# NCSA Guidelines for Post-Quantum Readiness Locale: `en` Source: `/en/compliance/ncsa-post-quantum-readiness/` Summary: NCSA Post-Quantum Readiness: Mosca-model risk assessment, cryptographic inventories, and PQC transition planning. On this page 1. [Overview](/en/compliance/ncsa-post-quantum-readiness/#topic-overview) 2. [Scope and the quantum risk to assess first](/en/compliance/ncsa-post-quantum-readiness/#scope-and-quantum-risk) 3. [Use the Mosca model to prioritize transition](/en/compliance/ncsa-post-quantum-readiness/#mosca-risk-model) 4. [PQC, QKD, and transition design](/en/compliance/ncsa-post-quantum-readiness/#technology-and-transition) 5. [A seven-step roadmap and the evidence to start collecting](/en/compliance/ncsa-post-quantum-readiness/#readiness-roadmap) 6. [Requirements Matrix](/en/compliance/ncsa-post-quantum-readiness/#compliance-matrix) 7. [Plan the PQC transition from real assets](/en/compliance/ncsa-post-quantum-readiness/#pqc-technical-guide) 8. [Readiness Assessment](/en/compliance/ncsa-post-quantum-readiness/#compliance-readiness-checklist) 9. [Check PQC readiness](/en/compliance/ncsa-post-quantum-readiness/#pqc-readiness-tool-heading) 10. [Frequently Asked Questions](/en/compliance/ncsa-post-quantum-readiness/#compliance-faq) 11. [Related Frameworks](/en/compliance/ncsa-post-quantum-readiness/#related-compliance-frameworks) # NCSA Guidelines for Post-Quantum Readiness A source-based guide to NCSA's Guidelines for Post-Quantum Readiness for government agencies and critical information infrastructure organizations that process confidential information, focusing on risk assessment, cryptographic asset inventories, and cryptographic transition planning. Executive Summary and Mandate Overview Target Audience Government and CII organizations that process confidential information, as practical NCSA guidance rather than a binding notification Mandatory Frequency Follow the document's seven-step roadmap; it is not an annual legal cadence Required Scope Public-key cryptography, IT and crypto-asset inventories, PQC, QKD, and hybrid approaches Non-Compliance Risk Harvest Now Decrypt Later when data must remain secret longer than current public-key algorithms remain safe ## Scope and the quantum risk to assess first The document is practical guidance rather than a binding notification. It targets government agencies and CII organizations that collect, use, exchange, or disclose confidential information through information systems. [![Which data needs quantum-readiness first: Long-lived confidential data, Harvest now, decrypt later, Cryptographic dependencies, System lifetime and constraints, Priority](/assets/compliance/guide-ncsa-post-quantum-readiness-scope-and-quantum-risk-en-v1.webp)](/assets/compliance/guide-ncsa-post-quantum-readiness-scope-and-quantum-risk-en-v1.webp) **Which data needs quantum-readiness first** Prioritize long-lived data and systems that are difficult to migrate. - **Long-lived confidential data** — Determine its security shelf life - **Harvest now, decrypt later** — Consider data that could be collected today - **Cryptographic dependencies** — Identify algorithms, protocols, certificates, and keys - **System lifetime and constraints** — Consider hardware, software, and suppliers - **Priority** — Compare data lifetime with migration effort and threat horizon - Public-key cryptography underpinning key exchange, digital signatures, and authentication (including RSA, ECC, and Diffie-Hellman) will be fundamentally broken by large-scale quantum computers running Shor's Algorithm. - Harvest Now, Decrypt Later represents an active and immediate risk where adversaries intercept and archive encrypted communications today to decrypt them once cryptanalytically relevant quantum computers emerge, echoing historical precedents like the Venona project. - Symmetric ciphers such as AES experience a quadratic speedup under Grover's Algorithm, which halves their effective security margin. Organizations can mitigate this by doubling key lengths to AES-256 and upgrading hash functions to SHA-384 or SHA-512. - Organizations must prioritize confidential data with a required security shelf life exceeding ten years, such as health records, trade secrets, financial transactions, and national security intelligence. ## Use the Mosca model to prioritize transition The guidance assesses risk through the relationship between the time an organization needs to migrate, the required secrecy lifetime of data, and the time until a capable quantum threat emerges. [![When cryptographic migration is urgent: X Migration time, Y Security shelf life, Z Threat timeline, X + Y \> Z](/assets/compliance/pqc-mosca-en-v1.webp)](/assets/compliance/pqc-mosca-en-v1.webp) **When cryptographic migration is