POST-QUANTUM TRANSITION · BOARD BRIEFING

Two Clocks

Why the Quantum Deadline Is Earlier Than Your Compliance Date

Release candidate 2 · August 2026 · All figures verified against primary sources; vendor-commissioned research attributed as such.

Ask a Board of Directors for the quantum transition deadline, and the answer is usually 2030. That estimate is informed and fair, but it comes from regulation, not physics. Over the past eighteen months the two have separated. The organizations with the clearest view of the physics have set their own deadlines inside the 2030 date.

There is a familiar shape here. The last time every system in the estate shared a single latent defect, the industry had December 31, 1999 circled on the calendar — and many organizations still spent the final two years paying premium rates for scarce specialists. Q-Day is harder in at least three ways:

1. the remediation goes deeper than a data-format fix
2. the failure is silent rather than loud, and
3. the risk is retroactive.
4. Plan to the earlier clock. 2030 is compliance; 2029 is where Google and Cloudflare have set their own targets, and both published their reasoning.
5. You do not need to predict Q-Day to start. If confidentiality lifetime plus migration time exceeds any plausible arrival date, the decision is already made.
6. Delay is partly irreversible. Harvested data is already lost. Embedded product cryptography cannot be retrofitted after shipment.
7. Sequence signing first. Longest hardware tail, least agility, largest blast radius, earliest dates, and the explicit priority of the organizations closest to the hardware.
8. Discovery is a this-cycle decision. Budget, sequencing, vendor negotiation and regulatory reporting all depend on an inventory that governments allow three years to build.
9. This is not a security-team project. It reaches into procurement, product, engineering, transaction diligence, contracts, capital planning and risk management. Programs that live inside the CISO’s organization get funded as though they were optional.
10. Crypto-agility is the durable capability. PQC is the first of these migrations, but almost certainly not the last. NIST selected HQC as a code-based backup key encapsulation mechanism in March 2025 and has not yet published a draft standard for it — the portfolio is still moving.

Data exfiltrated today under RSA or ECC is decryptable the day a cryptographically relevant quantum computer exists. Firmware signed today with an ECDSA key is forgeable that same day, on every device already in the field. There is no equivalent of fixing it on the 31st.

