Post Quantum Cryptography (PQC) readiness is increasingly constrained not by algorithm availability, but by cryptographic visibility, dependency complexity, and fragmented governance. This paper presents an anonymised case study of a large European critical service provider that initiated PQC readiness through a discovery first strategy, utilizing tool supported cryptographic inventorying to establish an evidence based baseline prior to migration planning. The discovery phase revealed systemic challenges, including distributed cryptographic ownership, uneven evidence quality across legacy and modern environments, and high dependency on third party cryptographic roadmaps. To operationalise these findings, the organisation introduced a structured exposure register that enabled prioritisation based on asset criticality, confidentiality longevity, and migration feasibility. We argue that PQC discovery should be understood as a governance capability that stabilises organisational knowledge and converts cryptographic uncertainty into measurable accountability, supporting risk based decision making and ecosystem coordination. The results contribute actionable lessons for institutions pursuing crypto-agility and resilience under post quantum harvest now, decrypt later threat models.
Post Quantum Cryptography (PQC) readiness is increasingly constrained not by algorithm availability, but by cryptographic visibility, dependency complexity, and fragmented governance. This paper presents an anonymised case study of a large European critical service provider that initiated PQC readiness through a discovery first strategy, utilizing tool supported cryptographic inventorying to establish an evidence based baseline prior to migration planning. The discovery phase revealed systemic challenges, including distributed cryptographic ownership, uneven evidence quality across legacy and modern environments, and high dependency on third party cryptographic roadmaps. To operationalise these findings, the organisation introduced a structured exposure register that enabled prioritisation based on asset criticality, confidentiality longevity, and migration feasibility. We argue that PQC discovery should be understood as a governance capability that stabilises organisational knowledge and converts cryptographic uncertainty into measurable accountability, supporting risk based decision making and ecosystem coordination. The results contribute actionable lessons for institutions pursuing crypto-agility and resilience under post quantum harvest now, decrypt later threat models.
India's digital governance infrastructure, spanning Aadhaar, UPI, DigiLocker, and critical sectors such as defence, finance, and telecommunications, is built upon classical publickey cryptography (RSA, ECC). The emergence of fault-tolerant quantum computers threatens to dismantle these foundations through Shor's algorithm, which solves integer factorisation and discrete logarithm problems in polynomial time, while Grover's algorithm reduces symmetric key security. The "harvest now, decrypt later" strategy magnifies the urgency, as adversaries can store encrypted data today for future decryption. This paper provides a comprehensive analysis of the post-quantum cryptography (PQC) migration imperative for India. We examine the quantum threat landscape, review candidate PQC families (lattice-, code-, multivariate-, hash-, and isogeny-based) and the newly standardised NIST algorithms, and detail the technical, regulatory, and economic challenges of large-scale PQC adoption in India's heterogeneous e-governance ecosystem. A phased implementation roadmap aligned with the National Quantum Mission (2026 to 2035) is presented, prioritising critical sectors (defence, banking, telecom, Aadhaar/UPI). The paper further highlights strategic opportunities for indigenous capability building, global certification leadership, and the reinforcement of digital sovereignty. By synthesising official reports, international standards, and sector-specific requirements, this work offers actionable guidance for transitioning India's governance to a quantum-resilient future. The paper further proposes the Quantum Governance Readiness and Infrastructure Decision Framework (Q-GRID), an India-specific, measurable decision framework that integrates quantum exposure, data longevity, systemic criticality, dependency, migration complexity, and regulatory urgency into a composite Quantum Risk Index to prioritise migration actions.
