Our approach
A structured five-stage advisory model aligned to ASD's LATICE guidance. It gives leaders the evidence, priorities and governance needed to make confident readiness decisions.
From uncertainty to a practical plan
Our approach is designed for executive clarity first. It establishes what matters, where exposure sits and how to sequence action before an organisation commits to a wider transition programme.
Locate
Build initial visibility of where traditional asymmetric cryptography exists across applications, cloud services, APIs, certificates, hardware and supplier dependencies.
- Working inventory of important cryptographic touchpoints
- Documented scope across internal, external and vendor-managed systems
- Visibility of hidden dependencies, certificates and key flows
- Clear view of blind spots requiring deeper validation
Assess
Relate the technology view to business exposure: data sensitivity, confidentiality life, business criticality, regulatory context and the likely cost of delay.
- Risk view by platform, application and data type
- Identification of systems protecting high-value or long-life information
- Assessment of operational, regulatory and reputational implications
- Management-ready summary of material risk themes
Prioritise
Focus attention and investment where they will make the greatest difference, balancing sensitivity, exposure, complexity, lifecycle and business importance.
- Ranked systems and domains for action
- Near-term, medium-term and later transition horizons
- Dependencies that shape sequencing and investment timing
- Clear rationale for leadership and governance forums
Plan the transition
Prepare delivery teams for a measured transition through architecture guidance, supplier engagement, testing and staged change planning.
- Transition principles and implementation options
- Actions for technology owners and suppliers
- Testing, rollback and release considerations
- Crypto-agility principles that reduce future rework
Govern, communicate and educate
Equip leaders and delivery teams with a shared understanding of the risk, milestones, responsibilities and decisions needed for a sustainable programme.
- Leadership alignment on timing, investment and residual risk
- Clear communication across security, architecture and engineering
- Governance checkpoints for progress and dependencies
- Practical education that supports informed decisions
Plan to the Australian timeline
ASD recommends milestones that make early planning an executive priority, particularly for complex environments and long-life sensitive data.
By end of 2026Refine the transition plan, confirm scope, governance, risk tolerance and dependencies.
By end of 2028Commence transition for critical systems and data, especially where sensitivity and change complexity are highest.
By end of 2030Complete the broader transition away from traditional asymmetric cryptography and continue to validate the new posture.