Your organization's encryption strategy is now a compliance deadline, not a future concern. The White House has set the end of 2030 for post-quantum key establishment and the end of 2031 for digital signatures in high-value federal systems. If you hold a DoD contract, process Controlled Unclassified Information, or operate cloud services under FedRAMP, you're facing the same timeline, whether or not you've started planning.
This checklist guides you through the transition to quantum-resistant cryptography. It's designed for compliance officers and IT security leads who need to assess current exposure, identify vulnerable systems, and build a defensible transition plan before your next audit cycle.
Prerequisites
Before starting the checklist, confirm you have:
- Current cryptographic inventory: A documented list of every system, application, and data flow using encryption for key establishment or digital signatures.
- System ownership mapping: Clear identification of who owns each cryptographic implementation, including third-party vendors and cloud service providers.
- Regulatory scope documentation: Written confirmation of which systems fall under DFARS 252.204-7012, FedRAMP baselines, NIST SP 800-171, or other federal security frameworks.
- Access to vendor roadmaps: Contact with your software, hardware, and cloud providers to request their post-quantum transition timelines.
If you're missing any of these, start there. You can't assess quantum risk without knowing where your encryption lives.
Transition Checklist
1. Identify systems vulnerable to "harvest now, decrypt later" attacks
Review every system that processes or stores data with a confidentiality requirement longer than five years. This includes intelligence reports, long-term contracts, personnel records, research data, financial projections, and any CUI with extended retention requirements.
Good looks like: A prioritized list of systems ranked by data sensitivity and retention period, with highest-risk systems (classified, CUI, or long-term confidential data) flagged for earliest transition.
2. Document current cryptographic dependencies
Map which encryption algorithms your systems use for key establishment (typically RSA or ECDH) and digital signatures (typically RSA or ECDSA). Include operating systems, databases, VPNs, email gateways, Public Key Infrastructure, and application-layer encryption.
Good looks like: A table showing each system, the cryptographic libraries it uses, the specific algorithms in production, and whether those implementations can be upgraded without hardware replacement.
3. Review NSA CNSA 2.0 requirements if you handle National Security Systems
If your organization processes classified information or operates systems designated as National Security Systems, confirm you understand the quantum-resistant algorithms NSA has approved. Check whether your current vendors support these algorithms or have published transition roadmaps.
Good looks like: Written confirmation from each vendor serving National Security Systems that they're implementing CNSA 2.0-compliant algorithms, with specific version numbers and deployment dates.
4. Assess cloud service provider readiness
For every cloud service you use under FedRAMP authorization or DoD Cloud Computing Security Requirements Guide compliance, request the provider's post-quantum cryptography roadmap. Google has set 2029 as its transition target; your providers should have comparable timelines.
Good looks like: Documented commitments from each cloud provider showing their quantum-resistant algorithm implementation schedule, with confirmation that you can adopt new algorithms without migrating data or reconfiguring integrations.
5. Evaluate hardware constraints
Identify systems where encryption is implemented in hardware (HSMs, TPMs, network appliances, satellite communications, embedded systems). Determine whether firmware updates can add quantum-resistant algorithms or whether hardware replacement is required.
Good looks like: A replacement schedule for hardware that cannot be upgraded, with budget estimates and procurement timelines that complete upgrades before end-of-2030 for key establishment.
6. Test algorithm compatibility in non-production environments
Stand up test instances of your highest-priority systems and attempt to enable quantum-resistant algorithms. Document performance impacts, compatibility issues, and integration failures. This is not a paper exercise.
Good looks like: Test reports showing successful handshakes using quantum-resistant key establishment, measured performance overhead, and a list of systems that failed testing with root-cause analysis.
7. Update procurement language
Revise your RFP templates and vendor contract requirements to mandate post-quantum cryptography support. Include specific algorithm requirements, implementation timelines, and upgrade paths.
Good looks like: Standard contract language requiring vendors to support quantum-resistant algorithms by your internal deadline, with penalties for non-compliance and requirements for vendor-funded upgrades if their products don't meet the timeline.
8. Build a phased rollout plan
Sequence your transition starting with systems handling the most sensitive data or those with the longest confidentiality requirements. Don't try to upgrade everything simultaneously.
Good looks like: A Gantt chart showing system-by-system upgrades, dependencies between systems, testing windows, and rollback procedures, with the entire plan completing before your regulatory deadline.
9. Document your transition in your System Security Plan
If you operate under the Risk Management Framework, NIST SP 800-171, or CMMC requirements, your System Security Plan must reflect your post-quantum cryptography transition. Update SC-13 (Cryptographic Protection) and related controls.
Good looks like: SSP sections explicitly describing your quantum-resistant algorithms, implementation status, and transition timeline, with references to vendor documentation and test results.
10. Establish a review cycle
Post-quantum cryptography isn't a one-time upgrade. New algorithms may be standardized, vulnerabilities may be discovered, and threat timelines may accelerate. Set a recurring review.
Good looks like: A quarterly review meeting on your compliance calendar where you assess new algorithm standards, vendor announcements, and threat intelligence related to quantum computing capabilities.
Common Mistakes
Waiting for "more mature" standards: The algorithms exist. NSA has selected them. Waiting for broader industry adoption just shrinks your implementation window.
Assuming your vendors will handle it: They won't, not without contract requirements and active management. Vendors prioritize customers who put transition requirements in writing.
Treating this as an IT project instead of a compliance obligation: Your auditors will ask about post-quantum readiness. If you're approaching a CMMC assessment or FedRAMP reauthorization after 2030, you need documented progress.
Ignoring systems with long data retention: A file encrypted today with RSA and stored for ten years becomes vulnerable whenever quantum computers reach sufficient power. The retention period matters more than the encryption date.
Next Steps
Start with item one on this checklist this week. If you're supporting DoD contracts or operating FedRAMP-authorized systems, you have less than five years to complete a complex technical transition. That timeline compresses further when you account for testing cycles, vendor delays, and the reality that you can't upgrade production systems without extensive validation.
Your next audit will include questions about quantum readiness. Have documentation ready.
