PQC Migration Roadmap: How to Build One and Where to Start
Jul 02, 2026
ArticleBuild a PQC migration roadmap: inventory and CBOM, risk ranking with Mosca, hybrid ML-KEM first, PKI next, and the 2027-2035 deadlines.
Read articlePQC readiness (post-quantum readiness) is an organization's ability to keep its data and systems secure once quantum computers can break today's public-key cryptography. A PQC-ready organization knows where RSA, elliptic-curve and Diffie-Hellman cryptography is used, has a funded plan to replace it with post-quantum algorithms such as ML-KEM and ML-DSA, and has the technical ability to change algorithms before regulatory deadlines.
Readiness is not a yes-or-no state. It is measured, tracked and improved over several years. This guide explains what PQC readiness covers, which metrics measure it, how to run a readiness assessment, and how to use the free DuoKey Quantum Risk Score as a starting baseline.
Table of Contents
- What PQC Readiness Covers
- Why PQC Readiness Matters Now
- How to Measure PQC Readiness: Metrics
- PQC Readiness Levels
- Outside-In vs Inside-Out Assessment
- How to Run a PQC Readiness Assessment in 7 Steps
- PQC Readiness Checklist
- Measuring Readiness with the DuoKey Quantum Risk Score
- FAQ
What PQC Readiness Covers
PQC readiness has four dimensions. A weakness in any one of them slows the whole migration.
| Dimension | Question it answers | Evidence of readiness |
|---|---|---|
| Visibility | Do we know where public-key cryptography is used? | A current cryptographic inventory, with CBOMs per application |
| Exposure | How much of it is quantum-vulnerable, and what does it protect? | Share of quantum-vulnerable components, mapped to data shelf life and business owners |
| Agility | Can we change algorithms without rewriting systems? | Algorithms set by policy, hybrid support in libraries, KMS, HSMs and network devices |
| Programme | Is there a funded plan with dates? | A PQC migration roadmap with owners, budget and executive approval |
Vendor readiness belongs to all four: much of your cryptography runs inside products you buy, so supplier roadmaps for ML-KEM and ML-DSA are part of your own readiness.
Why PQC Readiness Matters Now
Three pressures make readiness a 2026 question rather than a 2030 one:
- Harvest now, decrypt later. Encrypted traffic recorded today can be decrypted once a cryptographically relevant quantum computer exists. Data with a long confidentiality life is already exposed. See harvest now, decrypt later explained.
- Deadlines. NIST's draft IR 8547 proposes deprecating quantum-vulnerable algorithms at 112-bit security after 2030 and disallowing them after 2035. NSA's CNSA 2.0 applies to new national security systems from 2027. The UK NCSC expects discovery and a plan by 2028. FINMA expects Swiss financial institutions to have a board-approved PQC roadmap by mid-2027 (see our FINMA Guidance 05/2026 analysis).
- Duration. Earlier cryptographic transitions took a decade in many organizations. Readiness measured now tells you whether your migration can finish in time.
How to Measure PQC Readiness: Metrics
Pick a small set of metrics you can measure every quarter. These are the ones that move decisions:
| Metric | What it tells you | Where the data comes from |
|---|---|---|
| Inventory coverage | Share of applications, hosts and endpoints with a current CBOM or scan | Crypto discovery tools, CMDB |
| Quantum-vulnerable share | Share of cryptographic components using RSA, ECC or DH | CBOMs (nistQuantumSecurityLevel = 0) |
| Hybrid key-exchange adoption | Share of external TLS and VPN endpoints negotiating hybrid ML-KEM (e.g. X25519MLKEM768) | TLS scans, load balancer and VPN configuration |
| Long-lived data on classical key exchange | Systems carrying data with a long shelf life that still use RSA or ECDH key exchange | Inventory plus data classification |
| Key store readiness | Share of KMS, HSMs and secrets managers that support ML-KEM and ML-DSA keys | Vendor answers, product tests |
| Vendor readiness | Share of critical suppliers with a dated PQC roadmap | Procurement questionnaires |
| Crypto-agility | Share of applications where the algorithm is configuration, not code | Architecture review, crypto-agility platform |
| Programme status | Roadmap approved, funded, with owners and milestones | Governance records |
A composite score is useful for boards and trend lines; the individual metrics are what engineering teams act on.
PQC Readiness Levels
Most maturity models use four or five levels. The bands below are the ones DuoKey uses for the Quantum Risk Score:
| Score | Level | What it typically looks like |
|---|---|---|
| 0 to 39 | Low readiness | RSA-2048 and ECDSA dominant throughout. No hybrid key exchange. Long-retention data exposed to harvest now, decrypt later |
| 40 to 69 | Early readiness | Modern TLS in use, but only classical algorithms. No migration plan visible |
| 70 to 89 | Developing readiness | Classical and post-quantum key exchange running in parallel. Crypto-agile architecture demonstrable. CBOM published. Migration path documented against at least one regulatory timeline |
| 90 to 100 | Advanced readiness | Post-quantum by architecture. Crypto-agility validated. Continuous CBOM monitoring. Deprecation schedules tracked operationally |
Other frameworks exist, such as the PKI Consortium's PQC extension to its PKI Maturity Model. Whichever you use, keep the same scale over time so progress is comparable.
