Practical resources for security teams navigating the post-quantum transition. Use these tools to assess your readiness, compare algorithms, track key dates, and understand your regulatory obligations.
PQC migration checklist
A phased readiness checklist for enterprise cryptography migration. Work through the four phases to assess where your organisation stands.
Phase 1 — Discovery & inventory
- Build a cryptographic inventory. Identify all algorithms, key lengths, certificates, protocols and libraries in use across your organisation.
- Map data flows. Document where sensitive data is encrypted, transmitted and stored, and for how long it needs to stay confidential.
- Identify long-lived data. Flag data requiring confidentiality for 10 or more years. This is immediately at risk from harvest now, decrypt later attacks.
- Assess third-party dependencies. Catalogue vendors, cloud providers and libraries that handle cryptography on your behalf.
- Prioritise assets by risk. Rank systems by sensitivity of data, exposure to external networks, and difficulty of migration.
Phase 2 — Assessment & planning
- Review NIST FIPS 203, 204, and 205. Familiarise your team with ML-KEM, ML-DSA and SLH-DSA.
- Evaluate cryptographic agility. Assess whether existing systems can switch algorithms without a full redesign. Flag those that cannot.
- Define migration timeline. Set target dates per system tier. High-priority systems by 2027, all systems by 2030.
- Engage vendors. Contact critical vendors to understand their PQC roadmaps. Escalate where no roadmap exists.
- Budget and resource planning. Estimate effort and cost including staff training, tooling and third-party assessments.
Phase 3 — Implementation
- Deploy hybrid cryptography. Implement X25519 + ML-KEM in TLS and key exchange as a transitional measure.
- Update TLS configuration. Enable TLS 1.3 with post-quantum key exchange on all public-facing and internal services.
- Migrate PKI and certificates. Begin issuing post-quantum certificates. Plan for dual-algorithm PKI during transition.
- Update code signing and authentication. Replace RSA and ECDSA in CI/CD pipelines, firmware signing and authentication tokens with ML-DSA or SLH-DSA.
- Test for performance impact. Benchmark post-quantum algorithms in your environment. Key sizes are larger. Optimise as needed.
Phase 4 — Governance & compliance
- Update security policies. Revise cryptographic policies to mandate post-quantum algorithms for new systems.
- Train development and operations teams. Ensure engineers understand PQC algorithms, migration priorities and secure implementation.
- Review regulatory obligations. Check NIS2, DORA and sector-specific requirements. Document your compliance posture.
- Establish monitoring and incident response. Define how you would detect and respond to a cryptographic compromise, including quantum-related scenarios.
- Schedule annual review. PQC standards evolve rapidly. Review your cryptographic posture at least once a year.
NIST post-quantum algorithm comparison
The four NIST-standardised post-quantum algorithms compared by type, security level, key and signature sizes, and recommended use case.
Key encapsulation mechanisms (KEM)
| Algorithm | Standard | Security level | Public key | Ciphertext | Recommended for |
|---|---|---|---|---|---|
| ML-KEM-512 | FIPS 203 | Level 1 (AES-128) | 800 B | 768 B | Constrained environments |
| ML-KEM-768 | FIPS 203 | Level 3 (AES-192) | 1184 B | 1088 B | General enterprise use |
| ML-KEM-1024 | FIPS 203 | Level 5 (AES-256) | 1568 B | 1568 B | Highest-sensitivity applications |
Digital signature algorithms
| Algorithm | Standard | Level | Public key | Signature | Recommended for |
|---|---|---|---|---|---|
| ML-DSA-44 | FIPS 204 | 2 | 1312 B | 2420 B | Lower-security applications |
| ML-DSA-65 | FIPS 204 | 3 | 1952 B | 3309 B | General enterprise use |
| ML-DSA-87 | FIPS 204 | 5 | 2592 B | 4627 B | High-assurance applications |
| SLH-DSA-128s | FIPS 205 | 1 | 32 B | 7856 B | Root CAs, conservative deployments |
| SLH-DSA-192f | FIPS 205 | 3 | 48 B | 35664 B | Long-term signatures, fast variant |
| FN-DSA-512 | FIPS 206 | 1 | 897 B | 666 B | IoT and bandwidth-constrained systems |
| FN-DSA-1024 | FIPS 206 | 5 | 1793 B | 1280 B | High-security small-signature applications |
Classical vs. post-quantum: size comparison
| Algorithm | Type | Public key | Signature / ciphertext | Quantum resistant |
|---|---|---|---|---|
| RSA-2048 | Classical | 256 B | 256 B | No |
| ECDSA P-256 | Classical | 64 B | 64 B | No |
| X25519 (ECDH) | Classical | 32 B | 32 B | No |
| ML-KEM-768 | Post-quantum | 1184 B | 1088 B | Yes |
| ML-DSA-65 | Post-quantum | 1952 B | 3309 B | Yes |
For most enterprise deployments, start with ML-KEM-768 for key exchange and ML-DSA-65 for signatures. These are the Level 3 parameter sets, equivalent to AES-192 security, and are the ones referenced in most current implementation guidance from NIST, BSI, and ETSI.
