Quantum Leap: Crypto Deadline Looms for Businesses

Quantum computing's threat to current cryptographic standards is no longer a distant possibility, with advances rapidly accelerating progress. Google has warned that cryptographically-relevant quantum computers may be closer than anticipated, setting a 2029 target for its own migration to post-quantum cryptography (PQC). This urgency is compounded by the practice of 'harvest now, decrypt later,' where adversaries collect encrypted data today to decrypt with future quantum capabilities.

Organizations must proactively address quantum risk. NIST finalized its first PQC standards in 2024, encouraging immediate transitions. A critical first step involves creating a cryptographic bill of materials (QBOM) to inventory existing cryptography. Prioritization should focus on data longevity and sensitivity, as well as the risk to authentication systems reliant on public-key cryptography.

Achieving quantum readiness requires a business-wide approach, extending beyond the CISO's direct control. Migrations will likely span several years, necessitating flexibility in annual budget cycles to accommodate evolving standards and threats. Procurement strategies must also adapt, scrutinizing vendors for their PQC roadmaps and cryptographic update capabilities to avoid future migration complexities.