Is Your Organisation Ready for the NCSC's 2028 PQC Milestone?
THE ROAD TO QUANTUM READINESS
Your first priority is discovery, not migration.
You do not need to replace every cryptographic system today. The immediate priority is to understand where quantum-vulnerable cryptography exists, which critical services depend on it and what needs attention first. That evidence will help you build a credible migration plan aligned with the NCSC’s 2028 milestone.
DO YOU NEED TO ACT NOW?
You hold sensitive information for many years
You rely on ageing or business-critical applications
Your estate has significant PKI or certificate dependencies
You depend on suppliers you do not fully control
You are already modernising or migrating applications
You cannot afford a rushed migration
Identify your PQC risks. Start planning now.
If your organisation holds long-lived sensitive data, relies on legacy applications or has complex cryptographic dependencies, start by identifying where your exposure lies. Assess your critical systems, establish ownership and prioritise the areas that need deeper discovery. These steps will help you build the evidence and investment case for a credible migration plan ahead of the NCSC’s 2028 milestone.
PQC READINESS STARTS WITH KNOWING WHERE YOUR CRYPTOGRAPHY IS.
THE HIDDEN COMPLEXITY.
You cannot fix what you cannot find.
Cryptography is baked into applications.
Legacy applications often contain hard-coded algorithms, embedded certificates and outdated cryptographic libraries that standard asset inventories and vulnerability scans may miss.
These components can sit deep within application code, configurations and third-party dependencies, making them difficult to identify and replace.
What needs to happen.
Application-level cryptographic discovery identifies the algorithms, protocols, certificates and libraries in use, along with the systems and services that depend on them.
This establishes the evidence needed to assess exposure and determine whether remediation is technically feasible.
The application remains. The knowledge may not.
Critical systems with limited visibility.
Original developers may have left, documentation may be incomplete and vendors may no longer support the technology.
Yet these applications can remain essential to public services, with dependencies on identity, PKI, infrastructure and other systems that are poorly understood.
What needs to happen.
Structured discovery combines architecture reviews, configuration analysis, technical workshops and dependency mapping to reconstruct how an application uses cryptography.
Findings should record evidence sources and confidence levels, allowing migration decisions to account for uncertainty.
Replacing cryptography is rarely a simple upgrade.
Changing cryptography can affect critical services.
New algorithms, larger keys and changing protocol requirements can expose compatibility, performance and integration constraints.
Supplier roadmaps may cover supported products but leave bespoke applications, unsupported platforms and legacy integrations unresolved.
What needs to happen.
Assess each application's business criticality, technical constraints and dependencies before selecting a migration approach.
Depending on the findings, the appropriate decision may be to remediate in place, re-platform, retire, run to end-of-life or formally accept a defined residual risk.
You cannot fix what you cannot find.
The application remains. The knowledge may not.
Replacing cryptography is rarely a simple upgrade.
START WHERE THE RISK AND VALUE ARE HIGHEST.
Where do we stand, and what should we do first?
A rapid assessment of your current PQC position, priority risks and readiness for the NCSC’s 2028 milestone.
We work with leadership and technical stakeholders to identify where deeper investigation is needed and define a practical scope for discovery.
A clear picture of your current position, key risk indicators and where leadership attention is needed.
A shortlist of applications, services and dependencies that warrant deeper cryptographic assessment.
The systems, evidence, stakeholders and access needed for the next stage.
A practical route into targeted assessment, enterprise discovery or migration planning.
What is the risk in this critical application, and how should we address it?
Assess one or more critical or legacy applications in depth to understand the cryptography they rely on, what they protect and what could be affected by change.
Designed for applications where documentation is limited, dependencies are unclear or migration decisions need stronger evidence.
Identify algorithms, protocols, certificates, libraries, key-management arrangements and other cryptographic dependencies.
Understand how the application communicates, where trust sits and which integrations or services depend on it.
Assess business criticality, data sensitivity, technical constraints and the difficulty of changing the cryptography safely.
Establish whether to remediate, re-platform, retire, run to end-of-life or consciously tolerate the risk.
Where is cryptographic exposure across our estate, and how should we prioritise migration?
Discover quantum-vulnerable cryptography across applications, infrastructure, PKI, identity, integrations and supplier dependencies.
The result is an enterprise view of where cryptographic exposure sits, what matters most and how migration should be prioritised.
Build a structured view of algorithms, protocols, certificates, keys, libraries and dependencies across the agreed scope.
Prioritise applications by business impact, data sensitivity, exposure and migration complexity.
Understand data flows, trust boundaries, integrations and the dependencies that could affect migration.
Sequence remediation into practical migration waves, with the dependencies, investment and decisions required to move forward.
You do not need to propose a full PQC migration programme now.
The immediate decision is whether your organisation has enough evidence to locate quantum-vulnerable cryptography, prioritise exposed services and build a credible plan for 2028. If it does not, begin with proportionate discovery.
Request a PQC readiness discussion.
Tell us about your organisation and we'll discuss your current position, priority concerns and whether a Readiness Review or more targeted assessment is appropriate.
FREQUENTLY ASKED QUESTIONS.
The NCSC recommends that organisations complete discovery and assessment of cryptographic services and infrastructure and create an initial PQC migration plan by 2028. For large organisations, that means understanding which systems depend on quantum-vulnerable cryptography, which should be prioritised and what investment or engineering work will be required.
PQC readiness is an organisation’s ability to identify where quantum-vulnerable cryptography is used, understand the business and technical risk and prepare a structured migration to post-quantum cryptography. It begins with visibility. Organisations need to understand the cryptography embedded across applications, infrastructure, PKI, certificates, identity services, integrations and supplier dependencies before they can plan migration.
Cryptographic discovery identifies where and how cryptography is used across an organisation. It can cover algorithms, protocols, certificates, PKI, cryptographic libraries, key management, data flows, trust relationships and integrations. For PQC readiness, discovery should also establish what each cryptographic component protects, what depends on it and how difficult it may be to migrate.
Legacy applications can contain hard-coded algorithms, embedded certificates, unsupported libraries and undocumented dependencies that standard inventories may miss. The original developers may no longer be available and vendor support may be limited. Before changing the cryptography, organisations need evidence about what is actually in use, what depends on it and what could be affected.
A useful migration plan should identify affected systems, prioritise them according to business and technical risk and define an appropriate treatment for each. That may include remediation, re-platforming, retirement, running to an agreed end-of-life date or formally accepting residual risk. The plan should also capture dependencies, sequencing, investment requirements and delivery ownership.
Yes. The same discovery work can reveal weaknesses that matter now, including deprecated protocols, weak cipher suites, certificate issues, ageing PKI and poorly understood trust relationships. Addressing those weaknesses can improve current cyber resilience while building the evidence needed for longer-term PQC migration.
The required evidence and access depend on scope. Access is agreed in advance and should be proportionate to the questions being answered. Discovery should not require organisations to disclose private keys as a routine input.
We use supplier roadmaps as evidence, then identify gaps affecting bespoke integrations, unsupported products, legacy applications and shared services. The aim is to distinguish vendor-managed change from risks and decisions the organisation still owns.
Duration depends on scope, estate complexity, available evidence and access constraints. Work can be phased around priority services so that governance and investment decisions do not wait for exhaustive enterprise coverage.
No. The work provides evidence and a migration-planning basis aligned to the stated milestone; it is not an NCSC certification or endorsement."
Trusted Security, Backed by Leading Certifications.
PARTNERING WITH INDUSTRY LEADERS TO SECURE YOUR ORGANISATION.
Looking for
exceptional outcomes?
