PQC Migration Roadmap: A Step-by-Step Guide

A 12-to-15-year migration timeline sounds long enough to not need urgent planning — until it’s compared against the 2028–2030 window current projections give for quantum computers capable of breaking RSA-2048. Closing that gap requires treating post-quantum migration as a structured, sequenced program, not a single project with one deadline. Here’s the sequence that actually works.

Step 1: Cryptographic Inventory

Before anything can be migrated, it has to be found. Cryptographic dependencies accumulate quietly across infrastructure, application code, certificates, and vendor relationships over years, and very few organizations have a centralized, accurate picture of where RSA and ECC are actually in use. Automated discovery tooling is the practical starting point here — manual audits reliably miss dependencies buried in legacy code, embedded certificates, and third-party integrations that nobody currently owns. This step routinely surfaces dependencies nobody remembered existed, which is exactly the point of doing it first and doing it thoroughly.

Step 2: Risk Prioritization

Not every system needs to migrate on the same timeline, and treating the whole inventory as equally urgent is a fast way to stall the entire program under its own scope. Prioritization should be structured around harvest-now-decrypt-later exposure specifically: systems protecting long-lived, highly sensitive data go first, because that’s exactly the data already at risk from adversaries capturing encrypted traffic today in anticipation of future quantum decryption capability. Critical systems and anything with a hard regulatory deadline attached follow. Lower-sensitivity, shorter-lived data can reasonably come later in the sequence.

Step 3: Hybrid Migration Design

Cutting every system over to post-quantum cryptography simultaneously isn’t realistic, and it isn’t necessary. A hybrid approach — classical and post-quantum cryptography running in parallel during the transition — is the standard pattern, precisely so nothing breaks mid-migration. It maintains compatibility with systems, partners, and integrations that haven’t migrated yet, while still gaining post-quantum protection wherever it has been deployed. This is the step that turns “migrate everything” into a manageable, incremental rollout instead of a high-risk flag day.

Step 4: FIPS 203/204/205 Implementation

With inventory, prioritization, and a hybrid design in place, actual implementation follows: deploying ML-KEM, ML-DSA, and SLH-DSA across the layers that need them — TLS, SSH, VPN, PKI, and hardware security modules. This is where the standards explained in FIPS 203/204/205 actually get deployed against real infrastructure, guided by the prioritization already established rather than deployed ad hoc wherever happens to be easiest first.

Step 5: Vendor and Supply Chain Coordination

An organization’s own infrastructure is only part of the picture — cryptography also lives in every vendor, cloud provider, and third-party system in the supply chain, and their migration status varies significantly and doesn’t happen automatically just because NIST finalized the standards. This step means actually verifying where technology vendors and cloud providers currently stand — assessing and coordinating with the full supply chain rather than assuming a vendor’s marketing claims about “quantum readiness” reflect actual FIPS 203/204/205 support in production.

Step 6: Compliance Documentation

Running in parallel with the technical work, not bolted on at the end: documentation demonstrating the migration against whatever regulatory frameworks apply — NIST guidance directly, NIS2, UK NCSC guidance, FedRAMP, and sector-specific mandates depending on industry. Building this documentation as the migration proceeds, rather than reconstructing it retroactively once regulators start asking, is significantly less painful and considerably more credible as evidence of a genuine, ongoing program rather than a last-minute compliance exercise.

Why Starting Now Is Cheaper Than Starting Later

The PQC migration market itself reflects the urgency here — projected to grow from roughly $1.9B in 2025 to $12.4B by 2035, driven by exactly this dynamic: organizations that move early spend less, disrupt less, and comply sooner than those racing a compressed timeline later. Given a realistic 12-to-15-year migration against a 2028–2030 threat window, and a global shortage of practitioners with real ML-KEM/ML-DSA/SLH-DSA experience, the organizations that begin cryptographic inventory now are the ones with genuine room to sequence this work sensibly — everyone starting later is trading planning time for crisis management time.