The emergence of quantum computing technologies poses significant risks to conventional public-key cryptographic systems and creating an urgent need for organizational preparation toward Post-Quantum Cryptography (PQC) migration. Although various PQC migration frameworks and quantum-readiness initiatives have been proposed, existing approaches primarily focus on technical migration guidance and provide limited operational mechanisms for assessing organizational readiness, particularly within public-sector environments. This study develops and conducts a preliminary validation of a Post-Quantum Cryptography Organizational Readiness Instrument (PQC-ORI) for Indonesian public-sector organizations using a Design Science Research approach integrating Systematic Literature Review (SLR), Qualitative Content Analysis (QCA), and Framework Alignment Matrix (FAM) techniques to synthesize recurring organizational readiness constructs from PQC migration literature, governance frameworks, and cybersecurity readiness studies. The resulting framework comprises six organizational readiness dimensions: Cryptographic Awareness, Governance and Policy, Migration Management, Technical Capability, Cryptographic Agility, and Operational Resilience. The framework additionally operationalizes these dimensions into structured assessment indicators and a five-level maturity model intended to support organizational self-assessment and migration planning activities. Preliminary validation by three domain experts using structured expert judgment yielded an overall mean score of 3.69/4.00, indicating high relevance, conceptual consistency, and applicability for assessing organizational readiness for PQC migration in public-sector organizations.
The emergence of quantum computing technologies poses significant risks to conventional public-key cryptographic systems and creating an urgent need for organizational preparation toward Post-Quantum Cryptography (PQC) migration. Although various PQC migration frameworks and quantum-readiness initiatives have been proposed, existing approaches primarily focus on technical migration guidance and provide limited operational mechanisms for assessing organizational readiness, particularly within public-sector environments. This study develops and conducts a preliminary validation of a Post-Quantum Cryptography Organizational Readiness Instrument (PQC-ORI) for Indonesian public-sector organizations using a Design Science Research approach integrating Systematic Literature Review (SLR), Qualitative Content Analysis (QCA), and Framework Alignment Matrix (FAM) techniques to synthesize recurring organizational readiness constructs from PQC migration literature, governance frameworks, and cybersecurity readiness studies. The resulting framework comprises six organizational readiness dimensions: Cryptographic Awareness, Governance and Policy, Migration Management, Technical Capability, Cryptographic Agility, and Operational Resilience. The framework additionally operationalizes these dimensions into structured assessment indicators and a five-level maturity model intended to support organizational self-assessment and migration planning activities. Preliminary validation by three domain experts using structured expert judgment yielded an overall mean score of 3.69/4.00, indicating high relevance, conceptual consistency, and applicability for assessing organizational readiness for PQC migration in public-sector organizations.
This paper examines recurring technical and organizational bottlenecks in post-quantum cryptography (PQC) migration and develops an enterprise-oriented framework for managing them. A structured narrative review synthesizes NIST standards and guidance, CISA migration guidance, IETF specifications, and selected academic and research literature on enterprise migration, interoperability, software engineering, and PQC adoption. The paper organizes recurring migration concerns into five interacting layers and a six-stage migration lifecycle, and proposes candidate readiness metrics for future empirical testing. It connects technical migration concerns with organizational cybersecurity governance and presents a practical structure for treating PQC readiness as a continuous organizational capability. The framework is conceptual and is not presented as a validated maturity model.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
Purpose This paper aims to examines the governance of post-quantum cryptography (PQC) transition in Gulf Cooperation Council (GCC) banking, identifies structural gaps in existing regulatory frameworks and proposes a regulatory readiness framework for orderly migration to quantum-resistant standards. Design/methodology/approach A qualitative policy-analytical methodology combines structured literature synthesis with comparative regulatory analysis of six GCC banking frameworks – Saudi Arabian Monetary Authority, Central Bank of the UAE, Central Bank of Kuwait, Qatar Central Bank, Central Bank of Bahrainand Central Bank of Oman – against five PQC governance dimensions, stress-tested across three cryptographically relevant quantum computer timeline scenarios. Findings None of the six frameworks explicitly addresses PQC transition requirements and all show critical gaps in cryptographic agility, quantum threat timeline awareness and harvest-now-decrypt-later (HNDL) risk assessment. National Institute of Standards and Technology (US)’s PQC standards (Federal Information Processing Standard 203, 204, 205) supply the technical foundation but not the regulatory coordination and supervisory capacity GCC banking requires. Practical implications The framework gives GCC banking regulators actionable guidance for introducing HNDL risk assessment, mandating cryptographic agility and establishing PQC transition planning before migration becomes compressed and disruptive. Originality/value This is among the first systematic PQC governance analyses of GCC banking, best characterised as a theoretically grounded contextual adaptation rather than a new governance theory. The proposed three-phase framework – inventory, prioritised migration, continuous resilience – is framed through a socio-technical transition lens, translating generic quantum-risk identification into a governance architecture grounded in the six GCC supervisors’ regulatory landscape.
Abstract—The progression of quantum computing presents a prospective threat to classical public-key cryptographic systems widely used in enterprise data infrastructures. This study proposes a structured, analytics-driven framework to support organizational migration toward quantum-safe cybersecurity. The five-phase model integrates cryptographic asset inventory, probabilistic risk modeling, post-quantum control selection, phased implementation, and continuous monitoring.A Monte Carlo–based simulation estimates potential vulnerability windows for RSA and ECC under varying qubit growth scenarios, enabling data-driven risk prioritization. Performance benchmarking of selected post-quantum cryptographic schemes was conducted using Open Quantum Safe (OQS) libraries across 10,000 runs to evaluate computational overhead and scalability characteristics. Organizational readiness was assessed through survey analytics (n = 25) and Delphi-based expert validation (n = 15), providing structured consensus on implementation feasibility.A controlled enterprise pilot demonstrated measurable reductions in migration planning time (approximately 82% within scope) alongside high usability acceptance (SUS score: 84/100). Findings suggest that integrating predictive modeling, performance analytics, and governance planning can enhance preparedness for long-term quantum risk while maintaining operational stability. The framework contributes to applied data analytics and communication network security by offering a quantitatively informed pathway for enterprise cryptographic transition. Index Terms—quantum-safe cryptography, post-quantum mi- gration, quantum computing, cryptographic inventory, hybrid TLS, cybersecurity frameworks