Short, source-backed notes on the decisions behind a credible post-quantum transition.
The new national guidance makes the management question concrete: who owns the cryptographic transition, and what happens next?
The German announcement should prompt an evidence-led conversation, not a claim that every organisation has acquired the same legal deadline. Start by establishing applicability, accountable owners and an inventory of dependencies.
Changing an algorithm is a technical task. Being able to change it safely and repeatedly is an organisational capability.
NIST’s updated crypto-agility white paper provides a useful starting point. In practice, agility connects discovery, architecture, procurement, testing and decision-making; it cannot be reduced to a single library or API.
A system’s replacement date is not the same as the confidentiality lifetime of the information it handles.
Harvest-now-decrypt-later risk makes information lifetime a useful prioritisation lens. This does not mean every asset needs the same immediate intervention. Combine data sensitivity, lifetime, exposure and migration lead time.
Algorithm announcements, draft guidance and final publications play different roles in procurement and architecture.
The first three NIST PQC FIPS publications provide final algorithm standards. Work on additional algorithms and transition guidance continues. Keep a dated register so proposals are not mistaken for final requirements.
Start with a clear view of your cryptographic exposure. Build a transition you can govern, fund and deliver.
