NCSC urges firms to build quantum-safe resilience with PQC migration

The United Kingdom’s National Cyber Security Centre is now directing a timeline for organizations to adopt post-quantum cryptography, moving beyond warnings about the future threat of quantum computers. This guidance is for large organizations, operators of critical national infrastructure systems, and companies with bespoke IT, recognizing their complex cryptographic needs. The NCSC outlines a migration process beginning with an assessment of cryptographic dependencies, emphasizing detailed planning before technical implementation. These key target dates are intended to guide investment decisions and broader cyber security planning as the nation prepares for a mass technology change. The National Cyber Security Centre anticipates most organizations will complete migration to post-quantum cryptography by 2035, establishing a firm end-date for a widespread technological shift and signaling a move beyond simply warning about the quantum threat. This target date, detailed in recently released guidance, assumes a decade is sufficient for the development of robust post-quantum standards and the creation of a supporting product ecosystem, allowing for the eventual phasing out of vulnerable traditional public key cryptography. Understanding the full scope of an organization’s cryptographic footprint is the first step to…