UK’s NCSC Issues Roadmap for Post-Quantum Cryptography Transition

The UK’s National Cyber Security Centre (NCSC) has issued new guidance urging organizations to fully transition to post-quantum cryptography (PQC) by 2035. This strategic shift aims to protect sensitive data from the emerging threat of quantum computing, which could render current encryption methods obsolete.

A Phased Approach to PQC Migration

To ensure a smooth transition, the NCSC has outlined a three-phase migration strategy. This structured approach minimizes security risks associated with rushed implementation and ensures a stable transition period.

According to the NCSC, the guidance is primarily intended for technical decision-makers, cybersecurity risk owners, and operators of critical national infrastructure (CNI). Organizations with customized IT systems are also encouraged to follow the roadmap. For small and medium-sized enterprises (SMEs), the transition to PQC will likely occur as part of routine service provider upgrades.

NCSC’s Chief Technical Officer, Ollie Whitehouse, emphasized the urgency of migration: “Quantum computing is set to revolutionize technology, but it also poses significant risks to current encryption methods. Our new guidance on PQC provides a clear roadmap for organizations to safeguard their data against these future threats.”

Timeline for PQC Adoption

The NCSC has set a 10-year timeline to ensure a structured transition. This period allows for the development and adoption of PQC standards, as well as the availability of secure cryptographic solutions. The US National Institute of Standards and Technology (NIST) standardized the most widely used PQC algorithms in 2024, forming the foundation for this shift.

The three-stage transition plan includes:

2028: Discovery and Assessment

Large organizations and those managing in-house IT infrastructure should initiate migration planning within the next two to three years. Key tasks include:

• Identifying high-priority areas for early migration

• Assessing dependencies on suppliers and infrastructure

• Communicating needs to vendors

• Evaluating investment requirements for implementation

• Planning for the transition of long-term hardware roots of trust

Organizations should conduct a full cryptographic inventory to understand where and how encryption is currently applied. This will help them determine which systems require the most urgent upgrades. Companies operating in highly regulated industries, such as finance and healthcare, may need to coordinate with industry regulators to ensure compliance with future PQC requirements.

2031: High-Priority Upgrades and Refinements

Over the next three years, organizations should complete priority migration activities, securing their most critical assets. During this phase, they should also refine their transition strategy, ensuring compatibility with future cryptographic advancements.

This phase should also include testing and validation of PQC solutions. Many organizations will need to work with cybersecurity vendors to integrate quantum-resistant encryption protocols into their existing infrastructure. Businesses should also train their cybersecurity teams on new cryptographic methods and threat mitigation strategies.

2035: Full Migration to PQC

By 2035, organizations should have fully integrated PQC into their systems. Additionally, this period should be used to enhance overall cybersecurity resilience.

During the final phase, organizations should ensure that all legacy encryption methods are phased out to prevent security vulnerabilities. Continuous monitoring and regular updates will be essential to adapt to emerging threats in the post-quantum era.

Why PQC Adoption is Crucial

PQC adoption is an urgent cybersecurity priority. The arrival of powerful quantum computers capable of breaking traditional encryption poses a major risk to data security. Without PQC, sensitive information, communications, and system integrity could be compromised.

A growing concern is the “harvest now, decrypt later” tactic used by cybercriminals, in which attackers steal encrypted data today and decrypt it once quantum computing becomes viable. This method puts long-term sensitive data at significant risk.

Industries at High Risk

Industries that handle highly confidential data are particularly vulnerable to quantum threats. These include:

• Financial services: Banks and payment processors rely heavily on encryption to protect transactions and sensitive financial data.

• Healthcare: Hospitals and pharmaceutical companies store vast amounts of patient records and proprietary medical research.

• Government and defense: National security agencies and military operations depend on encryption to safeguard classified communications.

• Energy and utilities: Critical infrastructure, including power grids and water supply systems, could be exposed to cyberattacks if encryption is compromised.