Post-Quantum Cryptography Is No Longer Optional for Regulated Industries
Financial services and healthcare regulators have started issuing migration timelines. Most IT estates aren't ready.
For years, post-quantum cryptography was a topic for research labs and long-range planning. That is no longer the case for regulated industries. With new standards published and regulators setting expectations, financial services, healthcare and critical infrastructure organisations are being asked to show concrete migration plans.
Harvest now, decrypt later
The urgency comes from a simple threat. Adversaries can capture encrypted data today and store it until quantum computers are capable of breaking current algorithms. For data that must stay confidential for ten years or more — medical records, financial data, state secrets — the risk is already present.
“The question isn't when quantum computers arrive. It's how long our data needs to stay secret.”
Inventory comes first
The biggest obstacle is not the new algorithms. It is finding everywhere cryptography is used. Most enterprises have no complete inventory of the certificates, libraries, protocols and embedded devices that depend on today's encryption.
- Catalogue cryptographic assets across applications, networks and devices
- Prioritise systems that protect long-lived sensitive data
- Ask vendors for their post-quantum roadmaps and timelines
- Build crypto-agility so algorithms can be swapped without redesign
A multi-year programme
Migration will take years, not months. Many organisations are adopting hybrid approaches that combine classical and post-quantum algorithms during the transition, reducing risk while standards and products mature.
For regulated industries, the practical deadline is not the arrival of a quantum computer. It is the next regulatory examination that asks to see the plan.