Start with the cryptographic inventory
Document TLS, PKI, VPN, authentication, code-signing and other public-key dependencies. Capture versions, libraries, suppliers and ownership.
Identify long-life confidentiality risks
Prioritise systems where captured encrypted information must stay confidential for many years, considering threat exposure and transition lead times.
Map standards and interoperability
Evaluate applicability of NIST FIPS 203, 204 and 205 and platform-specific support. Account for certificate ecosystems, performance and hybrid transition approaches.
Engineer crypto-agility
Avoid fixed assumptions about algorithm size, signature shape or supported key exchange. Design rotation, rollback and migration testing into systems.
Sequence pilots and supplier decisions
Pilot a representative platform, validate compatibility and capacity, and incorporate PQC capability evidence into procurement and renewal processes.
Further reading: NIST Post-Quantum Cryptography project and ASD cryptographic guidance.