urgent** Compare X plus Y with Z to assess urgency. These are organizational estimates, not a prediction of the date a quantum computer will break encryption. - **X Migration time** — Time needed to make systems ready - **Y Security shelf life** — Time the data must remain secure - **Z Threat timeline** — Time until a capable quantum threat - **X + Y \> Z** — Start planning now - Mosca's Theorem establishes a mathematical crisis condition: whenever migration time plus data security shelf life exceeds the threat timeline, expressed as (x + y) - z \> 0, organizational data is already exposed to future compromise today. - Variable x (Migration Time) measures the years needed to overhaul PKI, applications, network appliances, and vendor workflows. Industry research indicates an enterprise-wide cryptographic transition spans five to twenty years. - Variable y (Security Shelf Life) defines how long data must retain its confidentiality and integrity, ranging from decades for medical and national records to the operational lifespan of IoT field devices and Smart Grid systems. - Variable z (Threat Timeline) represents the estimated years before capable quantum hardware emerges. Technical teams must track progress through metrics like logical qubits rather than mere physical qubit counts. ## PQC, QKD, and transition design The guidance discusses Post-Quantum Cryptography (PQC), Quantum Key Distribution (QKD), and hybrid approaches so each system can be assessed against its own risk and constraints. [![Designing the cryptographic transition: Current cryptography, Post-Quantum Cryptography, QKD, Hybrid approach, Crypto agility](/assets/compliance/guide-ncsa-post-quantum-readiness-technology-and-transition-en-v1.webp)](/assets/compliance/guide-ncsa-post-quantum-readiness-technology-and-transition-en-v1.webp) **Designing the cryptographic transition** Select transition options from risk, compatibility, and system constraints. - **Current cryptography** — Understand dependencies and constraints - **Post-Quantum Cryptography** — Evaluate suitability for real systems - **QKD** — Use only where context and constraints support it - **Hybrid approach** — Combine current and post-quantum mechanisms during transition - **Crypto agility** — Design systems so algorithms can be replaced - Post-Quantum Cryptography (PQC) represents the primary path forward for existing network infrastructure, deploying mathematical problems resistant to both classical and quantum computing, such as CRYSTALS-Kyber for key exchange, alongside CRYSTALS-Dilithium and SPHINCS+ for digital signatures. - Quantum Key Distribution (QKD) faces severe practical limitations, including a maximum distance of 125 kilometers over point-to-point fiber, low key exchange rates, high hardware expense, and an inherent inability to perform authentication. International cybersecurity authorities, including NSA, NCSC, and ANSSI, advise against relying on QKD for national security and military systems. - Hybrid solutions combining classical cryptography with PQC (such as IETF RFC 9370 for IKEv2) deliver the most cost-effective and secure migration architecture, preserving backward compatibility while mitigating unexpected algorithm vulnerabilities. - Crypto Agility must be engineered into system architectures so that cryptographic algorithms can be swapped swiftly, as demonstrated by the rapid invalidation of candidates like SIKE after years of evaluation. ## A seven-step roadmap and the evidence to start collecting The guidance sets out seven readiness steps that executives, managers, and operational teams must advance together rather than treating the work as a one-point algorithm replacement. [![Seven steps to quantum readiness: Build the roadmap → Build awareness → Assign responsibilities → Inventory assets → Evaluate options → Pilot and test → Monitor continuously](/assets/compliance/guide-ncsa-post-quantum-readiness-readiness-roadmap-en-v1.webp)](/assets/compliance/guide-ncsa-post-quantum-readiness-readiness-roadmap-en-v1.webp) **Seven steps to quantum readiness** Transition planning starts with ownership and inventory before technology selection. 