Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
This paper provides a comprehensive review of quantum readiness as a critical, multidimensional framework for navigating the upcoming quantum computing era. It addresses the imminent threat posed by cryptographically relevant quantum computers (CRQCs), which will be capable of breaking the public-key cryptographic systems (like RSA and ECC) that currently secure digital communications and e-commerce. The concept of ”harvest now, decrypt later” (HNDL), where adversaries collect encrypted data today to decrypt it once quantum computers are available, highlights the urgency of this transition. The review is structured around three key dimensions: the theoretical foundations of post-quantum cryptography (PQC), global standardization efforts, and real-world sectoral implementations. It discusses how quantum algorithms, specifically Shor’s and Grover’s algorithms, can render classical cryptography obsolete, and it analyzes the NIST Post-Quantum Cryptography Standardization Project, which has selected the first-generation PQC standards. The paper also examines strategies from the European Union and other nations, noting the geopolitical implications of standards fragmentation. Furthermore, the review explores the practical adoption of PQC in critical sectors like finance, telecommunications, and defense, emphasizing the importance of crypto-agility—the ability to rapidly switch cryptographic algorithms—for future-proofing systems. It also highlights open challenges, including performance overheads, legacy system migration, and the shortage of skilled professionals. The paper concludes by outlining future directions for a secure transition, advocating for continuous research, global collaboration, and sustained investment to build a quantum-resilient digital ecosystem.
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
Quantum computing is no longer a distant concern for cybersecurity planning. Its progress has raised serious questions about the long-term reliability of widely used public-key cryptographic systems, especially RSA, elliptic curve cryptography, and related key exchange mechanisms that currently protect digital communication, cloud services, financial transactions, government systems, and enterprise information assets. The main concern is that powerful quantum algorithms could weaken the mathematical assumptions on which these systems depend, creating future risks for encrypted data, digital signatures, identity systems, and secure network protocols (Shor, 1994; Mosca, 2018). Post-quantum cryptography has therefore become a major cybersecurity readiness priority, not only as a technical replacement for vulnerable algorithms, but as a broader organizational migration challenge. Effective preparation requires cryptographic asset inventory, risk classification, crypto-agility, vendor coordination, interoperability testing, and phased deployment across complex information systems (Kumar, 2022; Campbell, 2025). This article examines the cybersecurity implications of quantum computing and reviews the major post-quantum cryptographic algorithm families, current standardization efforts, enterprise migration barriers, and strategic readiness measures needed for the quantum computing era. It also discusses the importance of aligning post-quantum migration with existing cybersecurity governance, information systems management, and long-term digital resilience planning. By emphasizing early preparation, structured migration, and continuous cryptographic governance, the article argues that organizations can reduce future quantum-related exposure and strengthen the security of critical digital infrastructure before large-scale quantum attacks become practical (NIST, 2024; NCCoE, 2025).
Quantum computing poses an existential threat to classical public-key cryptography, particularly RSA and elliptic-curve systems, which form the backbone of secure communication, authentication, and digital trust. Once scalable quantum computers emerge, algorithms such as Shor’s will be capable of breaking these schemes, jeopardizing confidentiality and integrity across the internet and enterprise systems. Post-quantum cryptography (PQC) offers a viable defense, providing quantum-resistant algorithms that can be implemented on today’s hardware and protocols. Recent standardization milestones—including NIST’s approval of ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures, and the selection of HQC as a complementary KEM—mark a turning point for practical adoption. This paper surveys the quantum threat model, algorithm families, performance trade-offs, and integration patterns such as hybrid modes and crypto-agile architectures. It further outlines a phased migration roadmap for enterprises, emphasizing harvest-now-decrypt-later risks and compliance imperatives. By bridging technical, operational, and policy perspectives, the study provides actionable guidance to prepare organizations for a secure and quantum-resilient future.
This paper examines recurring technical and organizational bottlenecks in post-quantum cryptography (PQC) migration and develops an enterprise-oriented framework for managing them. A structured narrative review synthesizes NIST standards and guidance, CISA migration guidance, IETF specifications, and selected academic and research literature on enterprise migration, interoperability, software engineering, and PQC adoption. The paper organizes recurring migration concerns into five interacting layers and a six-stage migration lifecycle, and proposes candidate readiness metrics for future empirical testing. It connects technical migration concerns with organizational cybersecurity governance and presents a practical structure for treating PQC readiness as a continuous organizational capability. The framework is conceptual and is not presented as a validated maturity model.
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.