Quantum Readiness: How to Prepare for Post-Quantum Cryptography

Quantum computing capabilities aren’t a distant or hypothetical threat. Corporations and startups are making steady progress toward a functional quantum computer, and many experts predict true quantum computing is likely to arrive within the next decade.

In preparation, governments have already released quantum-resistant cryptography standards with rapidly approaching deadlines. Transitioning could take years, which means the time to begin quantum readiness is right now.

To stay ahead of the post-quantum cryptography curve, start with an evaluation of your organization’s quantum risk: an honest assessment of current systems and cryptographic algorithms. Then, follow our 10 steps to quantum safety.

What Is Quantum Readiness?

Quantum readiness is the measure of an organization’s ability to protect itself from future attacks by cryptographically relevant quantum computers (CRQC), which will likely break encryption standards within the next decade. Its focus is replacing current cryptographic systems with post-quantum cryptography (PQC): encryption algorithms capable of withstanding quantum threats.

To achieve quantum readiness, organizations must identify all cryptographic libraries in use today, then swap vulnerable encryption algorithms like Rivest-Shamir-Adleman and Elliptic Curve Cryptography (RSA and ECC) for quantum-resistant encryption algorithms. Vulnerable algorithms may exist wherever credentials or certificates are used, including digital signatures and authentication processes.

Quantum-ready organizations:

• Implement PQC algorithms that meet current and upcoming regulatory standards
• Maintain cryptographic agility by replacing outdated algorithms as quantum threats evolve
• Establish quantum-safe security and risk management procedures
• Educate teams on effective quantum attack prevention and detection methods

Why Quantum Readiness Matters Now

While current quantum capabilities are insufficient, the encryption-breaking algorithm already exists, which means the quantum era is already here.

Developed in 1994, Shor’s algorithm can break RSA and ECC, two of the most widely used encryption algorithms today. The hitch is that it doesn’t work on the classical computers we have now. But it will run on a functional quantum computer, meaning that when quantum processors advance, previously protected data is vulnerable.

When the National Institute of Standards and Technology (NIST) released its first three finalized PQC standards in August 2024, it noted that some experts predict future quantum computers could decrypt existing algorithms within a decade.

That’s why the National Security Agency (NSA) published a quantum-safe cryptography suite, the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), in 2022. CNSA 2.0 requires National Security Systems owners, operators and vendors to adopt quantum-resistant algorithms by 2030 (for networking equipment) or 2033 (for browsers, operating systems and cloud services).

Meanwhile, harvest now, decrypt later (HNDL) attacks already intercept encrypted traffic. Why collect data that can’t be decrypted? Because sensitive information like financial transactions, intellectual property and other classified data has a long lifespan. So, by the time quantum computers mature, that decrypted data will still be useful.

HNDL attacks are difficult to detect because the hackers don’t break anything. Instead, they silently observe, harvest and store the information. Often, you won’t know you’ve been exposed or understand the full scope of the attack.

Because of HNDL, quantum preparedness isn’t just about future threats. The approach is a timely and relevant security posture improvement that addresses the risks of vulnerable cryptography.

How to Assess Quantum Readiness

The path to quantum readiness starts with a complete cryptographic inventory, which identifies everywhere cryptographic algorithms are used across your organization. This information is required to create and implement a quantum readiness assessment (QRA), a comprehensive overview of your organization’s current status and exposure to threats.

A QRA reveals the impact of quantum decryption if Q-Day (the day quantum computing breaks encryption) were to happen today.

QRAs audit:

• Your use of quantum-vulnerable algorithms (like RSA or ECC)
• The robustness of your plans to transition your current digital security posture to post-quantum cryptography
• Your ability to remain adaptive to quantum advancements

You can use framework-based QRAs such as the Quantum-Readiness: Migration to Post-Quantum Cryptography factsheet (created by CISA, NSA and NIST), conduct a QRA yourself or have a third party assess your quantum readiness. The more comprehensive your assessment is, the more confident you can feel in your preparation for quantum computing.

10 Practical Steps to Improve Quantum Readiness

Readying your organization for PQC isn’t science fiction. There are concrete steps you can take today, many of which are grounded in existing best practices for network security.

Follow these steps to get ahead of the quantum curve:

1. Compile your cryptographic inventory: Create a detailed list of all specific systems and processes that use keys, credentials, certificates and code signing.
2. Prioritize efforts by risk: Based on your cryptographic inventory, determine the most high-priority data protection opportunities. Which information must remain confidential, is most valuable and has the longest lifespan?
3. Develop a quantum readiness roadmap: With a complete inventory and prioritized list, design a PQC migration roadmap to achieve quantum readiness as soon as possible.
4. Update brownfield devices: Many legacy devices are unable to process post-quantum keys, leaving them vulnerable to attacks. To defend against quantum machines, implement hybrid certificates for secure authentication and update/upgrade devices.
5. Plan for computational overhead: The complexity and key size of quantum-safe algorithms increase resource demand. Ensure your hardware, storage and processes can accommodate this.
6. Implement automated Certificate Lifecycle Management (CLM): Quantum readiness requires a secure public key infrastructure (PKI) with automated certificate issuance, renewal and revocation, including real-time policy enforcement.
7. Ensure vendor quantum readiness: Vendors have different levels of quantum readiness, different roadmaps and different timelines to adopt quantum-safe solutions. Don’t sign new contracts until you verify compatibility.
8. Emphasize cryptographic agility (crypto-agility): All systems must be flexible, with the ability to deprecate outdated encryption methods and swap in new ones without impacting business continuity.
9. Adopt NIST standards: NIST standardized three PQC algorithms to withstand future quantum threats: ML-KEM for key encapsulation and both ML-DSA and SLH-DSA for digital signatures.
10. Don’t overlook authentication: Most quantum readiness advice doesn’t include Remote Authentication Dial-In User Service (RADIUS) and 802.1X authentication preparedness, both of which also need to be quantum-ready. Quantum attackers could decrypt network credentials during authentication, letting them forge digital identities and expand their attack surface.

Two SecureW2 solutions make quantum readiness simpler and faster to achieve:

• JoinNow Cloud RADIUS supports quantum-ready authentication measures like RadSec and TLS 1.3, so authentication traffic stays encrypted end to end.
• JoinNow Dynamic PKI issues and manages certificates, including hybrid certificates for brownfield devices, so every device stays connected throughout the transition.

Schedule a demo to see how SecureW2 solutions secure your network today while setting you up for the quantum world of tomorrow.