1. Two Clocks

The Regulatory Clock Is Published and Dated

• United States, civilian. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed 22 June 2026. The EO directs OMB rather than binding agencies directly; the operative document is OMB M-26-15 (24 June 2026), which sets a five-phase schedule — high-value and high-impact systems on PQC key establishment by 31 December 2030, digital signatures by 31 December 2031, full migration 2035 — and required agency migration plans by late October 2026. Scope excludes national security systems.
• NIST IR 8547 (still an Initial Public Draft, November 2024) keys off security strength: 112-bit algorithms, including RSA-2048, deprecated after 2030 and disallowed after 2035; algorithms at 128-bit strength and above, including ECDSA P-256, disallowed after 2035.
• NSA CNSA 2.0, for national security systems: software and firmware signing support-and-prefer by 2025 — a date already passed — and exclusive use by 2030; networking equipment 2026/2030; browsers, servers and cloud 2025/2033; operating systems 2027/2033; niche and constrained equipment 2030/2033; custom applications and legacy equipment replaced by 2033. Running alongside it, CNSSP 15 requires all new national security system acquisitions to be CNSA 2.0 compliant from 1 January 2027, with non-capable equipment phased out by end-2030 and the algorithms mandated from end-2031.
• United Kingdom, NCSC. Discovery and migration planning complete by 2028, highest-priority migration by 2031, full transition by 2035.
• European Union. The NIS Cooperation Group’s Coordinated Implementation Roadmap — a recommendation, not a mandate — targets national roadmaps and planning by end-2026, high-risk critical infrastructure migrated by end-2030, and all risk levels complete by end-2035.
• Factoring cost collapsed. Craig Gidney’s May 2025 analysis put RSA-2048 within reach of under one million noisy qubits in less than a week, against the 2019 Gidney–Ekerå estimate of 20 million qubits in eight hours. The runtime is roughly 20 times longer — the qubit reduction was partly bought with time — but a 20-fold cut in the hardware requirement is the number that governs when the machine becomes buildable.
• Elliptic curve looks worse than RSA. In March 2026 Google published a discrete-log estimate for P-256 at fewer than 1,200 logical qubits, executable on under 500,000 physical superconducting qubits in a few minutes. A neutral-atom paper published the same week put P-256 at 26,000 physical qubits for a few days, with a floor of roughly 10,000 physical qubits for running Shor’s algorithm at cryptographically relevant scale at all. That neutral-atom result is a preprint from a company that raised $300 million on its thesis, with key details withheld — treat it as directional. Google’s is the more conservative architecture and reaches the same conclusion.
• Error correction crossed the threshold. Google’s 105-qubit Willow processor demonstrated logical error rates falling as code distance rises — the scaling property upon which the entire threat model was waiting.
• Expert opinion has tightened. The Quantum Threat Timeline Research Report 2025 (Mosca and Piani, evolutionQ and the Global Risk Institute, published March 2026, 26 experts) puts the averaged probability of a cryptographically relevant quantum computer within ten years at 28–49 percent, and within fifteen years at 51–70 percent.
• It is key exchange, not authentication. Cloudflare Radar measures one thing: share of HTTPS requests using post-quantum key exchange. The trust layer work — PKI, code signing, firmware signing, secure boot, hardware roots of trust — has barely started. Cloudflare says so. Its first authentication milestone shipped only in mid-2026.
• It was done for you, not by you. A handful of CDNs, browsers and cloud providers upgraded their edges. No mitigation for your data centers, applications, OT estate or vendor contracts.
• Internal readiness lags far behind. DigiCert-commissioned research (July 2026, n=1,001) found 87 percent of organizations planning, testing or implementing PQC — but only 7 percent running quantum-safe or hybrid cryptography across most of their digital certificates, and only 44 percent with a cryptographic inventory of any kind. ISACA’s April 2025 survey of over 2,600 professionals found 5 percent with a defined quantum strategy against 62 percent who expect quantum to break current encryption.
• Confidentiality horizon exceeds the timeline. Health and genomic records, insurance, legal and transaction files, intellectual property, defense and diplomatic material. Healthcare and life sciences are sharpest: the longest confidentiality requirement of any sector against the thinnest security budgets.
• Asset lifetime exceeds the deadline. Vehicles, aircraft, satellites, medical devices, grid and SCADA controllers, smart meters, payment terminals — 15 to 25 year lifecycles, often no field-upgradable cryptography. Product shipping today will still be in service past the disallowed date. This is the only category that cannot be remediated later at any price.
• Regulation flows down through contracts. Defense supply chain, where CNSA 2.0 and the 2027 acquisition gate bind every supplier rather than only primes; and financial services, where payment rails, HSMs, card networks and custody carry the heaviest supervisory pressure and deepest hardware dependency.
• Traffic is bulk-collectible at the network layer. Telecommunications: subscriber identity and backhaul are the canonical harvest target, against slow infrastructure refresh.
• NIST SP 800-208 specifies stateful hash-based signatures — LMS/HSS and XMSS/XMSS-MT — but CNSA 2.0 permits only LMS and XMSS for national security systems; the multi-tree variants HSS and XMSS-MT are disallowed, and NSA’s stated preference is LMS with SHA-256/192. State management is unforgiving: reusing a one-time key catastrophically compromises the tree, and signing requires CMVP-validated hardware with no waivers. That is an operational discipline most signing infrastructure has never had to enforce.
• ML-DSA-87 is also approved, and NSA notes it may be the most appropriate choice where a use case needs more signatures than one LMS or XMSS key supports, or where signing is distributed. SLH-DSA is not approved for any national security system use despite also being hash-based — worth knowing before anyone proposes it for firmware.
• Size is the binding constraint. ECDSA P-256 signatures are 64 bytes. ML-DSA runs 2,420 to 4,627 bytes with 1,312 to 2,592 byte public keys. SLH-DSA runs 7,856 to 49,856 bytes. That is one to nearly three orders of magnitude, depending on scheme — enough to break fixed-size image headers, one-time-programmable fuse budgets, secure-element storage, constrained flash and boot-time verification latency. On embedded and automotive platforms this is hardware redesign, not a firmware update.
• NIST CSF 2.0 — the Govern function is the natural home for crypto-agility policy, procurement controls and executive accountability. Identify covers the cryptographic bill of materials.
• NIST SP 1800-38 (NCCoE, Migration to Post-Quantum Cryptography) — the implementation-level companion, and the reference most likely to satisfy an auditor.
• ISO 27005 and ISO 31000 — scenario-based assessment, which fits deep uncertainty better than frequency-based methods.
• Five-Phase Delivery — Discover, Prioritize, Pilot, Scale, Institutionalize — with the final phase being the one that matters longest, because crypto-agility is what makes the next migration cheap.
• percentage of the estate inventoried
• percentage of certificates on quantum-safe or hybrid cryptography
• number of systems where X plus Y currently exceeds Z, and the trend
• percentage of tier-one vendors with a published, contractually referenced PQC roadmap

Regulations impact the private sector through procurement, contractual flow-down and diligence long before they become law. The 2027 acquisition gate is the clearest example: it binds suppliers, not just agencies.

The Technical Clock Is Unpublished — and Coming In

The organizations closest to the research are tightening timelines fastest, publicly.

