The Post-Quantum Transition: Why Organisations Need to Prepare Now
By SPIE ICS SA
Understanding post-quantum cryptography (PQC) and preparing your migration.
Post-quantum cryptography (PQC) refers to the family of algorithms designed to withstand attacks by a quantum computer while running on today's classical processors. It is gradually replacing RSA, Diffie-Hellman and elliptic curves, whose security relies on mathematical problems that a sufficiently powerful quantum computer would be able to solve.
This is no longer a matter of speculation. In August 2024, NIST published its first three PQC standards, and on 9 July 2026, FINMA issued its Guidance 05/2026, which recommends that Swiss financial institutions have a roadmap in place by mid-2027. Written by SPIE ICS's cybersecurity teams, this article explains what PQC is, why the threat already requires action today, and how to structure a realistic transition.
What is post-quantum cryptography (PQC)?
PQC covers encryption, key exchange and signature algorithms that are secure even if factorisation or the discrete logarithm can be solved, because they rely on problems that are difficult even for a quantum computer to solve, such as lattices or hash functions. It runs on existing hardware.
The term is sometimes confused with quantum cryptography (QKD), which uses the physical properties of light to distribute keys via dedicated fibre. PQC is purely software-based and integrates into TLS, IPsec, SSH, PKIs and HSMs without requiring special optical infrastructure. This compatibility is why it has been chosen as the migration path by NIST, Germany's BSI and FINMA.
You will also come across the terms 'quantum-safe' and 'quantum-resistant', as well as 'quantum-resistant encryption'. These terms all describe mechanisms whose security is not reduced by any known attack, whether classical or quantum.
What FINMA Guidance 05/2026 says
FINMA Guidance 05/2026, published on 9 July 2026, is based on a survey of 60 Swiss financial institutions. It recommends that senior management approve a PQC roadmap by mid-2027, and states that FINMA intends to actively monitor this area and give it greater weight in its supervision.
The survey reveals a structural lag: according to the results published by FINMA on 9 July 2026, 72% of the institutions surveyed have not planned or started any measures, and only 8% have a concrete roadmap. At the same time, 76% of respondents attach high or very high value to a cryptographic inventory, and 73% consider crypto-agility important or very important. The central finding of the Guidance is the gap between risk awareness and action.
FINMA recommends that supervised institutions address the following seven points:
- Have a PQC strategy approved by senior management.
- Draw up a roadmap with concrete milestones, to be in place by mid-2027 at the latest.
- Conduct a risk analysis that explicitly includes the 'Harvest Now, Decrypt Later' scenario.
- Build an inventory of cryptographic usage covering all applications and infrastructure.
- Prioritise the protection of critical data according to how long it must remain confidential.
- Integrate crypto-agility into architectures and procurement.
- Assess PQC requirements for external service providers and include them in contracts.
The analysis covers applications and infrastructure that are operated in-house, outsourced, or consumed as a service (SaaS or cloud). FINMA states that it intends to actively monitor this topic and give it greater weight in its ongoing supervision of institutions.
Why do quantum computers pose a threat to today's cryptography?
A cryptographically relevant quantum computer would run Shor's algorithm, which can factor large integers and solve the discrete logarithm problem in polynomial time. This would break RSA, Diffie–Hellman, and ECC. While Grover's algorithm only halves the security of symmetric encryption, this can be compensated for by moving to AES-256 and hashes of 384 bits or more.
No such machine exists today, and it is impossible to predict “Q-Day”. FINMA stresses this point precisely: uncertainty about the date does not justify inaction because migrating to a new cryptosystem across a large organisation takes years, not quarters.
The Harvest Now, Decrypt Later (HNDL) risk already exists
In the HNDL scenario, encrypted traffic is intercepted and stored today to decrypt it once quantum capability becomes available. Therefore, any RSA or ECDH key exchange captured in 2026 is potentially exposed, regardless of how robust the subsequent symmetric encryption is. FINMA Guidance 05/2026 therefore recommends including this scenario explicitly in the risk analysis.
Rather than asking “when will Q-Day arrive?”, the right question is “how long does this data need to stay confidential?”. Patient records, patents, infrastructure contracts, and industrial control communications retain their value for ten to thirty years — well beyond the most cautious estimates for the quantum threat.
Post-quantum algorithms: NIST standards and main candidates
- NIST standard FIPS 203 ML-KEM (formerly CRYSTALS-Kyber) for key establishment;
- NIST standard FIPS 204 ML-DSA (formerly CRYSTALS-Dilithium) and
- NIST standard FIPS 205 SLH-DSA (formerly SPHINCS+) for signatures.
