The NCSC post-quantum migration timeline

Three milestones for planning

The UK National Cyber Security Centre (NCSC) sets indicative migration milestones: by 2028, complete discovery and assessment and create an initial plan; by 2031, complete high-priority migration activities and refine the plan; by 2035, complete migration to PQC across systems, services and products.

These are transition-planning milestones, not a prediction of Q-Day. The guidance recognises that some less common technologies may be harder to migrate.

What discovery should make possible

An inventory should help identify the owner, supplier, cryptographic role, service dependency and change route. A list of algorithms without those relationships does not yet provide a schedulable migration plan.

Prepare the priority decisions

Assign a next action to each important unknown. Use confidentiality lifetime, business impact and replacement lead time to distinguish early work from later waves. Bring procurement and service owners into the decision before contracts or architectures lock in long-lived dependencies.

Make progress visible

A board update can show inventory coverage, unresolved supplier dependencies, pilot outcomes and the number of migration decisions with accountable owners. Keep assumptions and exceptions alongside those measures.

PQC Ready’s methodology connects that evidence to a maturity baseline and a delivery pathway. An assessment supports planning; it does not by itself demonstrate that an NCSC milestone has been met.

Continue exploring

• PQCEMM: enterprise post-quantum maturity
• PQC migration planning
• Harvest now, decrypt later: the business risk

Primary sources

• NCSC migration timelines