Skip to main content

Last reviewed 10 November 2026

Diagnose a post-quantum migration

When this applies​

You have opened a route and have not yet listed the cryptography in the system environment.

Do this​

  1. Name an owner for the first inventory and the subsequent review.
  2. Separate three cases in the record: a vendor-managed estate, an estate with a long data confidentiality period, and an estate you cannot yet classify.
  3. Write the first inventory for the case that applies, or list the unknowns that block classification.
  4. Set a subsequent-review date within the first month of opening the route.

Authority recommendation: The PQC Migration Handbook (AIVD, CWI, and TNO, December 2024, Netherlands) distinguishes urgent adopters, which need to start because they cannot afford to delay, from regular adopters, which do not need to react yet. Record which description fits your organisation before you deepen the inventory.

Keep this evidence​

An inventory record, a named owner, and a subsequent-review date.

Example​

An insufficient record is "We are quantum safe."

A decision-ready record names the migration lead as owner, records the first inventory as the vendor-managed estate plus one bespoke service still unclassified, and sets the subsequent review for 8 December 2026.

Limits and next page​

This page does not choose algorithms or applicable migration timelines. The next page is the inventory record.

Sources​

  • CISA, NSA, and NIST, Quantum-Readiness fact sheet, as of 17 August 2023. Fact sheet
  • AIVD, CWI, and TNO, The PQC Migration Handbook, December 2024. Handbook