Get quantum ready in 3 simple steps
UK Quantum Week is a timely reminder that quantum readiness is a practical task that needs addressing now, not a distant one. The National Cyber Security Centre (NCSC) has set out timelines for migration to Post Quantum Cryptography, with planning expected to be completed by all organisations by 2028. Quantum readiness is not something organisations can achieve overnight. Quantum computers capable of breaking today’s public-key encryption are not here yet, but by the time one arrives, businesses will need to have identified vulnerable systems, mapped their critical data and begun migrating. The good news is that this can be broken down into manageable steps. Organisations that start now can move at a sensible pace, without disrupting the business. Those who wait may be forced to rush, incurring greater disruption and/or cost.
Step 1: Bring the business on board
Post-quantum cryptography (PQC) migration touches far more than the security team. Cryptography underpins user authentication, document and code signing, digital contracts and the secure connections behind almost every transaction, so it is a business issue as well as a technical one. Start by building a cross-functional group spanning security, IT, legal, risk, procurement and the wider business.
Step 2: Find where cryptography is used
Most organisations know they use cryptography. Far fewer know where, how, and with which algorithms. Discovery is the foundation for everything else.
Useful places to look include:
Network traffic, to identify the protocols and cipher suites in use
Cloud and data centre environments, including what enters and leaves them
Endpoints and network devices, where legacy encryption often hides
Applications and third-party services, including supply chain dependencies
Discovery often uncovers surprises, such as deprecated protocols still running in a branch office exposing the organisation to risk even today before a cryptographically relevant before a cryptographically relevant quantum computer arrives.
Step 3: Prioritise and plan
Not all data carries the same urgency. Information that must stay confidential for years or decades, such as personal, health, financial or critical intellectual property data, should be addressed first. Transient data can follow, but it still needs a plan. Use your findings to build a phased, funded roadmap, then keep it running, because new systems, vendors and standards will keep arriving. The goal is crypto-agility: the ability to change algorithms without rebuilding systems from scratch.
Where the UK fits
The National Cyber Security Centre (NCSC) is leading the way in the UK, with programmes and guidance designed to help organisations build practical roadmaps for quantum readiness. UK organisations are expected to have a PQC migration plan in place by 2028, with high-priority systems migrated by 2031. Yet many still cannot say with confidence where cryptography is used across their estate, which systems are weak or quantum-vulnerable, or what must be fixed first.
To support enterprises in moving from uncertainty to action, with clear guidance and practical tools to future-proof their security and business operations, the NCSC has run the Post-Quantum Cryptography Pilot under the Assured Cyber Security Consultancy Scheme. Arqit has been selected as part of this scheme, to help UK organisations discover, assess and manage cryptographic risk as they transition to quantum-resistant security.
Start this UK Quantum Week
UK Quantum Week is a good moment to act. Start by launching a discovery project to find out where cryptography lives across your business. Visibility and assessment are the foundation of any successful migration.
Learn more about how Arqit helps organisations discover and manage cryptographic risk: https://arqitgroup.com/products/encryption-intelligence
