Last reviewed 10 November 2026
Not sure which route applies
Use these three questions when you are not sure which route applies.
If the organisation mostly uses supplier-updated browsers, operating systems, and mobile devices, and holds no long-lived confidential data and no product it cannot update, use the vendor-managed software route.
If a record needs to stay confidential for years, use the long-lived confidentiality route. If the organisation ships or operates a product whose signature check cannot be updated later, use the hard-to-change systems route.
If someone is coordinating many of these assets, use the organisation-wide route. An unknown stays written down with an owner. This page does not assess risk. When you still cannot choose, the risk owner or the sector authority chooses. A large bespoke estate, critical national infrastructure, or a regulated system needs a specialist as well as the organisation-wide route.
The output is a named route, or a list of unknowns and the person who will close them.
Primary next page: Diagnose.
Sources
- UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines
- AIVD, CWI, and TNO, The PQC Migration Handbook, December 2024. Handbook