In August 2024, NIST approved three standards: FIPS 203 ML-KEM (formerly CRYSTALS-Kyber) for key establishment and FIPS 204 ML-DSA (formerly CRYSTALS-Dilithium) and FIPS 205 ML-DSA (formerly SPHINCS+) for signatures. Falcon followed as FIPS 206 (FN-DSA), and in March 2025, HQC was selected as a backup encapsulation mechanism.
NIST's standardisation process, which began in 2016, saw several candidates eliminated along the way, including SIKE, which was compromised by a classical attack in 2022. This history illustrates why the authorities recommend diversity across mathematical families, and why crypto-agility is becoming an architectural requirement.
In practice, 2026 deployments mainly rely on ML-KEM in hybrid mode, combined with ECDH within the same TLS handshake. Several browsers and CDNs already enable X25519MLKEM768 by default. If a gateway or application proxy rejects these connections, this is an early sign of cryptographic debt.
The differences between post-quantum and classical cryptography
Classical asymmetric cryptography relies on factorisation and the discrete logarithm, using short keys and mature libraries. In contrast, post-quantum algorithms are based on lattices, hashes or codes. They produce much larger keys and signatures, and require protocols, certificates and network performance to be reviewed.
These size differences are far from trivial for critical infrastructure. For example, an industrial controller or smart meter designed for frames of a few hundred bytes will not handle an ML-DSA certificate chain without a firmware update – or even replacement of the equipment. This is one reason why the energy and transport sectors should start their cryptographic assessments before the services sector, whose renewal cycles are shorter.
Three common misconceptions about post-quantum cryptography
The most common misunderstandings concern the supposed replacement of AES, the confusion between QPUs and GPUs, and the belief that a vendor update is sufficient. In all three cases, the technical reality leads to the same conclusion. PQC is an architecture programme, not a software patch.
PQC does not replace AES. Shor's algorithm does not break AES or the SHA-2 or SHA-3 hash functions. While Grover's algorithm theoretically halves their security, this can be compensated for by moving to AES-256 and hashes of 384 bits or more. PQC only targets the asymmetric layer, including key exchange, signatures, certificates and authentication. A post-quantum TLS session continues to encrypt application data using AES-GCM or ChaCha20.
A QPU does not replace a GPU. Quantum processors excel at a narrow class of problems, including factorisation and molecular simulation. However, it offers no advantage for model training, graphics rendering or everyday vector computing. While quantum computing does not threaten data centres as such, it does threaten one specific component of their security.
Vendor updates alone are insufficient. Vendors will deliver compatible libraries. However, these updates do not address internally issued certificates, OT equipment that is no longer supported by its manufacturers or supplier contracts that were signed without a crypto-agility clause. According to FINMA's July 2026 survey, 72% of Swiss financial institutions have not planned or started taking any measures, which highlights the risk of being dependent on vendors' timelines.
Quantum Readiness Assessment and Migration Programme
The quantum readiness approach is structured in four steps:
- Governance and scoping
- A cryptographic inventory in the form of a CBOM
- Risk analysis with HNDL prioritisation
- A roadmap with milestones and hybrid pilots
FINMA Guidance 05/2026 recommends that supervised institutions have a roadmap approved by senior management by mid-2027.
Building the cryptographic inventory (CBOM)
The first challenge is not replacing an algorithm, but identifying its location. A CBOM lists algorithms, protocols, certificates, keys, libraries, and dependencies, and maps these to applications and business services. According to FINMA's July 2026 survey, 76% of institutions attach high or very high value to this inventory and 73% consider crypto-agility to be important or very important. However, at this stage, these two priorities rarely translate into concrete projects.
The CBOM must cover systems that are operated in-house, outsourced, or consumed as SaaS, in line with the scope that FINMA recommends institutions analyse. Key questions to address include: which algorithms and protocols are used; on which systems; with which certificates, keys, and libraries? Which applications depend on suppliers that do not yet offer a PQC migration path? Which data must remain confidential for more than ten years?
In SPIE ICS's approach, this inventory is not a one-off deliverable. Cryptographic Posture Management involves continuously collecting sources of cryptographic information (e.g. network scans, PKI, code repositories, CMDB and supplier reports), correlating them, and measuring the gap with the target policy. The organisation can then move from a collection of disparate cryptographic components to a measurable posture, as explained on our page dedicated to the quantum transition and post-quantum cryptography for the financial sector. Link ((quantum transition and post-quantum cryptography for the financial sector.))
