NCSA Guidelines for Post-Quantum Readiness

Scope and the quantum risk to assess first

The document is practical guidance rather than a binding notification. It targets government agencies and CII organizations that collect, use, exchange, or disclose confidential information through information systems.

Which data needs quantum-readiness first: Long-lived confidential data, Harvest now, decrypt later, Cryptographic dependencies, System lifetime and constraints, Priority — **Which data needs quantum-readiness first**
Prioritize long-lived data and systems that are difficult to migrate.
**Long-lived confidential data** — Determine its security shelf life
**Harvest now, decrypt later** — Consider data that could be collected today
**Cryptographic dependencies** — Identify algorithms, protocols, certificates, and keys
**System lifetime and constraints** — Consider hardware, software, and suppliers
**Priority** — Compare data lifetime with migration effort and threat horizon

Public-key cryptography underpinning key exchange, digital signatures, and authentication (including RSA, ECC, and Diffie-Hellman) will be fundamentally broken by large-scale quantum computers running Shor's Algorithm.
Harvest Now, Decrypt Later represents an active and immediate risk where adversaries intercept and archive encrypted communications today to decrypt them once cryptanalytically relevant quantum computers emerge, echoing historical precedents like the Venona project.
Symmetric ciphers such as AES experience a quadratic speedup under Grover's Algorithm, which halves their effective security margin. Organizations can mitigate this by doubling key lengths to AES-256 and upgrading hash functions to SHA-384 or SHA-512.
Organizations must prioritize confidential data with a required security shelf life exceeding ten years, such as health records, trade secrets, financial transactions, and national security intelligence.

Use the Mosca model to prioritize transition

The guidance assesses risk through the relationship between the time an organization needs to migrate, the required secrecy lifetime of data, and the time until a capable quantum threat emerges.

When cryptographic migration is urgent: X Migration time, Y Security shelf life, Z Threat timeline, X + Y > Z — **When cryptographic migration is urgent**
Compare X plus Y with Z to assess urgency. These are organizational estimates, not a prediction of the date a quantum computer will break encryption.
**X Migration time** — Time needed to make systems ready
**Y Security shelf life** — Time the data must remain secure
**Z Threat timeline** — Time until a capable quantum threat
**X + Y > Z** — Start planning now

Mosca's Theorem establishes a mathematical crisis condition: whenever migration time plus data security shelf life exceeds the threat timeline, expressed as (x + y) - z > 0, organizational data is already exposed to future compromise today.
Variable x (Migration Time) measures the years needed to overhaul PKI, applications, network appliances, and vendor workflows. Industry research indicates an enterprise-wide cryptographic transition spans five to twenty years.
Variable y (Security Shelf Life) defines how long data must retain its confidentiality and integrity, ranging from decades for medical and national records to the operational lifespan of IoT field devices and Smart Grid systems.
Variable z (Threat Timeline) represents the estimated years before capable quantum hardware emerges. Technical teams must track progress through metrics like logical qubits rather than mere physical qubit counts.

PQC, QKD, and transition design

The guidance discusses Post-Quantum Cryptography (PQC), Quantum Key Distribution (QKD), and hybrid approaches so each system can be assessed against its own risk and constraints.

Designing the cryptographic transition: Current cryptography, Post-Quantum Cryptography, QKD, Hybrid approach, Crypto agility — **Designing the cryptographic transition**
Select transition options from risk, compatibility, and system constraints.
**Current cryptography** — Understand dependencies and constraints
**Post-Quantum Cryptography** — Evaluate suitability for real systems
**QKD** — Use only where context and constraints support it
**Hybrid approach** — Combine current and post-quantum mechanisms during transition
**Crypto agility** — Design systems so algorithms can be replaced