Google set a 2029 migration target in March 2026, naming three factors: Willow, the error-correction result, and Gidney’s factoring estimate. Cloudflare followed in April 2026 with its own 2029 target for full post-quantum coverage including authentication. Cloudflare stated plainly that it reads Google’s prioritization as evidence “Google is concerned about Q-Day coming as soon as 2030.” IBM Quantum Safe’s CTO, Michael Osborne, has written that he cannot rule out quantum “moonshot” attacks on high-value targets as early as 2029.

In aggregate, these represent public commitments from organizations with inside visibility into hardware, and they are one to two years inside the regulatory deadlines. The people who can see the machinery are not planning to 2030.

Does the Date Matter?

Maybe not — especially since it is an informed guess, and because in this exercise a year early is exponentially better than a day late. Michele Mosca’s inequality states the problem in terms you already control:

If X plus Y exceeds Z, there is exposure — and that exposure began the day the data was created, not on Q-Day. The point for a board is that Z can remain unknown. Health, defense, genomic and financial transaction data carrying a ten-year confidentiality requirement, plus a five-year enterprise migration, fails the inequality against any Z under fifteen years. That covers the entire credible expert range, including its most conservative end. The conclusion holds without anyone having to accept a prediction.

2. The Adoption Headlines Are Misleading

Post-quantum key agreement now protects over 65 percent of human traffic to Cloudflare as of April 2026, up from 52 percent in December 2025. Genuine progress that is routinely misread.

Both readiness datasets come from organizations selling into this market, and the ISACA data predates the 2026 deadline accelerations by sixteen months. The overall picture: the public internet is migrating, and enterprises are not, yet.

3. Exposure

The Primitives

RSA, ECC/ECDSA and Diffie-Hellman fall to Shor’s algorithm — confidentiality and authenticity. Symmetric cryptography does not. Grover’s algorithm halves the effective key length of a block cipher in theory, but its iterations are inherently sequential and parallelize poorly — the operation counts involved remain out of reach on any plausible machine, which is why NIST uses AES-128 as the benchmark against which post-quantum security levels are defined. AES-256 is required under CNSA 2.0 and is the right default on normal refresh cycles, but AES-128 is not a Q-Day problem and should not compete for migration budget with the asymmetric work. This is an asymmetric-cryptography transition. What needs replacing is the public-key trust layer, in its entirety.

Two Mechanisms of Loss, Behaving Differently

Harvest now, decrypt later is a confidentiality failure with a retroactive tail: permanent loss for anything with a confidentiality requirement past roughly 2032.

Signature forgery is ugly, and under-discussed. Breaking a signing key does not compromise one message — it compromises every artifact that key has validated and everything an attacker chooses to mint afterward, indistinguishably from the genuine. One key break costs the entire installed base.

Sectors Diverge by Which Constraint Binds First, Not by Industry

Large enterprises often sit in three of the four at once.

4. Supply Chain and Trusted Compute

This is where the transition stops being a certificate-rotation exercise.

Secure boot is anchored in silicon. A device’s root of trust is typically an RSA or ECDSA public key — or its hash — fused into one-time-programmable memory, with the verification routine in mask ROM. Neither changes after fabrication. There is no cryptographic agility on deployed hardware: swapping the algorithm means silicon respin and a hardware refresh cycle, not a patch. A device manufactured in 2027 with ECDSA-only ROM verification will still be verifying with it in 2045.

The asymmetry is what should concern boards. An attacker with a cryptographically relevant quantum computer never touches your devices. They recover the signing key once, from any published signature, then mint valid firmware for the entire fleet. The result is a below-the-OS implant that survives reimaging, OS replacement and most forensic response — validating cleanly against the device’s own root of trust.

Signing is deliberately first in the regulatory sequence. CNSA 2.0’s support-and-prefer date for software and firmware signing was 2025, ahead of every other category, and exclusive use lands in 2030 alongside networking — the earliest of the exclusive-use dates. The reason is that signing has the longest tail: what you sign today must remain trustworthy for the full service life of everything that verifies it.

The strongest signal is commercial, not regulatory. Google’s March 2026 announcement explicitly re-prioritized authentication and digital signatures above harvest-now-decrypt-later, with Android 17 shipping ML-DSA signature protection as the named deliverable. The organization with the best hardware visibility moved signing to the front of its own queue.

The Replacement Primitives Are Awkward Exactly Where It Matters

And the software supply chain above it is behind. Artifact signing infrastructure gated on language-level cryptography that has only just arrived: Go’s standard library gained ML-DSA in version 1.27 (August 2026), and still lacks SLH-DSA. Sigstore has built crypto-agility scaffolding and carries ML-DSA experimentally in its specification, but the public good instance still signs with classical ECDSA P-256, and prototype post-quantum designs roughly double bundle size. Code-signing certificate hierarchies, CA/Browser Forum requirements, package repositories and HSM-backed signing services all have to move roughly together. They are not moving together yet.

