How to build a quantum readiness roadmap.

Readiness begins before replacement.

The term does not mean every system has already migrated or that risk has disappeared. A ready organization knows its exposure, owns a prioritized plan and can produce evidence that the plan is moving.

US federal timelines are useful signals, but they are not universal private-sector deadlines. The White House set a 2035 risk-mitigation goal for priority federal systems; NSA's CNSA 2.0 dates apply specifically to National Security Systems. Every organization still needs a plan based on its own data and obligations.

A useful roadmap connects six workstreams.

1. 01

   Govern

   Name an executive sponsor, programme owner and working group across security, engineering, infrastructure, procurement and risk.

2. 02

   Discover

   Build a cryptographic inventory covering public endpoints, code, cloud services, certificates, devices and suppliers.

3. 03

   Assess

   Connect assets to data sensitivity, secrecy lifetime, exposure, business criticality and replacement difficulty.

4. 04

   Plan

   Sequence remediation, vendor dependencies, testing environments, budgets and decision gates.

5. 05

   Migrate

   Test interoperable implementations, deploy in phases, preserve rollback paths and manage exceptions.

6. 06

   Verify

   Continuously monitor for vulnerable or newly introduced cryptography and retain evidence of change.

Prioritize by consequence and lead time.

Start with information that must remain secret longest because it is most exposed to harvest now, decrypt later. Then consider internet exposure, authentication and signing criticality, regulatory or contractual commitments, supplier lead time and system replaceability.

A high-value dataset behind a hard-to-replace system may need action before a more visible but short-lived workload. The roadmap should show those trade-offs rather than collapse them into one opaque score.

Track evidence, not declarations.

Readiness can be demonstrated with an owned cryptographic inventory, data-lifetime classifications, approved algorithm profiles, supplier responses, test results, migration decisions, exception records and trend reporting. Evidence should state its scope and recency.

A claim such as “quantum-proof” hides uncertainty. Better evidence shows what was assessed, which standards were used, what remains exposed and when the result was last verified.

A focused first 30 days creates momentum.

1. Appoint one accountable programme owner and define the systems in scope.
2. Inventory public-facing certificates and key exchange as a fast baseline.
3. Identify the three data classes with the longest secrecy lifetimes.
4. Ask critical suppliers for their standards support and migration roadmap.
5. Select one representative service for a controlled PQC test.
6. Define the measures leadership will review each quarter.

From there, expand discovery and use crypto agility practices to reduce the cost of each migration wave.