PQC Readiness Stage 1: How Awareness and Alignment Lay the Foundation for PQC Migration

The hardest part of PQC migration starts before any technology changes

Most security leaders know quantum computing puts today’s public-key cryptography at risk. Far fewer can name the person within their organization who owns the response. That gap between knowing and owning is where post-quantum cryptography (PQC) readiness stalls.

Quantum readiness is a journey that is split into phases. It begins with understanding your exposure and continues until you’ve modernized the cryptography your organization depends on. The first stage, Awareness and Alignment, is where that journey turns from a conversation into a program.

This post is part of a series on the five stages of PQC readiness from the Keyfactor PQC Lab. You’ll learn why Stage 1 can’t wait, four steps to build your foundation, and how to know you’re ready for Stage 2.

Where Stage 1 fits in the road to quantum resilience

Each stage towards PQC readiness builds on the one before it. Stage 1 is the foundation, because the other four stages need an owner to drive them.

The road to quantum resilience

Stage	What it focuses on
Stage 1: Awareness and alignment (you are here)	Buy-in across teams, clear ownership, and accountability
Stage 2: Discovery and planning	Visibility into every certificate, key, and algorithm, plus a readiness baseline
Stage 3: Risk prioritization	Ranking systems by data sensitivity, exposure, and shelf life
Stage 4: Agility and automation	Automation that puts security, identity, and infrastructure teams on one playbook
Stage 5: Continuous resilience	Crypto-agility to swap algorithms again without disruption

Want the big picture first? Explore the full PQC readiness framework.

Why awareness and alignment can’t wait

In its draft IR 8547 transition guidance, the National Institute of Standards and Technology (NIST) states that past cryptographic migrations took more than  a decade. This one is likely to take at least that long. The UK’s National Cyber Security Centre (NCSC) expects large organizations to need two to three years for discovery and planning alone.

Added to the above, the progress in quantum computing has significantly accelerated in the past few years. The migration can no longer be postponed. Alignment is the first task on that clock, so every month without an owner is a month of lost migration time.

The standards are ready for both, key encapsulation mechanisms (KEMs) and signatures. NIST published its first three finalized post-quantum standards, FIPS 203, 204, and 205, in August 2024. It urged organizations to start integrating them immediately, because full integration takes time.

The scope explains the timeline. Moving to PQC reaches far beyond swapping one cipher for another. It touches protocols, libraries, certificates, keys, hardware security modules (HSMs), firmware, and vendor products, so it amounts to an overhaul of your entire cryptographic stack.

Waiting for quantum news means you’ve waited too long

NIST’s draft guidance describes a planning model known as Mosca’s theorem: X + Y > Z.

• X is how long your data must stay secure
• Y is how long your migration will take
• Z is the time until a cryptographically relevant quantum computer (CRQC) exists

If X plus Y is greater than Z, you’re already behind. The model doesn’t need a date for Z, which helps, because NIST says no one knows when a CRQC will arrive. Expert estimates span a few years to a couple of decades.

Now picture waiting for the headline that a CRQC exists. On that day, Z is zero. Every system still running quantum-vulnerable cryptography is exposed, and your years of migration work haven’t started.

The exposure can begin even earlier. US agencies warn in a joint factsheet that adversaries could be collecting encrypted data today to decrypt later. The authors are the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and NIST.

To all of this, you can add the fact that many adversaries will lack the incentive to announce having access to a CRQC. Consequently, we may not know when attackers are ac whether or not it has been previously harvested.

This harvest now, decrypt later risk matters most for data that must stay confidential for many years.

Why waiting for a complete plan works against you

Many teams hold off until they have a complete migration plan. You can’t build that plan without the ownership, sponsorship, or visibility that Stage 1 creates. Waiting for the plan delays the work that produces it.

On the other hand, timelines are not waiting.

Government timelines add a planning horizon. NIST’s draft IR 8547 proposes deprecating 112-bit-strength RSA and elliptic curve algorithms after 2030. It proposes disallowing quantum-vulnerable public-key algorithms after 2035 for US federal use.

For US National Security Systems, NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) FAQ states its intent that all such systems be quantum-resistant by 2035. Neither timeline binds most enterprises, but they offer useful planning benchmarks.

What Stage 1 awareness and alignment means

Stage 1 means you recognize the PQC risk and are turning that awareness into clear ownership. The PQC readiness assessment sums up this stage in one line: you are building the foundation.

You don’t need a complete migration plan yet. What you need at Stage 1 is to complete the following three jobs:

1. Bring the right people together
2. Name an accountable owner
3. Identify the systems and data that need a closer look

Signs your organization is in Stage 1

You’re likely in Stage 1 if any of these sound familiar:

• PQC comes up in meetings, but no individual or team is accountable for it
• A working group coordinates early planning without executive sponsorship or funding
• No one has a reliable view of where quantum-vulnerable cryptography is used
• Discovery, if any, is targeted, mostly manual, and limited to a few known high-risk systems
• Leaders treat PQC as a one-time project with no ongoing governance
• Vendor and supply chain dependencies haven’t been assessed

Not sure where you land? Take the PQC readiness assessment to confirm your stage in about two minutes.

