What Is a Post-Quantum Migration Assessment?
A post-quantum migration assessment is a structured evaluation of an organization's cryptographic posture. It identifies where quantum-vulnerable cryptography is used, scores the associated risk, and produces a prioritized migration roadmap. It is the starting point recommended by CISA, NSA, and NIST before any migration work begins.
Without an assessment, organizations face two risks: wasting resources migrating low-priority systems first while high-priority systems remain exposed, or missing entire categories of cryptographic usage because they were not visible in the initial inventory. A systematic assessment prevents both.
Assessment Scope
A thorough assessment covers the organization's full attack surface, not just its own-developed software. Cryptographic usage is distributed across network protocols, purchased software, cloud services, firmware, hardware security modules, and supply-chain dependencies.
Network and TLS
TLS configurations for all servers, load balancers, and APIs. Certificate inventory covering all certificates in use, their signature algorithms, validity periods, and issuing CAs.
Application code
All codebases for uses of cryptographic libraries, direct algorithm calls, and embedded key material. Includes internally developed code and incorporated open-source packages.
Firmware and embedded systems
Firmware cryptographic implementations in devices that cannot easily be updated over the network. Often the most difficult to migrate and requires the longest lead time.
Supply chain
Cryptographic properties of third-party software, cloud services, hardware, and counterparty APIs. Migration cannot be complete if upstream or downstream dependencies remain quantum-vulnerable.
PKI and certificates
Certificate issuance infrastructure, HSMs used for signing, trust anchors, and revocation mechanisms. This is often the most complex part of the migration because it affects every service that relies on TLS.
Risk Analysis
The risk analysis phase scores each cryptographic asset against two primary dimensions: data sensitivity (the value of the information protected) and data lifetime (how long the information must remain confidential). Systems protecting data that must remain confidential for years or decades face immediate HNDL exposure.
System criticality is a secondary dimension. A highly critical system protecting ephemeral data (such as a payment authorization where the transaction completes in milliseconds) has different risk characteristics than a less critical system protecting long-lived personal data. Both factors are needed to assign migration priority.
Regulatory and contractual obligations form a third input. Organizations operating National Security Systems must comply with NSA CNSA 2.0. Federal civilian agencies must comply with OMB M-23-02. Organizations in regulated industries may face additional requirements from sector-specific guidance.
Assessment Deliverables
A completed assessment produces a Cryptographic Bill of Materials (CBOM): a structured inventory of every cryptographic algorithm, key size, certificate, and library in use. The CBOM is a living document that should be maintained and updated as the organization's systems change.
The risk-scored inventory assigns each asset a priority tier. Tier 1 assets require immediate migration attention because they protect long-lived sensitive data. Tier 2 assets are scheduled based on system criticality and operational impact. Tier 3 assets are scheduled in later migration phases.
The prioritized migration roadmap translates the risk tiers into a sequenced plan. It identifies which systems to migrate first, what vendor and supply-chain dependencies must be resolved, what architecture changes are needed, and what the expected timeline looks like for each phase.
From Assessment to Migration
The assessment output feeds directly into migration planning. Architecture decisions about hybrid deployment, certificate replacement, and supply-chain coordination are made using the CBOM and risk scores. The roadmap provides the sequencing.
Reassessment should be planned at regular intervals, typically annually, or whenever significant infrastructure changes are made. New systems, new vendors, and acquired organizations all introduce new cryptographic components that must be added to the CBOM and assessed.