Skip to main content

Last reviewed 10 November 2026

Mostly standard, vendor-managed software

This route is for an organisation that relies on standard browsers, operating systems, and mobile devices.

Before you follow the reading order, check whether another route applies. Long-lived confidential data belongs on the long-lived confidentiality route. A bespoke system, or a product whose signature check cannot be updated later, belongs on the hard-to-change systems route. An organisation coordinating many assets belongs on the organisation-wide route.

If none of those exceptions applies, read in this order:

  1. Commodity software
  2. Dates
  3. Vendor response log
  4. Subsequent review

The output is a vendor response log, and either a written note that no exception applies or the name of the route you moved to.

Primary next page: Commodity software.

For a labelled illustration, not a real organisation, see Protect this first.

Sources​

  • UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines