Our approach
A structured five-stage model aligned to ASD's LATICE guidance, adapted into plain consulting language for enterprise discovery, quantum risk assessment and transition planning.
The five-stage approach
Locate
Find and document where traditional asymmetric cryptography is used across cloud services, applications, APIs, certificates, hardware and supplier dependencies.
- Initial inventory of where legacy asymmetric cryptography is in use
- Documented scope across internal, external and vendor-managed systems
- Visibility of hidden dependencies, certificates and key flows
- Working picture of where more detailed technical validation is needed
- Foundation for the next stages of risk assessment and prioritisation
Assess
Understand the value and sensitivity of systems and data protected by current cryptography, along with legal, regulatory and operational exposure.
- Risk view based on data sensitivity and business criticality
- Identification of systems protecting high-value or long-life data
- Assessment of regulatory, contractual and operational implications
- Management perspective on the cost of delay
- Clearer understanding of likely quantum risk concentration points
Triage
Prioritise systems for transition by balancing sensitivity, external exposure, complexity, lifecycle and business importance.
- Ranked list of systems or domains that should move first
- Practical segmentation into near-term, medium-term and later effort
- View of dependencies that may constrain sequencing
- Basis for roadmap decisions and investment timing
- Reduced confusion over where to start
Implement
Plan and support transition activities, including vendor coordination, software updates, architecture decisions, testing and staged change.
- Transition design principles and implementation options
- Technology and vendor engagement actions
- Testing, rollback and release considerations
- Practical implementation plan for priority areas
- Improved crypto agility to support future standards updates
Communicate and educate
Equip leaders, architects, cyber teams and product teams with the awareness and guidance needed for a sustainable post-quantum transition programme.
- Shared understanding of the problem and why it matters
- Leadership alignment on timing, investment and priorities
- Clearer communication across security, engineering and architecture teams
- Reduced confusion about terminology, standards and scope
- Better organisational readiness to govern long-running change
Australian Signals Directorate (ASD) recommended target milestones for becoming post-quantum cryptography safe:
By the end of 2026Refine the transition plan, confirm scope, prioritisation and governance, and prepare for execution.
By the end of 2028Transition critical and high-priority systems that carry the greatest data sensitivity or exposure.
By the end of 2030Complete the wider transition away from traditional asymmetric cryptography where feasible.