1. **Build the roadmap** — Assign people, resources, and a transition plan 2. **Build awareness** — Educate affected teams, including procurement 3. **Assign responsibilities** — Name accountable owners across functions 4. **Inventory assets** — Map data and cryptographic assets 5. **Evaluate options** — Compare risk, performance, and compatibility 6. **Pilot and test** — Learn operational impact before migration 7. **Monitor continuously** — Reassess progress, risk, and the threat timeline - 1. Develop a roadmap: Assign a planning team and estimate resources. Start without waiting for quantum specialists. - 2. Build awareness: Include procurement and other affected teams so purchasing decisions account for quantum risk. - 3. Assign responsibilities: Name owners and understand the cryptography already in use. - 4. Inventory information assets: Map software, hardware, and how keys are created, stored, and used. - 5. Evaluate technology options: Compare risk, performance, limitations, and compatibility with actual systems. - 6. Pilot and test: Learn about operational impact and integration problems before changing core systems. - 7. Monitor progress: Periodically reassess progress, risk, and the threat timeline. ## Requirements and Testing Scope Matrix Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle. | Reference | Mandate Title | Scope Required | Testing Cycle | | --- | --- | --- | --- | | **Steps 1 to 3 (NCSA PQC)** | Roadmap planning, organizational awareness, and Mosca-model risk evaluation | Transition roadmap, (x + y) - z \> 0 crisis assessment, and Harvest Now, Decrypt Later exposure | Readiness preparation steps, not an annual statutory cadence | | **Step 4 (NCSA PQC Section 8.3)** | Dual-pillar information asset inventory (Data & Crypto Assets Inventory) | Data Inventory for confidential data exceeding ten years and Crypto Assets Inventory for algorithms, keys, and certificates | Baseline inventory, reviewed upon architectural changes | | **Step 5 (NCSA PQC Section 5)** | Technology evaluation covering PQC, QKD limitations, and hybrid architectures | CRYSTALS-Kyber, Dilithium, FALCON, SPHINCS+, FIPS 203 to 205 standards, Hybrid IKEv2 RFC 9370, and AES-256 upgrades | Architectural design and technology selection phase | | **Steps 6 and 7 (NCSA PQC)** | Pilot testing in staging environments and continuous Crypto Agility monitoring | Performance benchmarking, latency overhead, key size compatibility, and logical qubit metric tracking | Pilot implementation phase and periodic risk reviews | NCSA POST-QUANTUM TECHNICAL GUIDE ## Plan the PQC transition from real assets Preparing for the quantum era demands a clear distinction between Shor's and Grover's impact, evaluating crisis thresholds with Mosca's theorem, and establishing a dual-pillar inventory to achieve cryptographic agility. [![From crypto inventory to transition: Plan and assign → Inventory assets → Evaluate options → Pilot and test → Transition and monitor](/assets/compliance/pqc-transition-en-v1.webp)](/assets/compliance/pqc-transition-en-v1.webp) **From crypto inventory to transition** Start with the systems and data you actually use. Test compatibility and operational impact before rollout. This groups the technical work; the NCSA seven-step roadmap appears earlier in the article. 1. **Plan and assign** — Set a roadmap and accountable owners 2. **Inventory assets** — Map data and cryptographic assets 3. **Evaluate options** — Compare risk and compatibility 4. **Pilot and test** — Check interoperability and performance 5. **Transition and monitor** — Roll out gradually and reassess risk Shor vs Grover ### Dual Impact on Cryptosystems Shor's algorithm breaks public-key cryptography (RSA and ECC) in polynomial time, whereas Grover's algorithm provides quadratic brute-force speedup against symmetric keys, mitigated by doubling keys to AES-256 and digests to SHA-384 or SHA-512. Mosca Crisis Model ### Crisis Threshold: (x + y) - z \> 0 When migration time plus the confidentiality lifetime exceeds the assumed quantum threat timeline, the plan has a timing shortfall. Captured ciphertext may face harvest-now-decrypt-later risk, depending on the cryptography in use. This is a conditional planning model, not a confirmed compromise or a prediction of when a CRQC will arrive. Dual-Pillar Inventory ### Two-Pillar IT Asset Inventory Section 8.3 requires separate inventories: Data Inventory for assets requiring confidentiality beyond 10 years, and Crypto Assets Inventory to catalog algorithms, key sizes, certificates, and compile a Cryptography Bill of Materials (CBOM). QKD vs PQC ### QKD Limits & PQC Priority NCSA's 2025 guidance describes point-to-point fiber QKD for short-distance use of no more than 125 km, with constraints involving specialized equipment, endpoint security, and authentication. That figure describes the deployment context in the guidance and should not be generalized to every QKD technology. Enterprise readiness under the guidance should focus on PQC alongside cryptographic inventories and migration planning. ### Impact of Quantum Computing on Cryptographic Algorithms (Table 1 NCSA Guidance) Comparison of cryptographic impacts, quantum attack algorithms, and recommended mitigations across cipher categories. | Cryptographic Category | Current Algorithms | Quantum Attack & Impact | Urgency & Strategic Remediation | | --- | --- | --- | --- | | **Asymmetric Key Cryptography** | Key Exchange (e.g. RSA, DH, ECDH) | Shor's Algorithm solves prime factorization and discrete logarithms in polynomial time, completely compromising the algorithm. | Critical UrgencyImmediate risk of Harvest Now, Decrypt Later. Transition to NIST PQC standards (FIPS 203) or deploy hybrid key exchange schemes. | | **Asymmetric Key Cryptography** | Digital Signatures and Authentication (e.g. RSA, ECDSA, Ed25519) | Shor's Algorithm computes private keys directly, enabling unauthorized digital document signing and identity impersonation. | High UrgencyActive threat once CRQCs emerge. Transition to NIST PQC standards (FIPS 204, FIPS 205) or stateful hash-based signature schemes. | | **Symmetric Key Cryptography** | Bulk Data Encryption (e.g. AES-128, AES-256, 3DES, ChaCha20) | Grover's Algorithm provides quadratic speedup for brute-force key search, effectively cutting key strength in half. | Medium UrgencyMitigate by doubling key length (e.g. upgrading from AES-128 to AES-256 to preserve 128-bit post-quantum security). | | **Cryptographic Hash Functions** | Data Integrity & Verification (e.g. SHA-256, SHA-384, SHA-512, SHA-3) | Grover's Algorithm and quantum collision search weaken collision resistance and pre-image resistance. | Medium UrgencyMitigate by adopting larger digest sizes, establishing SHA-384 or SHA-512 as the minimum standard baseline. | Mosca's Theorem & Risk Metric ### Quantitative Risk Evaluation with Mosca's Crisis Model Dr. Michele Mosca formulated a foundational risk framework adopted by NCSA to evaluate whether organizations face immediate exposure. #### Three Core Variables (x, y, z) Equation Variables x represents migration time to quantum-safe systems, y represents security shelf life of sensitive data, and z represents threat timeline before a Cryptanalytically Relevant Quantum Computer (CRQC) emerges. #### Numerical Example & 5-Year Exposure Gap NCSA Case Study Assuming migration takes x = 5 years, data confidentiality lasts y = 10 years, and the threat timeline is z = 10 years, (5 + 10) - 10 = 5 years is a planning shortfall under the stated assumptions. It is not a prediction of the CRQC arrival date or proof of a five-year compromise. Review all three assumptions as evidence changes. #### Monitoring Logical Qubits & Quantum Volume Tracking Variable z NCSA advises tracking error-corrected Logical Qubits and Quantum Volume rather than raw Physical Qubits alone, as Shor's algorithm requires fault-tolerant logical qubits to factorize RSA keys. #### Historical Precedent: DES to AES Transition Migration Experience A Boston Consulting Group (BCG) study revealed that legacy migrations from DES/3DES to AES spanned up to 20 years across enterprise infrastructures, underscoring the urgency to begin PQC architectural planning immediately. Section 8.3 & CBOM ### Dual-Pillar Inventory Framework & Cryptographic Agility Step 4 of the NCSA guidance forms the most crucial and complex phase, dividing discovery into data sensitivity and cryptographic asset tracking. #### Pillar 1: Data Inventory Sensitive Data Identify classification levels, retention requirements, network transmission paths, and storage repositories, prioritizing intellectual property, medical records, and national security data with shelf lives exceeding 10 years. #### Pillar 2: Crypto Assets Inventory Cipher Discovery Catalog algorithms, key lengths, digital certificates, communication protocols (TLS, SSH, IPsec), and key management lifecycles within Hardware Security Modules (HSM). #### Cryptography Bill of Materials (CBOM) Supply Chain Generate structured CBOM manifests across internal software, third-party packages, and dependencies to pinpoint legacy algorithms and facilitate automated upgrades. #### Foundations of Cryptographic Agility Agility Architecture Decouple cryptographic implementations from core application logic through abstraction layers, enabling rapid algorithm switching without rewriting underlying business code. ### 3-Tier Organizational Governance Framework (Section 8.2) Achieving post-quantum readiness requires synchronized collaboration and clear accountability across every organizational stratum. #### Executive Leadership (C-Level & Board) Understand enterprise quantum risk, allocate multi-year migration budgets, establish governance policies, and mandate post-quantum procurement criteria. #### Management & Security Leads Translate executive policies into strategic initiatives, prioritize vulnerable systems, oversee migration roadmaps, and maintain business operational continuity. #### Technical Operations & Engineers Execute cryptographic inventories, run pilot tests on hybrid solutions, validate protocol interoperability, and benchmark algorithm performance overhead. #### Procurement & Vendor Management Embed post-quantum readiness clauses into vendor contracts and software procurement cycles, preventing the introduction of legacy, non-agile systems. Referenced from NCSA Guideline for Post-Quantum Readiness (2025): Section 4 Quantum Threats, Section 5 Security Technologies, Section 6 Mosca Model, and Section 8 Readiness Roadmap and Asset Inventories. [Consult STH on PQC Readiness and Cryptographic Agility Assessments](/en/#contact) ### Compliance Readiness Self-Assessment Select items your organization has completed to evaluate your readiness score. 