Why migrate to post-quantum cryptography now?
Short answer: because the data you encrypt today is already being collected by well-resourced actors who intend to decrypt it once a sufficiently powerful quantum computer exists. That is the harvest-now-decrypt-later threat. The Canadian Centre for Cyber Security has required federal departments to file a migration plan since April 2026, to migrate high-priority systems by the end of 2031, and everything else by 2035.
The asymmetric cryptography protecting your communications today (RSA, Diffie-Hellman, elliptic curves) rests on mathematical problems a large enough quantum computer would solve in hours rather than billions of years. Nobody knows exactly when that machine will exist. Everybody knows that encrypted archives intercepted today will still be sensitive ten years from now.
That is the crux for a Canadian business: a medical record, an M&A contract, a trade secret or a legal file has a confidentiality lifespan that far exceeds the quantum horizon. If your data must stay secret beyond 2035, it is already exposed.
What the Canadian roadmap requires
The Canadian Centre for Cyber Security, together with Shared Services Canada and the Treasury Board Secretariat, published roadmap ITSM.40.001 for migration to post-quantum cryptography. Three milestones structure the schedule:
April 2026 : submit an initial migration plan, then report annually
End of 2031 : migration complete for high-priority systems
End of 2035 : migration complete for all remaining non-classified systems
The scope covers infrastructure managed internally as well as through third parties, including cloud providers. This is the point most organizations underestimate: your post-quantum posture depends on your suppliers' posture.
These obligations formally target federal departments. But they propagate through contracts: if you sell to the federal government, or supply a critical infrastructure operator, the question will show up in your next tender and your next vendor risk assessment.
The standardized algorithms to know
NIST has standardized the first quantum-resistant algorithms, and Canadian guidance follows them:
ML-KEM (FIPS 203) : key encapsulation, replacing RSA and ECDH key exchange
ML-DSA (FIPS 204) : digital signatures, general purpose
SLH-DSA (FIPS 205) : hash-based signatures, for cases requiring different security assumptions
Good news: symmetric cryptography (AES-256) and modern hash functions (SHA-384, SHA-3) remain considered robust with adequate key sizes. The urgency is on the asymmetric side.
Four steps to a realistic migration
1. Cryptographic inventory
You cannot migrate what you cannot see. The inventory must answer three questions for every system: which algorithm, which key size, and how long the protected data must remain confidential. Focus areas: TLS certificates, VPN and IPsec tunnels, code signing, database encryption, EDI exchanges with partners, embedded and OT systems, HSM hardware.
This inventory is the longest deliverable to produce (expect several months for a mid-sized organization) and the most useful, because it also feeds privacy compliance work and insurance audits.
2. Prioritize by confidentiality lifespan
Rank assets with a simple formula: required confidentiality lifespan plus estimated migration time. If the sum exceeds the likely quantum horizon, the asset is a priority. Health data, HR records, intellectual property and legal archives naturally rise to the top.
3. Cryptographic agility
The intermediate goal is not to swap everything at once : it is to make your systems capable of changing algorithms without a rewrite. That means centralizing certificate management, eliminating hard-coded algorithms in applications, and contractually requiring suppliers to publish their post-quantum roadmap.
4. Hybrid deployment, then cutover
Recommended practice is to deploy hybrid suites first, combining a classical and a post-quantum algorithm so that security holds even if one of them breaks. Major browsers and TLS libraries already support these modes.
Mistakes to avoid
Waiting for a regulatory deadline: the harvest-now threat operates today, regardless of the legal calendar
Treating this as a purely technical project: it is first a data governance and third-party management exercise
Forgetting OT and embedded systems: industrial equipment has 15-to-25-year lifecycles and is often impossible to update
Neglecting code signing: an attacker able to forge a legitimate signature compromises your entire software distribution chain
Conclusion
Post-quantum migration is not a 2035 topic: it is an inventory topic for 2026 and an architecture topic for 2027. Organizations that start now move at the pace of their normal refresh cycles; those that wait will pay the price of an emergency migration. ITCS Group performs cryptographic inventories, assesses supplier post-quantum exposure and builds sector-appropriate migration roadmaps. Contact us for an initial assessment.
Sources
ITSM.40.001, Roadmap for the migration to post-quantum cryptography : Canadian Centre for Cyber Security
FIPS 203, 204 and 205 : NIST post-quantum cryptography standards
Migration to Post-Quantum Cryptography : NIST NCCoE