A deadline isn’t a migration plan

The dates are set. A June 2026 US executive order moves high-value federal systems to quantum-safe key exchange by December 31, 2030, and to quantum-safe signatures by the end of 2031. The UK’s National Cyber Security Centre asks organizations to finish discovery and a first plan by 2028, complete their highest-priority moves by 2031, and finish everything by 2035. The G7’s financial cyber experts suggest 2030 to 2032 for critical financial systems.

A date tells you when to finish, but not what to move first. That part is your plan, and it depends on facts about your own systems that no regulator can supply.

The dates, side by side

The milestones come from different bodies and apply to different organizations, so read them as one direction of travel rather than one rulebook. The US order binds federal agencies. The NCSC timeline is guidance for UK organizations. The G7 roadmap is non-binding guidance for the financial sector. NIST’s proposal to deprecate today’s public-key methods after 2030 and disallow them after 2035 is a draft that’s still open.

Read together, they say the same three things: plan now, move the most important systems first, and expect the job to take years.

Why deadlines go wrong

Deadlines are often set without a clear picture of which systems can realistically move in time. Lead time varies enormously. Some systems change in one maintenance window. Others depend on equipment with long replacement cycles, on software a vendor has to update first, or on partners who must be ready before you can switch.

Without that picture, the easiest systems get done first because they’re easiest to report on, and the hardest are left with the least time. The G7 roadmap describes cryptographic transition as “often a complex and time-consuming process that must be undertaken with care to be done safely”, which is a polite way of saying it can’t be rushed at the end.

How to sequence the work

For each system, find out four things:

• Where it relies on cryptography, and which methods it uses.
• How long its data or signatures must stay trustworthy.
• What depends on it, inside your organization and outside it.
• Who owns it and can make the change.

Then order the work by lead time, longest first. The systems with the longest road, such as root certificates other systems trust and connections to partners, need to start first even if they finish last.

Revisit the order as you learn more. Discovery always turns up systems nobody listed, and a vendor update can shorten a lead time overnight.

What to do in the next twelve months

Most organizations aren’t moving yet: in the 2026 Entrust and Ponemon Institute study, 38% said they were actively moving to quantum-safe encryption. That leaves room to get ahead with three practical steps.

• Complete discovery for the systems that matter most, starting with the ones that hold long-lived data.
• Agree an owner for each of them, with the authority to schedule change.
• Build a sequence your teams can absorb alongside their other work, and review it every quarter.

None of this needs a final answer on which algorithm goes where. It needs a clear view of what you have and who will move it.

Common sequencing mistakes

• Starting with the easiest systems. They make good progress reports and leave the hardest work until there’s no time left.
• Treating every system as equally urgent. Effort spreads thin, and the long-lived data and long-trusted signatures get no more attention than a test site.
• Planning only inside your own walls. Partners, suppliers and customers who verify your signatures or share your connections have to move too, often on their own schedules.
• Waiting for every algorithm decision before starting. Discovery, ownership and dependency mapping are needed whatever you choose, and they take the longest.
• Counting deployments as progress. A change isn’t finished until fresh evidence confirms it, as described in when is a cryptographic change finished?

Questions for your first planning session

• Which deadlines apply to us directly, and which apply to our customers or regulators?
• Which of our systems hold data that must stay private for many years?
• Which signatures do our customers and partners rely on for years at a time?
• Which systems depend on a vendor or partner moving first?
• Who will own the sequence, and how often will we review it?

Where Arcrix™ helps

Arcrix™ by QTrino Labs builds the picture a sequence needs, with an owner for every finding, and keeps it current. A deadline becomes a sequenced plan, so the systems that need the most lead time get attention first.