0% Organizational quantum-readiness roadmap established with assigned responsibilities across executive, managerial, and technical teams Risk assessed using Mosca's Theorem formula (x + y) - z \> 0 to identify data exposed to Harvest Now, Decrypt Later Data Inventory established for confidential information with a security shelf life exceeding ten years Crypto Assets Inventory and CBOM completed covering algorithms, key lengths, and digital certificates across all systems Upgrade plan defined for symmetric encryption to AES-256 and hash functions to SHA-384 or SHA-512 to resist Grover's Algorithm PQC algorithms or hybrid architectures piloted in staging with systems designed for Crypto Agility Assessment Status Check items above to view assessment result. [Request Pentest Quote](/en/#contact) PQC BY STH ## Check a website's PQC readiness for free Start with internet-facing assets: PQC by STH inspects the TLS configuration a website presents, helping teams identify algorithms and readiness signals for a Post-Quantum Cryptography transition. This result is a starting point for a Crypto Assets Inventory, not a security certification or a complete assessment of internal systems. [Check a website with PQC by STH ](https://pqc.p7z.pw/) ## Frequently Asked Questions (FAQ) Key answers and practical guidance addressing common compliance questions. ### Why must organizations prepare for Post-Quantum Cryptography today? Adversaries are currently intercepting and storing encrypted data to decrypt later once quantum computers mature (Harvest Now, Decrypt Later), placing long-term confidential data at immediate risk. ### Which cryptographic algorithms are vulnerable to quantum computing attack vectors? Asymmetric public-key algorithms including RSA, ECC, and Diffie-Hellman are vulnerable, whereas symmetric encryption algorithms like AES-256 remain resilient when using appropriate key lengths. ### Why do international cybersecurity agencies recommend PQC over QKD for general enterprise systems? NCSA's 2025 guidance describes point-to-point fiber QKD for short-distance use of no more than 125 km, with constraints involving specialized equipment, endpoint security, and authentication. That figure describes the deployment context in the guidance and should not be generalized to every QKD technology. Enterprise readiness under the guidance should focus on PQC alongside cryptographic inventories and migration planning. ### How does Mosca's Theorem indicate an active security crisis for an organization? When migration time plus the required data secrecy lifetime exceeds the threat timeline, expressed as (x + y) - z \> 0, archived data is vulnerable to future decryption, requiring immediate transition planning. ## Related Compliance Frameworks and Security Standards - [ NCSA Zero Trust Guidelines ](/en/compliance/ncsa-zero-trust-guidelines/) - [ Bank of Thailand pentest rules for financial institutions ](/en/compliance/bank-of-thailand/) - [ PCI DSS v4.0.1: VA, ASV Scan, Pentest, Segmentation ](/en/compliance/pci-dss/) - [ Does ISO/IEC 27001:2022 require penetration testing? ](/en/compliance/iso-27001/) Open full-size image to zoom ## Official source documents Original files from the regulating authorities, hosted on sth.sh for convenience. Always defer to the latest version at the source link. [ ![First-page preview of NCSA Guidelines for Post-Quantum Readiness](/assets/process/compliance-sources/sth-source-ncsa-post-quantum-readiness-2568.webp) ](/assets/documents/sth-source-ncsa-post-quantum-readiness-2568.pdf) ### NCSA Guidelines for Post-Quantum Readiness By NCSA [Open document (PDF) ](/assets/documents/sth-source-ncsa-post-quantum-readiness-2568.pdf) [Download ](/assets/documents/sth-source-ncsa-post-quantum-readiness-2568.pdf) [Source ](https://www.ncsa.or.th/ncsa_book/5004a6893034327c56000029) ## Need a pentest that satisfies these requirements? Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation. [Request a Pentest quote](/en/#contact) ## PDF document [Open in new tab ](/en/compliance/ncsa-post-quantum-readiness/) [Download](/en/compliance/ncsa-post-quantum-readiness/) Last updated 16 October 2026