Post-quantum standards timeline
NIST PQC project milestones
| Year | Event |
|---|---|
| 2016 | NIST launches PQC standardisation project. 69 candidate algorithms submitted from research teams worldwide. |
| 2017 to 2019 | Round 1 evaluation. 26 candidates advance to Round 2. |
| 2020 | Round 2 complete. 15 candidates advance to Round 3. |
| 2022 | NIST announces initial algorithm selections: CRYSTALS-Kyber, CRYSTALS-Dilithium, FALCON, SPHINCS+. |
| 2023 | Draft standards published for public comment. |
| August 2024 | FIPS 203, 204, and 205 finalised. First official post-quantum cryptography standards published. |
| Late 2024 | FIPS 206 (FN-DSA / FALCON) finalised. |
| 2025 | HQC under evaluation as an additional code-based KEM candidate. |
NSA CNSA 2.0 migration deadlines
| Deadline | Requirement |
|---|---|
| 2025 | New software applications delivered to national security systems must support CNSA 2.0 algorithms. |
| 2026 | New hardware delivered to national security systems must support CNSA 2.0 algorithms. |
| 2027 | Legacy national security systems must have approved CNSA 2.0 migration plans in place. |
| 2030 | Existing systems must use only CNSA 2.0 algorithms for new cryptographic operations. |
| 2033 | All national security systems must be fully migrated to CNSA 2.0 algorithms. |
European milestones
| Year | Body | Event |
|---|---|---|
| 2021 | ENISA | PQC report for EU critical infrastructure published. |
| 2022 | BSI | Migration guidance recommending CRYSTALS-Kyber and Dilithium published. |
| 2022 | NSA | CNSA 2.0 published. First government mandate with hard PQC migration deadlines. |
| 2023 | ETSI | ISG QSC guidance on quantum-safe migration for telecoms and financial sector published. |
| October 2024 | EU | NIS2 Directive becomes enforceable across 18 sectors. |
| August 2024 | NIST | FIPS 203 to 205 published. Global baseline for PQC migration established. |
| January 2025 | EU | DORA becomes fully applicable to EU financial entities and their critical ICT providers. |
| 2025 to 2026 | EU regulators | NIS2 and DORA supervisory guidance on PQC obligations expected from EBA, ENISA, and national authorities. |
| 2030 | BSI | Target date for full migration of German federal systems to post-quantum algorithms. |
Regulatory reference guide
NIS2 Directive (EU 2022/2555)
NIS2 became enforceable in October 2024 across all EU member states. Article 21(2)(h) requires entities to maintain policies and procedures regarding the use of cryptography and encryption. Article 21(2)(d) addresses supply chain security, making vendor PQC readiness a legitimate third-party risk assessment dimension. Article 20 makes management bodies accountable for approving and overseeing cybersecurity measures.
National cybersecurity authorities in Germany, the Netherlands, and France have incorporated post-quantum readiness into supervisory examinations. The minimum credible evidence of compliance is a cryptographic inventory, documented HNDL risk awareness, and a migration roadmap with prioritised timelines.
DORA (EU 2022/2554)
DORA became fully applicable in January 2025 for EU financial entities and their critical ICT third-party service providers. Article 9 requires state-of-the-art encryption and cryptographic controls, a dynamic standard that evolves as the threat environment changes. Articles 28 to 30 govern third-party risk management. PQC readiness is an auditable assessment dimension for critical ICT providers. The CTPP oversight framework gives EU supervisory authorities direct scrutiny of major cloud and infrastructure providers.
eIDAS 2.0
eIDAS 2.0 governs qualified trust services including electronic signatures, seals, timestamps, and the EU Digital Identity Wallet. Qualified certificates issued today with RSA or ECDSA keys will need to be reissued as post-quantum alternatives are incorporated into ETSI qualified trust service standards. ETSI and CEN/CENELEC are actively working on post-quantum profiles for the relevant technical specifications.
Sector-specific guidance
| Sector | Body | Status |
|---|---|---|
| Finance (EU) | EBA / ECB | PQC referenced in ICT supervisory expectations. Formal guidance expected 2025 to 2026. |
| Telecoms (EU) | ETSI ISG QSC | Migration guidance published. 5G security standards incorporating PQC requirements. |
| Government (DE) | BSI | Formal migration guidance published. Federal systems target date 2030. |
| Government (FR) | ANSSI | Hybrid PQC deployment guidance and QKD position paper published. |
| Defence / Gov (US) | NSA / CISA | CNSA 2.0 mandates with hard deadlines: 2025 (new software) through 2033 (full migration). |
| Healthcare (EU) | ENISA / DPAs | GDPR Article 32 state-of-the-art obligation increasingly relevant to special category health data. |