How To Prep Cryptographic Assets For The Emerging Quantum Era

Data drives business, and it must be protected. Cybersecurity is an ongoing, ever-evolving challenge for organizations across industries—and it’s about to become even more complex as the age of quantum computing advances toward maturity.

Quantum computing has the power to quickly solve the complex mathematical problems traditional encryption methods rely on, rendering those methods obsolete. It’s vital for businesses to act now to protect themselves, their digital assets and their customers. Below, members of Forbes Technology Council share practical, actionable tips to help companies assess and prepare their cryptographic assets to ensure their defenses are updated, compliant and ready for the quantum revolution.

Tap Into NIST Resources

Use NIST’s resources to navigate the shift to post-quantum cryptography. NIST has published standards and best practices for adopting quantum-resistant algorithms, providing guidance on assessing cryptographic assets, selecting algorithms and managing the transition. Don’t go it alone—leverage NIST’s tools to proactively prepare for the quantum era and secure your systems and data. – Neil Lampton, TIAG

Start With An Audit Of Sensitive Data

It’s essential for organizations to proactively upgrade their cryptographic systems to be quantum-resistant. My advice: Start with an audit of sensitive data, like customer and transaction info, and evaluate your existing methods. Prioritizing quantum-safe algorithms will earn your customers’ trust and ensure your digital infrastructure remains secure as quantum technology evolves. – Gökçe Güven, Kalder

Create A CBOM

A cryptographic bill of materials provides a comprehensive inventory of an organization’s cryptographic assets and their dependencies, detailing where and how each asset is used. A CBOM facilitates a more organized and efficient transition to post-quantum cryptography as the technology becomes a regulatory and operational requirement. – Jason Sabin, DigiCert Inc.

Adopt Multiple Layers Of Protection

Quantum computers will break modern encryption. Since the current standards used everywhere won’t hold, organizations should be acting now to increase their quantum knowledge, audit their systems (from logins to legacy code) and adopt multiple layers of protection, including the finalized NIST post-quantum encryption standards, quantum key distribution and quantum-secure networks. – Stephanie Simmons, Photonic Inc.

Implement A Continuous Inventory Program

Assess your current cryptographic assets and implement a continuous inventory program, including encryption algorithms, management practices and data protection methods across all legacy and modern systems. It reveals where sensitive data may be exposed and where post-quantum cryptography measures need prioritization. Organizations have legacy encryption embedded in their systems, many of which are vulnerable today. – Jack Hidary,SandboxAQ

Assess Current Protections Against Emerging Risks

Quantum readiness is going to be a key business advantage, and lack of preparation will be just as evident in the market. As an organization inventories its cryptographic assets, I’d advise thorough assessments of those protections against emerging quantum risks. This forms a baseline on which an organization can build a proactive roadmap for quantum-safe cryptography based on its specific environment. – Jordan Rackie, Keyfactor

Start Experimenting With PQC Deployments Now

An organization needs to understand and prioritize the data that it’s most important to protect, know how that data is currently protected, and determine how different quantum threat mitigations will affect it. I would strongly advise starting to experiment with post-quantum cryptography deployments now to build an experience-based understanding of the efforts required to deploy quantum-resistant solutions. – Karl Holmqvist, Lastwall

Implement A Phased Migration To Quantum-Resistant Algorithms

To prepare for quantum threats, organizations should act promptly by auditing their cryptographic assets, focusing on those vulnerable to quantum decryption, like RSA and ECC. After identifying these areas, they should implement a phased migration to quantum-resistant algorithms, following NIST’s standards, and explore quantum key distribution, given recent advancements in QKD technology. – Vandana Rana,Walmart Global Tech

Encrypt Your Cloud Data

As powerful compute resources like quantum computing become mainstream, threat actors will “harvest now, decrypt later.” If you don’t encrypt your cloud data, someone else will. Maintain control of data cryptography and aim for the highest level of data encryption; double is best. While encryption impacts storage efficiencies (for example, deduplication and compression), the juice is worth the squeeze. – Rick Vanover,Veeam