Post-Quantum Cryptography (PQC) represents the primary path forward for existing network infrastructure, deploying mathematical problems resistant to both classical and quantum computing, such as CRYSTALS-Kyber for key exchange, alongside CRYSTALS-Dilithium and SPHINCS+ for digital signatures.
Quantum Key Distribution (QKD) faces severe practical limitations, including a maximum distance of 125 kilometers over point-to-point fiber, low key exchange rates, high hardware expense, and an inherent inability to perform authentication. International cybersecurity authorities, including NSA, NCSC, and ANSSI, advise against relying on QKD for national security and military systems.
Hybrid solutions combining classical cryptography with PQC (such as IETF RFC 9370 for IKEv2) deliver the most cost-effective and secure migration architecture, preserving backward compatibility while mitigating unexpected algorithm vulnerabilities.
Crypto Agility must be engineered into system architectures so that cryptographic algorithms can be swapped swiftly, as demonstrated by the rapid invalidation of candidates like SIKE after years of evaluation.

A seven-step roadmap and the evidence to start collecting

The guidance sets out seven readiness steps that executives, managers, and operational teams must advance together rather than treating the work as a one-point algorithm replacement.

Seven steps to quantum readiness: Build the roadmap → Build awareness → Assign responsibilities → Inventory assets → Evaluate options → Pilot and test → Monitor continuously — **Seven steps to quantum readiness**
Transition planning starts with ownership and inventory before technology selection.
**Build the roadmap** — Assign people, resources, and a transition plan
**Build awareness** — Educate affected teams, including procurement
**Assign responsibilities** — Name accountable owners across functions
**Inventory assets** — Map data and cryptographic assets
**Evaluate options** — Compare risk, performance, and compatibility
**Pilot and test** — Learn operational impact before migration
**Monitor continuously** — Reassess progress, risk, and the threat timeline

1. Develop a roadmap: Assign a planning team and estimate resources. Start without waiting for quantum specialists.
2. Build awareness: Include procurement and other affected teams so purchasing decisions account for quantum risk.
3. Assign responsibilities: Name owners and understand the cryptography already in use.
4. Inventory information assets: Map software, hardware, and how keys are created, stored, and used.
5. Evaluate technology options: Compare risk, performance, limitations, and compatibility with actual systems.
6. Pilot and test: Learn about operational impact and integration problems before changing core systems.
7. Monitor progress: Periodically reassess progress, risk, and the threat timeline.

Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

Reference	Mandate Title	Scope Required	Testing Cycle
Steps 1 to 3 (NCSA PQC)	Roadmap planning, organizational awareness, and Mosca-model risk evaluation	Transition roadmap, (x + y) - z > 0 crisis assessment, and Harvest Now, Decrypt Later exposure	Readiness preparation steps, not an annual statutory cadence
Step 4 (NCSA PQC Section 8.3)	Dual-pillar information asset inventory (Data & Crypto Assets Inventory)	Data Inventory for confidential data exceeding ten years and Crypto Assets Inventory for algorithms, keys, and certificates	Baseline inventory, reviewed upon architectural changes
Step 5 (NCSA PQC Section 5)	Technology evaluation covering PQC, QKD limitations, and hybrid architectures	CRYSTALS-Kyber, Dilithium, FALCON, SPHINCS+, FIPS 203 to 205 standards, Hybrid IKEv2 RFC 9370, and AES-256 upgrades	Architectural design and technology selection phase
Steps 6 and 7 (NCSA PQC)	Pilot testing in staging environments and continuous Crypto Agility monitoring	Performance benchmarking, latency overhead, key size compatibility, and logical qubit metric tracking	Pilot implementation phase and periodic risk reviews

NCSA POST-QUANTUM TECHNICAL GUIDE

Plan the PQC transition from real assets

Preparing for the quantum era demands a clear distinction between Shor's and Grover's impact, evaluating crisis thresholds with Mosca's theorem, and establishing a dual-pillar inventory to achieve cryptographic agility.

