The NCSC recommends that UK organisations finish discovering where they use vulnerable encryption, and have a migration plan, by 2028. Most firms haven't started. Find out where you stand in 15 minutes.
Attackers are already collecting encrypted data so they can decrypt it once quantum computers are powerful enough. Security people call this "harvest now, decrypt later". If your firm holds data that needs to stay private for five, ten or twenty years, such as client files, health records, contracts or financial data, that risk exists now.
Switching to post-quantum encryption is a long job, because cryptography is buried in software, suppliers, devices and contracts. That is why the NCSC has set out a timeline that starts with simply finding out what you have.
Set migration goals, complete a full discovery of where you rely on cryptography, and build an initial plan.
Carry out the highest-priority migrations and refine the plan into a full roadmap.
Complete migration to post-quantum cryptography across all systems, services and products.
Source: NCSC, Timelines for migration to post-quantum cryptography. These dates are NCSC guidance, not law.
Banks, insurers, the NHS and defence primes are starting to ask suppliers about post-quantum plans in security questionnaires and tenders. A clear answer wins work.
The FCA, the Bank of England and, for EU-facing firms, DORA all expect cryptographic risk to be managed. Post-quantum readiness is becoming part of that conversation.
Insurers increasingly ask how well you know your security estate. A cryptography inventory is a concrete thing you can show them.
Firms that start in 2030 will compete for the same small pool of specialists. Firms that map their estate now can migrate on their own schedule.
Under UK GDPR you must keep personal data secure for as long as you hold it. If it will still be sensitive in ten years, it needs protecting against what attackers can do in ten years.
A plain-English checklist you can fill in without technical help. It shows how far you are from the NCSC's 2028 milestone and what to do first.
Especially mid-sized firms without an in-house cryptography team, in sectors where clients and regulators will ask first.
Payments, lending and wealth platforms answering to the FCA and banking partners.
Firms holding privileged client files and signed agreements for decades.
Suppliers handling patient records that must stay private for a lifetime.
Subcontractors who will be asked by primes to show a plan.
PQC Readiness is run by CryptoShift, and helps UK firms take the first step on the NCSC timeline: understanding where they stand. We don't sell software and we don't need access to your systems.
When your results show you need hands-on help, we introduce you to a vetted UK specialist who does post-quantum migration work. The checklist and the introduction are free to you.
Email is the best way to reach us. We reply within one working day.