In the first 30 days, do four things: build an inventory of where you use public-key cryptography, rank it by how long the protected data must stay secret, ask vendors about their post-quantum plans, and pick one low-risk pilot. You do not need a large budget to start, and none of it requires choosing final algorithms yet.
Week 1: assign and scope
- Name an owner. Cryptography migration falls between security, platform and product teams, so someone must hold it.
- Write a one-page scope: systems, data classes, and the standards you will follow. NIST's finalized standards are FIPS 203, 204 and 205.
- Agree on language. Use "quantum-vulnerable" for RSA, DH, elliptic curve and related schemes, as in NIST IR 8547.
Week 2: inventory
CISA's page says federal agencies must keep a current inventory of IT vulnerable to quantum decryption, and that it works with NIST's NCCoE on automated discovery tools. A private company can borrow the practice.
Collect:
- TLS endpoints and the key exchange and certificate types they use.
- SSH, VPN and tunnel configurations.
- Code, package and image signing keys and where they are held.
- Libraries in your software that implement cryptography, from your SBOM or dependency scan.
- Vendor and SaaS dependencies that terminate or sign on your behalf.
- Hardware with fixed firmware: HSMs, devices, smart cards.
Week 3: rank and decide
For each item, record data lifetime, who owns it, how hard it is to change, and whether the vendor controls it.
Rank by lifetime first. Data that must stay secret for ten years or more, carried over public-key key exchange, goes to the top. This is the harvest now, decrypt later group.
Week 4: ask, pilot, report
- Send vendors three questions: which post-quantum standards do you support, when, and how will you tell us.
- Pick one pilot where a post-quantum key exchange is already available as a software update, such as a TLS endpoint you control. Turn it on in a test environment, test handshake sizes and logging.
- Write a short report: inventory count, top ten exposures, pilot result, and the next quarter plan.
What not to do in 30 days
- Do not rip out RSA everywhere.
- Do not choose a vendor product only because it says quantum on the label.
- Do not promise a date to customers that you have not tested.
A note on dates
NIST's draft proposes deprecation after 2030 and disallowance after 2035 for its own standards. Use them as planning markers, and watch for the final report.
Safeguard can help with the dependency part of the inventory through SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan. The rest needs your own review.
Quick check
What is the single most useful first step?
An inventory of public-key use ranked by data lifetime. Without it, you cannot decide what to migrate first.
Do we need to pick final algorithms in the first month?
No. Pick a pilot, learn from it, and keep algorithm choices in configuration so they can change.
Sources
Last reviewed: 19 October 2026.
