Australia’s ASD Sets Framework for Enterprise Post-Quantum Migration

Advances in quantum computing threaten to undermine widely used public-key encryption, pushing governments and companies to prepare for post-quantum cryptography, or PQC. The UK’s National Cyber Security Centre said migration will span legacy systems, sensitive data and complex technology supply chains, making an early inventory of cryptographic assets essential to managing long-term security and operational risks.

The NCSC’s latest practical guidance urges organisations to track vendors’ upgrade plans and make PQC readiness a condition in procurement and cybersecurity assessments. It sets a target of completing migration across all systems by 2035. The agency said supplier preparedness will be critical, as organisations depend on hardware, software and managed-service providers to deliver compatible upgrades before vulnerable cryptographic standards become obsolete.

Quantum computers could eventually break widely used public-key encryption, pushing companies to prepare for post-quantum cryptography, or PQC. Cybersecurity provider F5 said the transition must extend beyond replacing TLS certificates. Organizations also need visibility into algorithms, keys, protocols and other cryptographic components embedded across applications, infrastructure and supply chains, where overlooked legacy technology could create security gaps.

F5 recommended that companies begin with a comprehensive inventory and adopt a machine-readable Cryptographic Bill of Materials, or CBOM, to document where cryptographic assets reside, how they are used and what systems depend on them. Because no single discovery method can cover every environment, businesses should combine network traffic analysis, source-code scanning and configuration reviews to reduce blind spots, assess exposure and prioritize upgrades according to risk and operational importance.

The prospect that quantum computers could break widely used public-key encryption has pushed governments and companies to prepare for post-quantum cryptography, or PQC. The shift extends beyond swapping algorithms: organizations must identify cryptographic assets, manage system dependencies and control keys throughout their life cycles. Without a comprehensive migration framework, security gaps may emerge as legacy and quantum-resistant technologies operate in parallel.

A research team from universities across Europe and Germany reviewed 22 studies on PQC transition frameworks and found that most approaches emphasize early-stage inventory, risk assessment and planning. Guidance is considerably thinner for deployment, operational execution and long-term maintenance. The researchers said future frameworks should build in Crypto-Agility, allowing algorithms to be replaced efficiently, alongside systematic key management to protect the full migration life cycle.