Test Quantum-Resistant Algorithms Alongside Existing Systems

Organizations should inventory their cryptographic assets and identify vulnerabilities. Begin testing quantum-resistant algorithms alongside existing systems using a hybrid approach. This enables gradual integration of new solutions without disrupting operations, helping build a quantum-safe infrastructure over time, instead of reacting when quantum computing advances. – Srikanth Mandru, Cisco Systems

Understand The Urgency

To be prepared for the quantum threat, first acknowledge that you don’t have infinite time to react. A cryptologically relevant quantum computer is likely to be available by 2030. Adopting the post-quantum cryptography algorithms standardized by NIST and quantum key distribution in your solution will allow you to achieve defense-in-depth. – John Prisco, Safe Quantum Inc.

Identify Where And How Your Company Uses Cryptography

Start preparing now by understanding where and how your company uses cryptography to protect data. Cryptography acts like a digital lock, keeping sensitive information—such as customer data, AI modules, financial records and communications—secure. Once fully developed, quantum computers will be incredibly powerful and capable of breaking the encryption methods we currently rely on. – Ronen Cojocaru, 8081 Inc.

Be Aware Of ‘Hack Now, Decrypt Later’ Strategies

The threat of quantum actors being able to hack into classically encrypted communications is real. Adversaries are conducting “hack now, decrypt later” strategies, and organizations must implement quantum-safe protocols now. That means paying close attention to NIST standards, which show how post-quantum cryptography should be applied. PQC should be combined with quantum key distribution to be genuinely quantum-secure. – Markus Pflitsch, Terra Quantum AG

Leverage AI For Guidance

AI can help you figure out your risk from quantum and provide you with actionable next steps to start addressing your post-quantum, crypto-related risk in an organized fashion. This is a Y2K-type challenge, except a lot less visible since it does not impact availability—just the core confidentiality of everything you do. – Gaurav Banga, Balbix

Assess The Potential Impact Of A Quantum Attack

An organization must assess the potential impact of a quantum attack on its systems, considering the consequences of a data breach and the resulting business disruption. It is also essential to prioritize the transition to post-quantum cryptography algorithms to protect sensitive data. – Will Conaway, NTT Data

Explore Potential Solutions And Partners

Educate yourself about quantum threats; understand that, while they’re coming, so are a number of solutions. There is no silver bullet, so have a Plan A and a Plan B. There are well-funded, cyber-focused companies driving initiatives to help solve quantum threats, so you won’t have to do it alone—but you will need to be educated and know what solutions best fit your business needs. – Jeff Schmidt, ECI

Assess Your Current Supply Chain

Start preparing by mapping the impact on your business when today’s cryptographic methods and systems become obsolete. Follow guidance from national cybersecurity authorities and stay updated on threat levels, as well as the standardization of post-quantum cryptography. Contact your vendors to discuss their plans for replacing their current protocols with PQC, and create a plan to assess your current supply chain based on the standards noted above. – Chris Dimitriadis, ISACA

Establish Ownership Of Cryptographic Assets

Organizations need ownership and insight to prepare for post-quantum cryptography. By conducting an inventory of its cryptographic assets and establishing ownership, a company can ensure a clear strategy and proper management of the transition. Designated ownership and visibility also prevents organizations from being siloed, allowing for a holistic approach to preparation. – Anudeep Parhar, Entrust

Ensure Systems Can Quickly Adapt To New Algorithms

Ensure your systems are designed to easily swap cryptographic algorithms as standards evolve, minimizing disruption when transitioning to quantum-resistant options. Start by inventorying assets with long-term data sensitivity and ensuring they’re adaptable to new algorithms. This flexible approach prepares you to respond swiftly as quantum-safe protocols mature. – Andres Zunino, ZirconTech

Avoid Overlooking ‘Clear And Present’ Dangers

One piece of advice I’d give organizations is not to borrow trouble. NIST says that 2048-bit RSA keys should be sufficient through at least 2030. In the interim, don’t worry about theoretical boogeymen: prioritize the “clear and present” dangers. Whether it’s taking advantage of a lack of multifactor authentication or talking IT help desk staff into deactivating it, cybercriminals are using low-tech exploits to do damage right now. – Jim Taylor, RSA Security

Previously published on Forbes.