Embracing the Three ‘R’s of Quantum

By Steven Sim, CGEIT, CISA, CRISC, CISM, CDPSE; Member of ISACA Emerging Trends Working Group; Chair, OT-ISAC Executive Committee

Quantum resistance, resilience and readiness need to be considered across not just technologies but also process and people across enterprises. This article explains both the backdrop and the necessary steps to take for the next two years.

Elevated Threat Landscape: Rapid developments since 2023

Two years ago, I wrote an article for the ISACA Now Blog on Quantum Resistant Cryptography. In the blog, I shared the need for crypto-agility, the need to protect against harvest-now-decrypt-later (HNDL) attacks and developments in quantum-resistant cryptography. 

CISA (Cybersecurity and Infrastructure Security Agency) had recommended RSA2048 and ECC256 be deprecated by 2030 and disallowed after 2035. In the blog, I summarized CISA’s recommendations for an enterprise’s post-quantum cryptography (PQC) roadmap in seven steps, focusing on risk assessment, identifying systems with quantum-vulnerable ciphers and prioritizing cryptographic transitions.

Two years have since passed and much has changed in the world of quantum.  It used to be a distant threat with Quantum Day (Q-Day) slated to be around 2035-2037 for available cryptographically relevant quantum computers (CRQC). This timeline, however, has been brought forward to as early as 2030 in more recent predictions. 

New research has shown that RSA2048 encryption could be cracked using a one-million-qubit system by 2030, 20 times faster than previous estimates. Such a system running for one week can possibly crack RSA2048 encryption. This is also 20 times fewer qubits than the previous 2019 estimate according to Google’s research. While current systems still operate with only hundreds of qubits, Google’s research shows that technical breakthroughs with more efficient algorithms, advanced error correction, and optimized quantum operations, are lowering the threshold for cryptographic threats. Besides Google, Microsoft also announced Majorana 1 as the first quantum processor to use more stable topological qubits in Feb 2025. Microsoft believes its quantum processor can eventually scale to one million qubits on a single chip.

Such advancements stressed the need to fast-track transitions for long-lived and high-risk cryptographic systems. NIST’s recommended timeline for deprecating vulnerable algorithms by 2030 appears more necessary than ever. 

Counter-measures: Standards and Guidelines 

The saving grace is that PQC standards were finalised in 2024 with NIST releasing three highly anticipated post-quantum cryptography (PQC) algorithm standards that were built to withstand cyberattacks from quantum computers. Beyond PQC standards, other technologies including quantum key distribution (QKD) and quantum random number generation (QRNG) have also been touted to help mitigate the risk posed by quantum to present day public key cryptography. 

Industry associations have also taken heed and released associated guidance. For instance, as recent as June 2025, the International Association of Ports and Harbours (IAPH) has released Cyber Resilience Guidelines for Emerging Technologies in the Maritime Supply Chain with a focus on the impact of quantum with an associated advisory.

Counter-measures: Technological Developments

The Internet Engineering Task Force (IETF) has also enhanced Transport Layer Security (TLS) 1.3 which also uses the affected public-key cryptographic algorithms like RSA and ECC used in handshakes. They have integrated PQC and quantum safe methods into TLS. In fact, some implementations already use PQC-enabled TLS 1.3 connections. For example, Cloudflare reports nearly 2% of their TLS 1.3 connections use PQC earlier in 2024. 

Both technology and cybersecurity companies have also released solutions. For instance, Google has also implemented NIST-approved ML-KEM across Chrome and internal systems, establishing a benchmark for securing web traffic, VPNs, and messaging platforms, and Checkpoint has released quantum-resistant VPN solutions. Among many messaging applications, Signal has also deployed PQC in recent years.

Counter-measures: Are processes in place and people aware?

While the industries at large are seeing increased maturity in standards and guidance, what is the level of organizational awareness?

In the World Economic Forum’s Global Cybersecurity Outlook 2025 released in January 2025, it mentioned the results of a focus group poll that as many as 40% of organizations indicated that they have started to take proactive steps by conducting risk assessments to understand the quantum threat. 