Practical implication: sequence firmware and code signing first. Longest hardware tail, least agility, largest blast radius per key compromise, earliest regulatory dates, and now the explicit priority of the organizations with the best view of the threat.

5. Discovery Is the Long Pole

Migration cannot be scoped, sequenced, budgeted or defended to a board or regulator without knowing where cryptography lives — formalized as a cryptographic bill of materials: algorithms, key sizes, protocols, certificates, libraries and the dependencies that invoke them, including what was inherited through acquisition or embedded in third-party components.

The UK NCSC allows organizations until 2028 — roughly three years from its March 2025 roadmap — to complete a full discovery exercise and build a migration plan, before any migration begins. Against a 2030 regulatory date and a 2029 technical horizon, that leaves no slack. Manual discovery does not scale, because cryptography is distributed across network traffic, application code, certificate estates, cloud configuration and hardware. Automated cryptographic discovery has consequently become its own product category over the past eighteen months.

Discovery is also what makes Mosca’s inequality operable. X and Y are not enterprise-wide constants — they are per-system values. You cannot compute them for a system you have not found.

6. Managing to an Uncertain Deadline

Security organizations must run a multi-year capital program against a hazard with no date. That is a genuine methodological problem, and most of the standard toolkit handles it badly.

Probabilistic quantification under-serves this. FAIR and similar approaches need a loss event frequency. The arrival of a cryptographically relevant quantum computer is not calculable risk — it is deep uncertainty, where the distribution itself is contested. An expert range of 28 to 49 percent for the same ten-year window spans nearly a factor of two. Running that through a quantification model produces a number with false precision on the one variable that matters most, and invites the board to discount it accordingly.

Plan against lead time, not to probability. When the hazard date is unknowable but the remediation lead time is long and knowable, lead time is the governing constraint. This is how seismic retrofit and strategic stockpiling are managed, and it is the correct posture here: the decision-relevant number is not when Q-Day arrives but how long you need, which is measured in years and is entirely within your visibility.

Mosca’s inequality is the mechanism that makes this concrete. Applied per system rather than enterprise-wide, it produces a defensible prioritization: rank by confidentiality lifetime, exposure, business criticality and ease of replacement, then migrate wherever X plus Y exceeds any plausible Z. It also gives the board a clean statement of residual risk — not “we are secure,” but “these systems currently fail the inequality, and here is the plan and date for each.”

The Frameworks CISOs Should Map To

Reporting in Terms a Board Can Assess

“Are we secure?” is unanswerable. These metrics are measurable — as is progress against them:

7. For the Board of Directors

Asks. Name an accountable executive outside of security. Fund cryptographic discovery this cycle. Require PQC roadmaps from tier-one vendors and silicon suppliers. Write crypto-agility into procurement standards. Report progress against these four metrics to the risk committee quarterly.

The precedent worth remembering is not that the last one turned out fine. It turned out fine because it ran for four years as a board-level program with a budget line and a plan. The organizations that treated it as an IT problem paid the most and finished last.

Sources

Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, 22 June 2026 — whitehouse.gov

OMB M-26-15, Execution of the Migration to Post-Quantum Cryptography, 24 June 2026 — whitehouse.gov

NIST IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards — csrc.nist.gov/pubs/ir/8547/ipd

NSA, Commercial National Security Algorithm Suite 2.0 and CNSA 2.0 FAQ — media.defense.gov

NCSC, Timelines for migration to post-quantum cryptography, March 2025 — ncsc.gov.uk/guidance/pqc-migration-timelines

NIS Cooperation Group, Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, June 2025 — digital-strategy.ec.europa.eu

C. Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, May 2025 — arXiv:2505.15917

Google Quantum AI, elliptic-curve discrete-log resource estimate, March 2026 — arXiv:2603.28846

M. Cain et al., Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits, March 2026 — arXiv:2603.28627

Google Quantum AI, Quantum error correction below the surface code threshold, Nature, December 2024

M. Mosca and M. Piani, Quantum Threat Timeline Research Report 2025, evolutionQ and Global Risk Institute, March 2026

H. Adkins and S. Schmieg, Quantum frontiers may be closer than they appear, Google, 25 March 2026

B. Westerbaan, Cloudflare targets 2029 for full post-quantum security, Cloudflare, 7 April 2026

DigiCert, Quantum Readiness Outlook, 23 July 2026 (vendor-commissioned, n=1,001)

ISACA, Quantum Pulse Poll, April 2025 (n greater than 2,600)

NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes, October 2020

NIST, HQC selected as fifth algorithm for post-quantum encryption, March 2025