Outside-In vs Inside-Out Assessment
A readiness assessment can start from outside your network or from inside it. Most organizations need both.
| Outside-in | Inside-out | |
|---|---|---|
| Looks at | Public domains and endpoints: TLS versions, key exchange groups, certificates, DNSSEC, public evidence of a migration programme | Code, binaries, filesystems, keystores, KMS and HSM keys, internal TLS, VPNs, SSH |
| Access needed | None | Scanners or agents with internal access |
| Time to first result | Days | Weeks to months, then continuous |
| Output | A baseline score and the exposure an attacker can see | A full CBOM and inventory with owners |
| Best for | Board baseline, prioritizing public endpoints, peer comparison, vendor due diligence | Migration planning and regulatory evidence |
How to Run a PQC Readiness Assessment in 7 Steps
- Set scope and owner. Decide which business units, environments and suppliers are in scope, and who signs off.
- Take an external baseline. Score your public domains; this gives a first number and finds exposed endpoints quickly.
- Discover internal cryptography. Scan code, hosts, keystores, cloud KMS and network devices, and record the results as CBOMs.
- Classify data by shelf life. Mark the systems that carry data that must stay confidential for 10 years or more.
- Assess key stores and vendors. Ask HSM, KMS, network and application vendors for dated ML-KEM and ML-DSA support (see PQC key management).
- Score and prioritize. Combine exposure, shelf life and deadlines into a priority list; Mosca's inequality (shelf life + migration time > time to a quantum computer) is a simple test.
- Feed the roadmap and re-measure. Turn the gaps into a PQC migration roadmap and repeat the measurement every quarter.
PQC Readiness Checklist
- An executive owner and budget for post-quantum migration
- A cryptographic inventory covering applications, infrastructure and cloud, kept current
- CBOMs in CycloneDX format for critical applications
- Data classified by confidentiality lifetime
- Hybrid ML-KEM key exchange enabled on external TLS and VPN endpoints you control
- Dated PQC support confirmed for each KMS, HSM and critical supplier
- New systems and procurements required to be crypto-agile
- A PQC migration roadmap with milestones aligned to the deadlines that apply to you
- Readiness metrics reported to management on a regular cadence
Measuring Readiness with the DuoKey Quantum Risk Score
The DuoKey Quantum Risk Score (QRS) is a free, outside-in PQC readiness assessment of your domain. It produces a 0 to 100 composite index from four weighted signals, using a published formula:
| Signal | Weight | What it measures |
|---|---|---|
| Algorithm resilience | 40% | Public-key algorithms and cipher suites in production, against FIPS 203, 204 and 205 |
| Crypto agility | 30% | TLS 1.3 adoption, hybrid support, certificate rotation cadence, CAA and DNSSEC |
| Harvest exposure | 20% | Data at risk under harvest now, decrypt later: forward secrecy, data lifespan, long-retention endpoints |
| Migration posture | 10% | Public evidence of a programme: published CBOM, hybrid endpoint testing, vendor disclosures |
The report includes an executive summary, a cryptographic inventory of the observable domain surface, a migration priority matrix, a regulatory timeline mapping and a 36-month migration sequence, followed by a review session with a DuoKey cryptographer. It needs no access to internal systems.
The QRS measures observable posture. It is a baseline and a trend indicator, not a security audit or a regulatory attestation. For the inside-out view, DuoKey's PQC Scanner produces CBOMs and DuoKey CPM keeps the inventory and readiness metrics current.
FAQ
Q: What is PQC readiness?
PQC readiness is how prepared an organization is to replace quantum-vulnerable public-key cryptography with post-quantum algorithms before quantum computers and regulatory deadlines make it necessary. It covers visibility of cryptography, exposure, crypto-agility and a funded migration programme.
Q: How do you measure PQC readiness?
With a small set of metrics: inventory coverage, share of quantum-vulnerable components, adoption of hybrid ML-KEM key exchange, key store and vendor readiness, crypto-agility and programme status. Many organizations combine them into a composite score, such as the 0 to 100 Quantum Risk Score, and track it quarterly.
Q: What is a PQC readiness assessment?
A structured review that establishes where an organization stands today: which cryptography it uses, how exposed it is, and what stands in the way of migration. It can be outside-in (public endpoints, no access needed) or inside-out (scans of code, hosts and key stores), and its output feeds the PQC migration roadmap.
Q: What is the difference between PQC readiness and crypto-agility?
Crypto-agility is one part of PQC readiness: the technical ability to change algorithms without redesigning systems. Readiness also includes knowing where cryptography is used, understanding exposure and having a funded plan.
Q: How long does a PQC readiness assessment take?
An outside-in assessment of public domains takes days. A full internal assessment with CBOMs and vendor questionnaires usually takes several weeks to a few months, and then becomes continuous monitoring.
Q: Is quantum readiness the same as PQC readiness?
In practice, yes. "Quantum readiness" and "post-quantum readiness" are used interchangeably for preparing cryptography for quantum computers. Some organizations also use "quantum readiness" for adopting quantum computing itself, which is a different topic.
References
- NIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography Standards
- CISA, NSA, NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography
- NCSC: Timelines for migration to post-quantum cryptography
- PKI Consortium: PQC extension to the PKI Maturity Model
- NIST FIPS 203, 204 and 205
Written by
DuoKey Team
Related Resources
Plan your post-quantum migration
Discuss the decisions that matter most to your security programme.
Tell us where control is difficult today. We will help you identify a practical next step.