Products or systems that may be hard to change

This route is for a product whose verifier, firmware, or release cycle cannot be changed quickly.

Can the verifier be updated later? When it cannot, read long-lived roots before signatures.

Read in this order:

1. Inventory
2. Release dates
3. Long-lived roots
4. Signatures
5. Vendor plan
6. Implementation
7. Change record
8. Vendor response log

The output is one asset's vendor-release, test, production-deployment, and end-of-support dates, plus a change record.

Primary next page: Inventory.

For a labelled illustration, not a real organisation, see Protect this first.

Sources

• NIST, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), October 2026. NIST IR 8547
• UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines

Related pages

• Release dates
• Protect this first
• Not sure which route applies