ISACA also conducted a more recent poll to measure the pulse of the wider community on quantum concerns. Results from the Quantum Pulse Poll published in April 2025 indicated that only 35% of the community have a good understanding of quantum computing’s capabilities yet 62% are worried that quantum computing will break today’s Internet encryption. Additionally, 57% say quantum computing will create new business risks and only 7% understand NIST’s post-quantum standards. There appears to be a worrisome skills gap in this space. 

Cryptographic upgrades in systems can span years; enterprises would require strategic planning now. Because software teams often lack understanding of cryptographic libraries and hash functions, early inventory, performance testing, and system mapping is required for achieving a pragmatic PQC migration roadmap.

Not to sound like a broken record – don’t panic, but start planning now

Indeed, a successful transition begins with a clear quantum-readiness strategy, and the need for organizations to begin their journey today. Cybersecurity teams need to take steps including cryptographic audits to identify the most vulnerable systems. Prioritized transition plans should focus on high-value assets containing sensitive long-term data. 

Engaging technology vendors about their post-quantum implementation roadmaps is also equally important, as does testing quantum-resistant algorithms for operational compatibility within existing infrastructure.

Beyond the rapid advancements during the last two years, more advances are expected. In an environment of rapid changes in technological advancements, enterprises with the ability to stay crypto-agile are better geared to adapt to these rapid changes. I would akin Q-day to Y2K, where massive efforts had to be put in place to ensure a smooth transition. Y2K had shown us that enterprises that plan ahead had fewer hiccups and lessened business impact if any.

Embrace quantum resistant cryptography:

Have a deepened awareness and understanding of quantum-resistant technologies.

• Learn about the algorithms and approaches, understanding that symmetric ciphers of suitable key lengths (e.g. symmetric AES-256) and asymmetric ciphers for key exchanges (e.g. Module-Lattice-Based Key Encapsulation Mechanism Standard (Crystals-Kyber)) are quantum-safe.
• Understand that adoption of TLS 1.3 would eventually allow for the selection of PQC algorithms which may include ML-KEM (Hyber) and ML-DSA (Dilithium).

Put quantum resilience processes in place:

Put in place processes to plan out the migration in a risk-optimal and prioritized manner. It is not just about protection and deployment of PQC, but also about addressing the ability to detect, contain and recover from a quantum cybersecurity incident and the ability to manage crisis as a result of such incidents.

• Establish the cryptographic inventory. Take inventory of the most sensitive and critical datasets that must be secured for extended time.
• Take inventory of systems using cryptographic technologies to facilitate a smooth transition in future. Determining which ones are at risk by putting in place relevant impact and risk assessments.
• Identify acquisition, cybersecurity, data security standards that require updating.
• Identify where and purpose public key cryptography is used and mark as quantum vulnerable.
• Prioritize systems for cryptographic transition based on functions, goals, and needs.
• Develop plan for systems transitions upon publication of post-quantum cryptographic standard.

Ensure quantum readiness:

Finally, quantum readiness entails putting in place both assurance and maturity processes, including cryptographic audits and a maturity program that steps up to the right level with underlying crypto-maturity. 

• Process maturity can be established for by utilizing models such as ISACA’s CMMI. There are also targeted maturity models for specific quantum-resilient processes. For instance, DigiCERT has established a PQC Maturity Model for the establishment of PQC. 
• Being quantum ready entails being at the appropriate level of people, process and technology maturity. Many organizations may be at the PQC Novice level right now, but they need to minimally shift their maturity towards Apprentice level.
• Level of crypto-agility deployed also affects maturity and therefore readiness.

Therefore, the least we can do is to embrace the three ‘R’s of quantum, understand and get trained on quantum-resistant technologies, put in place quantum-resilient processes and elevate quantum-readiness across the enterprise. 

Hackers say HNDL (Harvest Now Decrypt Later). I say RANTS (Readiness – Assess Now Transit Soon).