From crypto inventory to transition: Plan and assign → Inventory assets → Evaluate options → Pilot and test → Transition and monitor — **From crypto inventory to transition**
Start with the systems and data you actually use. Test compatibility and operational impact before rollout. This groups the technical work; the NCSA seven-step roadmap appears earlier in the article.
**Plan and assign** — Set a roadmap and accountable owners
**Inventory assets** — Map data and cryptographic assets
**Evaluate options** — Compare risk and compatibility
**Pilot and test** — Check interoperability and performance
**Transition and monitor** — Roll out gradually and reassess risk

Shor vs Grover

Dual Impact on Cryptosystems

Shor's algorithm breaks public-key cryptography (RSA and ECC) in polynomial time, whereas Grover's algorithm provides quadratic brute-force speedup against symmetric keys, mitigated by doubling keys to AES-256 and digests to SHA-384 or SHA-512.

Mosca Crisis Model

Crisis Threshold: (x + y) - z > 0

When migration time plus the confidentiality lifetime exceeds the assumed quantum threat timeline, the plan has a timing shortfall. Captured ciphertext may face harvest-now-decrypt-later risk, depending on the cryptography in use. This is a conditional planning model, not a confirmed compromise or a prediction of when a CRQC will arrive.

Dual-Pillar Inventory

Two-Pillar IT Asset Inventory

Section 8.3 requires separate inventories: Data Inventory for assets requiring confidentiality beyond 10 years, and Crypto Assets Inventory to catalog algorithms, key sizes, certificates, and compile a Cryptography Bill of Materials (CBOM).

QKD vs PQC

QKD Limits & PQC Priority

NCSA's 2025 guidance describes point-to-point fiber QKD for short-distance use of no more than 125 km, with constraints involving specialized equipment, endpoint security, and authentication. That figure describes the deployment context in the guidance and should not be generalized to every QKD technology. Enterprise readiness under the guidance should focus on PQC alongside cryptographic inventories and migration planning.

Impact of Quantum Computing on Cryptographic Algorithms (Table 1 NCSA Guidance)

Comparison of cryptographic impacts, quantum attack algorithms, and recommended mitigations across cipher categories.

Cryptographic Category	Current Algorithms	Quantum Attack & Impact	Urgency & Strategic Remediation
Asymmetric Key Cryptography	Key Exchange (e.g. RSA, DH, ECDH)	Shor's Algorithm solves prime factorization and discrete logarithms in polynomial time, completely compromising the algorithm.	Critical Urgency Immediate risk of Harvest Now, Decrypt Later. Transition to NIST PQC standards (FIPS 203) or deploy hybrid key exchange schemes.
Asymmetric Key Cryptography	Digital Signatures and Authentication (e.g. RSA, ECDSA, Ed25519)	Shor's Algorithm computes private keys directly, enabling unauthorized digital document signing and identity impersonation.	High Urgency Active threat once CRQCs emerge. Transition to NIST PQC standards (FIPS 204, FIPS 205) or stateful hash-based signature schemes.
Symmetric Key Cryptography	Bulk Data Encryption (e.g. AES-128, AES-256, 3DES, ChaCha20)	Grover's Algorithm provides quadratic speedup for brute-force key search, effectively cutting key strength in half.	Medium Urgency Mitigate by doubling key length (e.g. upgrading from AES-128 to AES-256 to preserve 128-bit post-quantum security).
Cryptographic Hash Functions	Data Integrity & Verification (e.g. SHA-256, SHA-384, SHA-512, SHA-3)	Grover's Algorithm and quantum collision search weaken collision resistance and pre-image resistance.	Medium Urgency Mitigate by adopting larger digest sizes, establishing SHA-384 or SHA-512 as the minimum standard baseline.

Mosca's Theorem & Risk Metric

Quantitative Risk Evaluation with Mosca's Crisis Model

Dr. Michele Mosca formulated a foundational risk framework adopted by NCSA to evaluate whether organizations face immediate exposure.

Three Core Variables (x, y, z)

Equation Variables

x represents migration time to quantum-safe systems, y represents security shelf life of sensitive data, and z represents threat timeline before a Cryptanalytically Relevant Quantum Computer (CRQC) emerges.

