Almost everything that keeps data private online depends on a small number of mathematical problems that today's computers cannot solve in any useful time. RSA and elliptic curve cryptography protect web traffic, VPNs, digital signatures, software updates and much of what organisations exchange with banks, regulators and partners.
A sufficiently powerful quantum computer would solve those problems. Nobody knows exactly when such a machine will exist, and estimates vary widely. But standards bodies and governments have stopped treating it as science fiction, and that alone makes it an audit topic.
Why it matters before the machine exists
The risk is not only in the future. Attackers can capture encrypted data today and store it until it can be decrypted, an approach often called "harvest now, decrypt later". Information that must stay confidential for ten years or more, such as health records, national identity data, legal files and long term contracts, is already exposed to that risk.
The second reason is time. Replacing cryptography across an organisation is slow. It sits inside applications, devices, certificates, hardware security modules and third party products. Previous migrations, such as moving away from old hashing algorithms, took many years.
The standards are ready
In August 2024 the US National Institute of Standards and Technology published its first post quantum cryptography standards: FIPS 203 for key establishment and FIPS 204 and FIPS 205 for digital signatures. NIST has also set out a transition plan in NIST IR 8547, proposing that today's vulnerable algorithms be deprecated after 2030 and disallowed after 2035. Vendors are already adding support, and some web browsers and messaging apps use hybrid post quantum key exchange today.
Five questions auditors should ask now
1. Do we have a cryptography inventory?
Most organisations cannot say where they use RSA or elliptic curve cryptography, in which systems, protocols and certificates, and with which key lengths. Without that inventory, there is no plan, only good intentions. Ask whether one exists and how it is kept current.
2. Which data must stay secret for longest?
Prioritise by how long information needs protecting, not just by how sensitive it is today. Data with a long confidentiality life is the first to face the harvest now, decrypt later risk, and the first that should move.
3. Is anyone accountable?
Post quantum migration touches infrastructure, applications, procurement and vendors. Check that a named owner and a roadmap exist, even if the roadmap is only at the discovery stage.
4. Are we buying crypto agility?
New systems should be able to change algorithms without being rebuilt. Review whether procurement requirements and vendor contracts ask about post quantum support and algorithm agility. Every system bought today without it is a future migration problem.
5. What are our vendors doing?
Much of the cryptography an organisation relies on lives in products it does not control: cloud services, network equipment, payment systems and software libraries. Ask critical vendors for their post quantum roadmap, and track the answers.
What good looks like at this stage
Nobody expects an organisation to be post quantum ready in 2026. A reasonable position today is a cryptography inventory in progress, data classified by confidentiality lifetime, an owner with a roadmap, procurement clauses that require agility, and a list of vendor commitments. That is achievable, inexpensive compared with a rushed migration later, and exactly the kind of foresight a good audit can prompt.
Four questions for leadership
- Which of our data would still be damaging if it were decrypted ten years from now?
- Do we know where our encryption lives, and who owns the plan to change it?
- Are new systems we buy able to switch algorithms without being replaced?
- Which of our critical suppliers have told us their post quantum plans?
Post quantum risk is unusual because the threat is uncertain but the preparation is not. Inventory, prioritisation and agility are good security practice whether the quantum computer arrives in five years or fifteen. Auditors who ask these questions now are not predicting the future. They are making sure the organisation is not starting from zero when it arrives.
References and further reading
- NIST, FIPS 203, Module Lattice Based Key Encapsulation Mechanism Standard (August 2024)
- NIST, FIPS 204, Module Lattice Based Digital Signature Standard
- NIST, IR 8547, Transition to Post Quantum Cryptography Standards
- CISA, Post Quantum Cryptography Initiative
- UK National Cyber Security Centre, Next steps in preparing for post quantum cryptography