A migration sequence built around public milestones
Every organisation's timeline is shaped by two public milestones. The first is FINMA's mid-2027 deadline, by which Swiss financial institutions must have a roadmap approved by senior management. The second is the draft NIST IR 8547, which plans to deprecate algorithms offering 112 bits of security (RSA-2048 and ECC-224) by 2030, and to disallow them by 2035. These two deadlines define the timeframe for action for all organisations, whether they are supervised by FINMA.
The logical sequence is as follows:
- Appoint an executive sponsor and define the scope.
- Build the CBOM, starting with long-term confidentiality flows exposed to HNDL.
- Carry out the risk analysis and map blocking suppliers.
- Deploy hybrid TLS and VPN pilots and renew internal PKIs.
- Embed crypto-agility requirements in procurement and architectures.
- Align the retirement of RSA and ECC with the NIST IR 8547 timeline.
Examples by type of organisation
For an industrial company running ICS/SCADA networks, the priority lies with remote management tunnels and equipment with a lifespan of more than fifteen years. In this case, SLH-DSA is ideal for signing long-lived firmware. For a service organisation, the focus is on internal PKI, remote access, and cloud contracts. A crypto-agility clause here avoids costly renegotiation. For public institutions and hospitals, the legal retention period for personal data means that HNDL must be addressed first, even before performance considerations.
Insights from the conference Quantum Transition: From Awareness to Action illustrate this shift from diagnosis to programme.
Frequently asked questions about post-quantum cryptography
What exactly is post-quantum cryptography?
Post-quantum cryptography is a set of key exchange and digital signature algorithms designed to withstand quantum computers while running on classical processors. The reference standards are ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), which were published by NIST in August 2024.
Is PQC a complete replacement for AES and current algorithms?
No, PQC replaces only the asymmetric mechanisms vulnerable to Shor's algorithm, namely RSA, Diffie-Hellman and elliptic curves. AES-256 and the SHA-2 or SHA-3 hash functions remain secure against Grover's algorithm and continue to encrypt application data.
What does FINMA recommend regarding PQC?
FINMA Guidance 05/2026, published on 9 July 2026, recommends that each institution have a PQC roadmap approved by senior management by mid-2027. A survey of 60 Swiss financial institutions shows that 72% have neither planned nor started any measures, while only 8% have a concrete roadmap. FINMA has stated that it intends to step up its supervision in this area.
What quantum attacks threaten classical cryptography?
Shor's algorithm breaks RSA, Diffie-Hellman and ECC by solving factorisation and the discrete logarithm problem in polynomial time. Grover's algorithm speeds up exhaustive key search against symmetric ciphers, halving their effective security. The Harvest Now, Decrypt Later (HNDL) scenario applies these future attacks to data captured today.
How can I assess the quantum readiness of my ICT infrastructure?
The assessment is based on a cryptographic inventory (CBOM), which is mapped to business services. It also involves classifying data according to the required confidentiality period, analysing supplier dependencies, and measuring architectural crypto-agility. According to FINMA's July 2026 survey, 76% of financial institutions recognise the high value of this inventory. The outcome is a quantum readiness score and a prioritised roadmap.
Which organisations are leading the adoption of post-quantum cryptography?
The US National Institute of Standards and Technology (NIST) defines the relevant standards (FIPS 203, 204, 205 and 206). Germany's BSI and France's ANSSI publish recommendations for hybrid deployment. The IETF is integrating PQC into TLS and IPsec. The PQCA (Post-Quantum Cryptography Alliance) coordinates open-source implementations. In Switzerland, FINMA establishes the supervisory framework through Guidance 05/2026, issued on 9 July 2026.
Conclusion: Start by understanding your cryptographic posture.
Three decisions will enable you to begin the transition without waiting for an emergency. Appoint an executive sponsor and define a clear scope, as FINMA recommends that a strategy be approved at the highest level by mid-2027. Build a CBOM and maintain it over time because no migration can be planned without knowing your level of dependence on cryptography. Prioritise according to how long data must be protected, rather than according to a hypothetical Q-Day. This is the right starting point, regardless of any quantum deployment timeline.
SPIE ICS supports banks, industrial companies, and public institutions in assessing their quantum exposure and developing their PQC transition programme. To discuss your situation and receive an initial assessment of your quantum readiness, contact SPIE ICS's cybersecurity experts.