Numerical Example & 5-Year Exposure Gap

NCSA Case Study

Assuming migration takes x = 5 years, data confidentiality lasts y = 10 years, and the threat timeline is z = 10 years, (5 + 10) - 10 = 5 years is a planning shortfall under the stated assumptions. It is not a prediction of the CRQC arrival date or proof of a five-year compromise. Review all three assumptions as evidence changes.

Monitoring Logical Qubits & Quantum Volume

Tracking Variable z

NCSA advises tracking error-corrected Logical Qubits and Quantum Volume rather than raw Physical Qubits alone, as Shor's algorithm requires fault-tolerant logical qubits to factorize RSA keys.

Historical Precedent: DES to AES Transition

Migration Experience

A Boston Consulting Group (BCG) study revealed that legacy migrations from DES/3DES to AES spanned up to 20 years across enterprise infrastructures, underscoring the urgency to begin PQC architectural planning immediately.

Section 8.3 & CBOM

Dual-Pillar Inventory Framework & Cryptographic Agility

Step 4 of the NCSA guidance forms the most crucial and complex phase, dividing discovery into data sensitivity and cryptographic asset tracking.

Pillar 1: Data Inventory

Sensitive Data

Identify classification levels, retention requirements, network transmission paths, and storage repositories, prioritizing intellectual property, medical records, and national security data with shelf lives exceeding 10 years.

Pillar 2: Crypto Assets Inventory

Cipher Discovery

Catalog algorithms, key lengths, digital certificates, communication protocols (TLS, SSH, IPsec), and key management lifecycles within Hardware Security Modules (HSM).

Cryptography Bill of Materials (CBOM)

Supply Chain

Generate structured CBOM manifests across internal software, third-party packages, and dependencies to pinpoint legacy algorithms and facilitate automated upgrades.

Foundations of Cryptographic Agility

Agility Architecture

Decouple cryptographic implementations from core application logic through abstraction layers, enabling rapid algorithm switching without rewriting underlying business code.

Executive Leadership (C-Level & Board)

Understand enterprise quantum risk, allocate multi-year migration budgets, establish governance policies, and mandate post-quantum procurement criteria.

Management & Security Leads

Translate executive policies into strategic initiatives, prioritize vulnerable systems, oversee migration roadmaps, and maintain business operational continuity.

Technical Operations & Engineers

Execute cryptographic inventories, run pilot tests on hybrid solutions, validate protocol interoperability, and benchmark algorithm performance overhead.

Procurement & Vendor Management

Embed post-quantum readiness clauses into vendor contracts and software procurement cycles, preventing the introduction of legacy, non-agile systems.

Referenced from NCSA Guideline for Post-Quantum Readiness (2025): Section 4 Quantum Threats, Section 5 Security Technologies, Section 6 Mosca Model, and Section 8 Readiness Roadmap and Asset Inventories.

Consult STH on PQC Readiness and Cryptographic Agility Assessments

Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

Organizational quantum-readiness roadmap established with assigned responsibilities across executive, managerial, and technical teams Risk assessed using Mosca's Theorem formula (x + y) - z > 0 to identify data exposed to Harvest Now, Decrypt Later Data Inventory established for confidential information with a security shelf life exceeding ten years Crypto Assets Inventory and CBOM completed covering algorithms, key lengths, and digital certificates across all systems Upgrade plan defined for symmetric encryption to AES-256 and hash functions to SHA-384 or SHA-512 to resist Grover's Algorithm PQC algorithms or hybrid architectures piloted in staging with systems designed for Crypto Agility

Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

Why must organizations prepare for Post-Quantum Cryptography today?

Adversaries are currently intercepting and storing encrypted data to decrypt later once quantum computers mature (Harvest Now, Decrypt Later), placing long-term confidential data at immediate risk.

Which cryptographic algorithms are vulnerable to quantum computing attack vectors?

Asymmetric public-key algorithms including RSA, ECC, and Diffie-Hellman are vulnerable, whereas symmetric encryption algorithms like AES-256 remain resilient when using appropriate key lengths.

Why do international cybersecurity agencies recommend PQC over QKD for general enterprise systems?