Four steps to build your PQC foundation

These four steps overlap, so you can run them in parallel.

Name an accountable owner

Naming an accountable leader is the clearest next move. Ownership turns PQC from a recurring discussion into coordinated work.

The owner  drives the organization’s transition plan: establishing priorities, coordinating teams, tracking progress, and resolving gaps across cryptographic discovery, risk assessment, and migration planning.

 That’s often a security architecture leader, a PKI owner, or a program manager reporting to the CISO.

Write the role down. A one-page charter that names the owner, sponsor, scope, and decision rights keeps PQC from sliding back into everyone’s problem and no one’s job.

Secure executive sponsorship and funding

Sponsorship and funding turn early planning into a coordinated program. The target state is a named sponsor and program lead who define priorities, budget, and a cross-functional roadmap.

Build the business case around data integrity and resilience. Quantum adversaries are just one threat on the list. Weak algorithms, expired certificates that cause outages, unmanaged keys, audit findings and AI adversaries are threats today.

The work that prepares you for PQC also reduces those risks now. A cryptographic inventory, clear ownership, and the ability to change algorithms quickly pay off whenever cryptography breaks. Boards can fund that with confidence, because the return doesn’t depend on predicting a quantum date.

Bring the right teams to the table

PQC touches every team that issues, uses, or buys cryptography. Secure buy-in across those teams early and define who owns what.

Team	Why they belong in Stage 1
Security leadership	Owns the program, sets risk tolerance, and reports progress to executives
PKI and identity	Knows where certificates, keys, and certificate authorities live and how they’re issued
Infrastructure and network	Runs the TLS endpoints, load balancers, VPNs, and HSMs that will need upgrades
Application owners	Know where cryptography is embedded in code, libraries, and business-critical apps
Procurement and vendor management	Asks suppliers about PQC roadmaps and adds requirements to new contracts
Legal and compliance	Tracks regulations and data retention obligations that set your X value, that is, the security shelf-life of your data
Enterprise risk	Connects quantum exposure to the risk register and business impact

Procurement often gets left out, which is a mistake. CISA, NSA, and NIST recommend engaging vendors as part of quantum-readiness planning. By Stage 4, security, identity, and infrastructure teams will need to work from the same playbook, and alignment now makes that easier.

Focus your first look at exposure

Start with the systems and data that are sensitive, long-lived, exposed, or regulated. Keep this first pass focused; the full inventory comes in Stage 2.

Good candidates to start include external-facing TLS services and systems holding data that must stay confidential for a decade or more. Add code and firmware signing for long-lived devices, plus systems in regulated environments.

Guide yourself by asking each team one question: which of your systems would hurt most if its cryptography failed or its data leaked in 10 years? The answer gives you a short list for discovery.

What progress looks like at the end of Stage 1

You’re ready to move on when a clear owner is in place and focused discovery has begun. Use this checklist to confirm:

Leaders treat PQC as an ongoing program with governance.

• A named owner coordinates PQC readiness, and the role is documented.
• An executive sponsor backs the program, with funding in place or committed.
• PKI, infrastructure, application, procurement, legal, and risk teams know their roles.
• You’ve identified a first set of sensitive, long-lived, exposed, or regulated systems.
• Focused discovery has started on those systems.
• Leaders treat PQC as an ongoing program with governance.

From alignment to discovery: What comes next

Once you have an owner, the next job is visibility. You can’t migrate what you can’t see.

Stage 2: Discovery and planning covers how to find every certificate, key, and algorithm across your environment. It also shows how to map dependencies, benchmark readiness, and set a baseline for your plan. NCSC’s indicative UK milestones target discovery and an initial plan by 2028.

How Keyfactor can help

Keyfactor PQC Lab gives you resources for every stage. For Stage 1, start with the PQC readiness assessment. It asks six questions, assigns one of five stages, and highlights three focus areas.

Lessons from the Lab, a video series with the PQC experts behind the lab, covers Awareness and Alignment. These Stage 1 resources go deeper:

• Planning Ahead for Post-Quantum Cybersecurity
• Special Board Report: Post-Quantum Risk and Business Resilience
• How to Prepare Your Team Today for a Post-Quantum Future

Want help applying your result? A Keyfactor PQC expert can connect it to your environment and answer questions about discovery, prioritization, testing, and migration. Request a Demo to start the conversation.

Alignment is the first step to quantum resilience

Stage 1 comes down to three jobs: bring the right people together, name an accountable owner, and identify the systems that need a closer look. You’re done with this stage when a clear owner is in place and cryptographic discovery has begun.

You don’t need a complete plan, you only need a decision to start. Take the assessment to see where you stand, then explore the full five-stage framework.