NCSC publishes post-quantum cryptography migration workshop findings

The NCSC has published a report summarising the findings from its first post-quantum cryptography migration workshop, held to help organisations understand the practical challenges of transitioning to quantum-resistant cryptographic standards. The NCSC reports that no organisation can navigate the migration alone, and that the workshop highlighted the need for cross-sector collaboration, clear technical guidance and realistic planning timelines. The report emphasises that post-quantum cryptography migration is not a simple software update, but a complex, multi-year programme that will require organisations to identify where cryptography is used, assess dependencies, test new algorithms and coordinate changes across supply chains and partner organisations.

Why this matters for UK organisations

For UK organisations, this is an early but important signal that post-quantum cryptography planning should be starting now, even though the immediate operational risk from quantum computing remains distant. The NCSC's message is that organisations need to understand their cryptographic inventory, identify where long-lived data or systems may be at risk from future quantum decryption, and begin engaging with suppliers and partners about migration timelines. The workshop findings also make clear that this is not a problem that can be solved by individual organisations in isolation, and that coordinated industry and government action will be needed to manage the transition effectively. Organisations that begin planning now will be better positioned to manage the technical, operational and supply chain challenges that will emerge as post-quantum cryptography standards mature and adoption timelines become clearer. The report also highlights that organisations need to consider not just their own systems, but also how cryptographic changes will affect partner integrations, third-party services and long-term data protection obligations.

What to review

Organisations should begin identifying where cryptography is used across the organisation, particularly in long-lived systems, data archives, partner integrations or infrastructure that may be difficult or expensive to replace. This includes reviewing where encryption is used to protect data at rest, data in transit, digital signatures, authentication mechanisms and key management systems. Organisations should also consider whether they have the technical visibility and supplier engagement needed to plan a multi-year cryptographic migration, and whether this work has clear ownership within IT, security or architecture teams. It is also worth reviewing whether long-lived data, such as archives, backups or regulatory records, may be at risk from future quantum decryption, and whether additional protection measures should be considered now. The NCSC's guidance suggests that organisations should begin engaging with suppliers and partners about their post-quantum cryptography roadmaps, and that this should be treated as a strategic planning exercise rather than an immediate technical project.

Source: NCSC UK