MITRE Publishes Post-Quantum Cryptography Migration Roadmap

In a significant development for cybersecurity preparedness, MITRE has published a comprehensive Post-Quantum Cryptography (PQC) Migration Roadmap in May 2025. This strategic document aims to guide organizations in transitioning their cryptographic systems to withstand the emerging threat of quantum computing. While experts estimate that cryptographically-relevant quantum computers (CRQCs) may still be 10 to 20 years […] The post MITRE Publishes Post-Quantum Cryptography Migration Roadmap appeared first on Cyber Security News.

Jun 2, 2025 - 13:40

MITRE Publishes Post-Quantum Cryptography Migration Roadmap

In a significant development for cybersecurity preparedness, MITRE has published a comprehensive Post-Quantum Cryptography (PQC) Migration Roadmap in May 2025.

This strategic document aims to guide organizations in transitioning their cryptographic systems to withstand the emerging threat of quantum computing.

While experts estimate that cryptographically-relevant quantum computers (CRQCs) may still be 10 to 20 years away, the roadmap emphasizes that organizations must begin planning their migration now to ensure successful implementation before these powerful machines can break current encryption standards.

The roadmap, developed by the Post-Quantum Cryptography Coalition (PQCC), addresses a particularly concerning vulnerability known as “harvest now, decrypt later,” where adversaries collect encrypted data today with plans to decrypt it once quantum computing capabilities mature.

This threat poses serious risks to sensitive information with long-term value, potentially compromising critical infrastructure, personal data, and organizational secrets even if they appear secure under current encryption methods.

PQCC analysts identified four critical categories that organizations must navigate during their migration journey: Preparation, Baseline Understanding, Planning and Execution, and Monitoring and Evaluation.

“The implementation of categories and activities will look different organization-to-organization,” researchers noted, acknowledging that components of the roadmap may be implemented concurrently or in a staggered order depending on organizational needs and resources.

The document presents a tailorable approach to migration, recognizing that organizations vary widely in their data sensitivity, available information about their assets, and budgets for potentially significant software and hardware updates.

It offers concrete activities and desired outcomes for each category, helping organizations track their progress throughout the transition process.

For organizations handling highly sensitive data, the roadmap classifies them as “urgent adopters,” while others with lower risk profiles are categorized as “regular adopters.”

Model timeline for determining the urgency of PQC migration (Source – PQCC)

This classification helps organizations determine appropriate timelines and resource allocation for their PQC migration efforts.

Preparation: The Critical First Step

The roadmap’s first category, Preparation, lays the groundwork for a successful migration.

This phase involves organizations obtaining an overview of their PQC migration aims, assigning a dedicated migration lead, identifying necessary stakeholders, and aligning these stakeholders through strategic messaging.

The roadmap recommends that organizations begin by assessing whether they should start the migration process immediately or follow a later timeline based on their specific risk profile.

During this preparation phase, organizations must evaluate their attack surface, the types of systems they operate, the criticality and sensitivity of data handled, and interdependencies with other organizations.

The roadmap emphasizes the importance of appointing an individual or team to monitor and progress the PQC migration, someone well-positioned to coordinate across different areas within and outside the organization.

Communication plays a crucial role in this initial phase, with the roadmap recommending that organizations develop strategic messaging that clearly articulates the value and purpose of PQC migration to key stakeholders.

This includes identifying a return on investment, measuring impact, and understanding financial and operational requirements, all while establishing early engagement with system vendors and operators to scope migration needs effectively.

Celebrate 9 years of ANY.RUN! Unlock the full power of TI Lookup plan (100/300/600/1,000+ search requests), and your request quota will double.

The post MITRE Publishes Post-Quantum Cryptography Migration Roadmap appeared first on Cyber Security News.