5 steps organizations can take to prepare for the post-quantum era

For years, “Q-Day,” or the moment quantum computers break modern encryption, has been treated as a distant problem. But thinking of quantum as a future, singular event is a mistake.

The timeline is accelerating rapidly. The White House Executive Order 14412, issued this summer, mandates sweeping federal upgrades to post-quantum standards by the end of 2030. The Treasury Department’s recently announced Quantum-Readiness Task Force also highlights the systemic risks already present in the financial sector. The push extends well beyond the U.S., with the EU establishing a coordinated roadmap for post-quantum cryptography (PQC) adoption, while the U.K. has outlined its own migration milestones through 2035.

But the real threat isn’t that quantum suddenly flips a switch. Hackers are already preparing for that moment. Through “harvest now, decrypt later” (HNDL) attacks, bad actors are collecting encrypted traffic today to break it tomorrow. If your sensitive data has a shelf life of more than a couple of years, your organization is already carrying cryptographic debt. The post-quantum cryptography (PQC) era started the moment adversaries began saving your data.

Boards, CEOs, CIOs, and CISOs can treat quantum readiness as an enterprise risk rather than a niche security project. That commitment can lead to a real budget, realistic deadlines, and regular progress reviews.

There’s no need to rebuild your entire tech stack on day one. The first step is establishing who’s driving the transition. Preparing for PQC should start with a small cross-functional team that owns your cryptography. Its job is to find cryptographic debt, set policy, push vendors, and get you to quantum-safe standards before attackers get your data. 

ZeroTier outlines five steps organizations can take to prepare for the post-quantum era, offering practical tips for assessing risks, addressing cryptographic gaps and planning the transition to quantum-safe standards.

5 Steps to Take Today 

You don’t need to tackle everything at once, but you do need a clear plan. Here are five practical steps to start building your quantum readiness.

1. Build out your Cryptographic Bill of Materials (CBOM). A CBOM is a complete inventory of the places you use cryptography, from applications and devices to network connections, certificates and third-party systems. Document which algorithms are in use, where they’re deployed and what they’re protecting. You can’t migrate what you can’t see. A clear inventory is the first step toward knowing what needs to change.

2. Layer on a Quantum Bill of Materials (QBOM). Use your CBOM to identify which systems rely on quantum-vulnerable cryptography. Then rank them by risk and urgency. Start with high-value assets (HVAs), critical infrastructure and sensitive data that needs to stay protected for years. Consider how long that data must remain confidential, how exposed it is today and how difficult each system will be to upgrade. Not everything needs to move at once, but your highest-risk systems shouldn’t be last in line.

3. Name one accountable leader. Quantum readiness is a leadership responsibility and shouldn’t be an IT afterthought. Assign one person to own the transition, coordinate across IT, security, compliance and procurement, and keep progress on track. That leader should have the authority to set priorities, secure budgets and hold teams accountable. Without clear ownership, even the best migration plans can stall before they get started.

4. Don’t create a bespoke PQC project. Avoid the urge to treat this as a massive, disruptive rip-and-replace. Piggyback directly on your existing tech lifecycle, i.e., routine software updates, cloud migrations, and scheduled hardware refreshes. When cryptographic upgrades are built into work that’s already funded and underway, security is actually deployed.

5. Draft your migration plan now. Don’t wait for regulatory deadlines to force your hand. Build a practical roadmap that outlines which systems need to transition, what changes are required, and when each upgrade should happen. Set clear milestones, identify dependencies, and work with vendors to understand their PQC readiness. Prioritize your highest-risk systems and build quantum-safe upgrades into your existing technology refresh cycles. 

Start with the Connections That Matter Most 

Quantum readiness doesn’t require changing everything overnight. As you build your CBOM and QBOM, pay close attention to the connections carrying your most sensitive data. VPN tunnels, site-to-site links and remote access paths all carry information that could be exposed to HNDL attacks. Securing these connections is a critical part of any PQC migration strategy.

Look for a quantum-secure software-defined networking platform that offers centralized visibility, identity-based access control and policy enforcement across devices, clouds and sites, without requiring a complete rip-and-replace of your infrastructure. Prioritize solutions that support NIST-standardized post-quantum cryptography, including hybrid key exchange combining ML-KEM-1024 (FIPS 203) with classical ECDH P-384 as well as cryptographic modules validated under FIPS 140-3. The goal is to protect sensitive traffic now while maintaining the flexibility to adapt as cryptographic standards and security requirements evolve.

This story was produced by ZeroTier and reviewed and distributed by Stacker.