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
Small and medium-sized enterprises (SMEs) face the same quantum-era cryptographic exposure as large organisations, but they often lack the specialised security teams, governance maturity, asset visibility, and implementation budgets assumed by most post-quantum cryptography (PQC) roadmaps developed for governments, public institutions, and large enterprises. This paper addresses this challenge by adopting a structured research process to develop an evidence-based, SME-specific PQC migration framework that translates practical insights from existing roadmaps, standards, practitioner publications, and academic studies into structured actionable guidance. The framework also identifies activities that extend beyond typical SME capabilities into the operational domain of larger enterprises. The research study uses a human-supervised, large-language-model (LLM)-assisted text-analytics workflow based on a comprehensive multi-criteria decision analysis (MCDA). An initial corpus of 52 documents was evaluated for SME relevance, practical usefulness, clarity, and coverage. Seventeen high-value documents were selected for deeper analysis, producing 556 source-linked migration insights. These insights were validated, consolidated, and prioritised into 73 decision-oriented actions organised across four phases: Prepare, Assess, Implement, and Govern. The results show that PQC migration is not simply an algorithm-replacement exercise; it is an organisational transformation process requiring governance, cryptographic visibility, vendor coordination, phased implementation, and continuous monitoring. The contribution is both practical and methodological: a lifecycle-based migration model for SMEs and larger enterprises, and a replicable evidence-to-action analytical process for converting dispersed technical guidance into context-specific organisational action.
Post-quantum cryptography (PQC) migration is moving from algorithm design to organisational practice, yet the evidence that should guide migration tools is scattered across process studies, performance experiments, agility surveys and risk models. This paper presents a structured review guided by three research questions: what migration process is supported by the literature, what is known about the performance cost of the new algorithms, and what is missing for automated migration support. Eleven sources were analysed in depth, including recent IEEE Access papers and related surveys, experiments and guidance documents. The review finds that process terminology is still inconsistent, that performance evidence is mostly laboratory-based and per algorithm, that crypto-agility and risk scoring remain largely conceptual, and that cryptographic inventory is the prerequisite for everything else. These findings are converted into seven traceable requirements, which shape a seven-layer architecture for a Quantum-Ready Encryption Migration Assistant mapped to a four-phase migration process. A validation protocol with hypotheses, metrics, baselines and threats to validity is specified so that the assistant can be evaluated in future work. The architecture is conceptual and no experimental results are claimed.
Post-quantum cryptography (PQC) migration is moving from algorithm design to organisational practice, yet the evidence that should guide migration tools is scattered across process studies, performance experiments, agility surveys and risk models. This paper presents a structured review guided by three research questions: what migration process is supported by the literature, what is known about the performance cost of the new algorithms, and what is missing for automated migration support. Eleven sources were analysed in depth, including recent IEEE Access papers and related surveys, experiments and guidance documents. The review finds that process terminology is still inconsistent, that performance evidence is mostly laboratory-based and per algorithm, that crypto-agility and risk scoring remain largely conceptual, and that cryptographic inventory is the prerequisite for everything else. These findings are converted into seven traceable requirements, which shape a seven-layer architecture for a Quantum-Ready Encryption Migration Assistant mapped to a four-phase migration process. A validation protocol with hypotheses, metrics, baselines and threats to validity is specified so that the assistant can be evaluated in future work. The architecture is conceptual and no experimental results are claimed.
Quantum computing creates a governance problem before it creates a cryptanalytic event. Information collected today may remain sensitive after a cryptographically relevant quantum computer becomes available, while long-lived operational technology and spacecraft may be unable to adopt new cryptography within conventional replacement cycles.This paper examines how operators of long-lived cyber-physical systems should prioritize post-quantum migration under uncertainty. It distinguishes the present confidentiality risk of harvest-now, decrypt-later collection from the prospective integrity and authentication risks that could follow scalable attacks against public-key cryptography.Building on Mosca's migration inequality, the paper introduces the Quantum Migration Priority Score, a transparent decision framework combining timing pressure, consequence, adversary exposure, and cryptographic agility. Illustrative applications to municipal water systems and proliferated low-Earth-orbit architectures demonstrate how migration priority depends on mission consequences, protocol boundaries, key management, supply-chain dependencies, and compensating controls.The paper concludes with a staged governance strategy centered on cryptographic inventories, crypto-agile procurement, testable migration pathways, accountable risk ownership, and explicit management of residual risk.