Post Quantum Cryptography: The Deadline Boards Cannot Defer
Post quantum cryptography has a deadline, and it is closer than most boards think. Data stolen today can be decrypted later, which means the exposure starts now, years before the quantum computers that can exploit it arrive.
Quick Read: Executive Summary
Name an owner for cryptography. Most companies cannot say who decides which encryption they use. Give one executive that accountability, a budget line, and a reporting date.
Build a cryptographic inventory. List where public key encryption protects data and signatures: remote access, customer portals, file transfer, backups, code signing, and connections to vendors.
Rank data by how long it must stay secret. Deal documents, estate plans, health records, and intellectual property that must stay confidential for ten years or more move to the front of the line.
Put quantum readiness into vendor renewals. Ask every critical supplier for its migration roadmap to the NIST post quantum standards and a target date, and write it into contracts signed from now on.
Fund crypto agility, not a one time swap. Systems should be able to change algorithms through configuration rather than a rebuild, because the standards and guidance will keep moving.
Supporting Framework: Why Encryption Became a Governance Question
Most executives treat encryption as a solved problem. The padlock icon appears, the auditor checks a box, and the conversation moves on. The assumption behind that padlock is changing. The public key algorithms that protect most of today's data and digital signatures depend on math problems that a large enough quantum computer is expected to solve.
The timeline has moved from academic debate to planning assumption. Gartner predicts that by 2029, advances in quantum computing will make most conventional asymmetric cryptography unsafe to use. You do not have to accept the precise year to accept the direction, and the standards bodies have already acted on it. In its draft transition report, IR 8547, NIST proposes that quantum vulnerable public key algorithms be deprecated after 2030 and disallowed after 2035, consistent with the federal goal of widespread adoption of post quantum cryptography by 2035.
The reason this cannot wait for 2029 has a name: harvest now, decrypt later. NIST's own report describes adversaries collecting encrypted data today so they can decrypt it once the capability exists. For most operational data that is a manageable risk. For information whose value lasts for decades, it is not. A family office's estate plans, a healthcare organization's patient records, and the terms of a private deal are all worth stealing now and reading later.
The harder problem is that encryption lives in places nobody has inventoried. It is embedded in vendor software, network appliances, certificates, backup tools, and integrations that were set up years ago and never revisited. The NIST Cybersecurity Framework 2.0 already expects organizations to maintain inventories of their hardware, software, services, and systems. Very few of those inventories record which cryptography each system depends on, which is why the first step in every serious migration plan is simply finding it.
For middle market companies, most of the migration will arrive through vendors rather than through internal engineering. That shifts the bargaining power to procurement. A contract signed this year for a three or five year term will run straight into the 2030 deprecation window, so renewals are the cheapest moment to ask the question. Encryption is one of the security domains boards rarely see, a point I made in Cybersecurity Has 12 Domains. Boards Oversee Two., and post quantum readiness is the clearest example of why that blind spot now carries a date.
Summary Thoughts
Quantum readiness is an inventory and procurement problem that happens to be driven by physics. Nothing about the first steps requires a quantum expert: it requires an owner, a list, and a rule that no critical contract gets renewed without a migration commitment.
The board question is straightforward. Which of our data must stay secret past 2030, and do we know what protects it today? A company that can answer both has time on its side. A company that cannot is already behind, whether or not a quantum computer ever touches its data.
Evidence
By 2029, advances in quantum computing will make most conventional asymmetric cryptography unsafe to use; post quantum cryptography requires long lead times because switching methods is not easy. Source: Gartner, Top 10 Strategic Technology Trends for 2025, October 21, 2024.
Quantum vulnerable public key algorithms are proposed to be deprecated after 2030 and disallowed after 2035; the report identifies the harvest now, decrypt later threat and aligns with the federal 2035 target. The report is an initial public draft. Source: NIST IR 8547 (Initial Public Draft), Transition to Post Quantum Cryptography Standards, November 2024.
Organizations are expected to maintain inventories of hardware, software, services, and systems. Source: NIST Cybersecurity Framework 2.0.
Comments