PQC) is moving from research and standardization into implementation. For organizations beginning to assess their post-quantum readiness, that creates a new question: how do you choose the right technology and the best provider to support the transition? The timelines are becoming clearer. In August 2024, the US National Institute of Standards and Technology (NIST) published its first three finalized post-quantum cryptography standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). NIST now advises organizations to begin applying these standards as they migrate towards quantum-resistant cryptography. In the UK, the National Cyber Security Centre (NCSC) has set out an indicative migration timeline. It recommends organizations complete cryptographic discovery and initial migration planning by 2028, undertake their highest-priority migrations by 2031, and complete migration across systems, services, and products by 2035. For large organizations, the NCSC estimates that discovery, assessment, strategy, and initial migration planning alone could take two to three years. This means that choosing a PQC provider is much more than checking whether it supports the latest algorithms. Organizations need technology that can be implemented securely, integrated into existing environments, and adapted as standards and requirements continue to evolve. Here…