What Is the Step-by-Step Quantum Readiness Roadmap for Enterprises Preparing for Q-Day?
A quantum readiness roadmap moves an enterprise through six phases: cryptographic inventory, risk-based prioritization, migration strategy selection, PKI preparation, phased deployment, and ongoing algorithm evolution. NIST's post-quantum program keeps expanding past its first three standards, ML-KEM, ML-DSA, and SLH-DSA.
The evaluation process is still producing findings: in July 2026, Anthropic's Claude Mythos Preview model cut the effective key strength of HAWK-256, the smallest parameter set of the HAWK signature candidate, in half in about 60 hours, a weakness that had survived two rounds of expert human review over two years. HAWK is a candidate, not a deployed algorithm, but the result is a sign that the standards are still shifting, that AI is now part of the review process that shapes them, and that data recorded today stays exposed until a winning standard is actually finalized and deployed. Mosca's theorem is the formula security teams use to decide which systems to prioritize first. Cryptographic migration protects future key exchanges, but it does nothing about traffic already being recorded today. CyberRidge's Carmel platform addresses that gap by protecting data in transit at the physical, optical layer while the rest of the roadmap is underway.
Q-Day is the point when a cryptographically relevant quantum computer becomes able to break today's public-key encryption, and preparing for it takes more than buying a single product. Two things need to happen at the same time: a standards-based migration to post-quantum algorithms, which takes years to complete across an enterprise's certificates and systems, and protection for the links carrying long-lived sensitive data that stays exposed to interception in the meantime. Skip the second part, and traffic gets harvested today and decrypted later once quantum capability catches up.
What a Quantum Readiness Roadmap Actually Covers
A quantum readiness roadmap is the sequence an organization follows to move its cryptography from algorithms vulnerable to Shor's algorithm to NIST-approved post-quantum replacements, while also addressing data exposed before migration finishes. CISA, the NSA, and NIST jointly describe quantum readiness as an ongoing program starting with a cryptographic inventory, since most enterprises lack a current map of where RSA or ECDH (the asymmetric algorithms most systems currently use for key exchange and digital signatures) are used across their certificates and protocols.
Grover's algorithm only halves AES-256's effective strength, but still keeps it above the 128-bit post-quantum security threshold the NIST and the NSA now require. Therefore these standards bodies do not require replacing the 256 symmetric cipher. The roadmap's real work is replacing the asymmetric key-exchange layer, which is what Shor's algorithm actually threatens.
The Six-Step Roadmap: From Inventory to Deployment
The roadmap breaks into six concrete steps, each building on the one before it.
Where Cryptographic Migration Alone Falls Short
Post-quantum cryptography secures future key exchanges, but it does not stop an adversary from copying encrypted traffic off a fiber link today and storing it. This is the harvest-now-decrypt-later threat: an attacker taps a cable, records the payload along with the RSA or ECDH handshake, and waits. Once a quantum computer breaks that recorded handshake, the attacker recovers the session key and decrypts the stored data, regardless of how strong the migration eventually becomes. Upgrading to ML-KEM closes this path for future sessions, but it does nothing for traffic already recorded, and the payload stays a coherent, recordable signal on the wire throughout. Physical tapping of trunk lines, submarine cables, and street cabinets is a documented, ongoing risk, so this exposure is not theoretical for organizations running long-lived sensitive data over fiber.
Closing the Harvest Gap While You Migrate
The two tracks solve different halves of the same problem, and a complete roadmap runs both in parallel rather than one waiting on the other. Carmel spreads the signal across a wide spectral band and encodes it with a continuously changing optical key, so a link tapped today yields nothing coherent to store. Carmel is complementary to PQC and should be rolled out as a protection mechanism while the roadmap undergoes the standards-based migration. This minimises the risk of links that fall below Mosca's theorem test.
The exposure column matters more than it looks: cryptographic assumptions are shifting faster under AI. In July 2026, Anthropic's Claude Mythos Preview model autonomously improved the best-known attack on a reduced-round version of AES by 200-800x, and cut the key strength of HAWK-256, a NIST post-quantum signature candidate, in half. Neither breaks a deployed system today — the result targets a weakened, reduced-round research variant. While HAWK has not been deployed, it points to a trajectory: whatever is recorded now will eventually face tomorrow's tools. The migration track can't protect already exfiltrated data; the necessity is therefore on blocking the harvest.
Curious what makes the recorded-traffic problem different from a key-exchange problem? CyberRidge's breakdown of the Harvest Gap explains why PQC and QKD both leave the payload itself recordable.
Practical Takeaways for Security Teams Building Their Roadmap
Start with the inventory step regardless of deadline pressure; prioritization and strategy depend on it. Run the Mosca's theorem calculation on your longest-lived data first, since financial, government, and defense data are most exposed to harvesting today. Pace against the binding deadlines first: Executive Order 14412 requires PQC key establishment across federal high-value assets and high-impact systems by the end of 2030 and PQC digital signatures by the end of 2031 — earlier than CNSA 2.0's 2030–2033 window, and well ahead of NIST's 2035 retirement date, which is the outer bound, not the starting line. For links that already fail the test, physical-layer protection closes the recording gap while the broader migration is underway.
FAQs
Q: What is Q-Day, and is there an official date for it?
A: Q-Day refers to the point when a quantum computer becomes powerful enough to break the RSA and elliptic-curve encryption most organizations rely on for key exchange today. No official date exists; NIST planning treats it as a moving target and sets migration deadlines, such as full algorithm retirement by 2035, as a hedge against uncertainty rather than a prediction.
Q: What is the first step in a quantum readiness roadmap?
A: The first step is a cryptographic inventory: cataloging every certificate, key, algorithm, and protocol across the environment. Prioritization, migration strategy, and PKI preparation all depend on this baseline, so skipping it stalls every later phase.
Q: Does a PQC migration alone protect against harvest-now-decrypt-later attacks?
A: No. PQC migration protects the key exchange for sessions established after the upgrade, but it does not retroactively protect traffic to an adversary already recorded, and the encrypted payload remains a recordable optical signal on the fiber regardless of which algorithm protects the keys. CyberRidge's Carmel closes that specific gap at the physical layer.
Q: How does Mosca's theorem help decide which systems to migrate first?
A: Mosca's theorem states that if the required confidentiality lifespan of your data (X) plus the time needed to migrate that system (Y) exceeds the time until quantum computers can break today's encryption (Q), the organization is already out of time on that system. Security teams use it to rank systems by urgency rather than migrating everything on the same schedule.
Q: Does Carmel replace the need for a PQC migration?
A: No. Carmel works alongside a standards-based PQC migration rather than in place of it. PQC protects future key exchanges against quantum attacks; Carmel protects the physical signal against being recorded and harvested today, which is a separate part of the same roadmap.
Q: How long does it take to deploy Carmel compared to a full PQC rollout?
A: CyberRidge reports that Carmel typically deploys in weeks, since it installs as a drop-in replacement for existing transmission line cards without requiring changes to the surrounding network. A full PQC migration across an enterprise's certificate and PKI infrastructure typically takes months to years, which is why physical-layer protection is often deployed first on the highest-exposure links.
Q: What deadlines should enterprises use to pace their roadmap?
A: The binding dates to plan against are Executive Order 14412's: PQC key establishment for federal high-value assets and high-impact systems by December 31, 2030, and PQC digital signatures by December 31, 2031 (the order also pushes FAR contractor compliance to that same December 2030 date). CNSA 2.0 sets separate transition dates for U.S. national security systems between 2030 and 2033, and NIST plans to fully retire the vulnerable classical algorithms by 2035 as the outer backstop. The UK's NCSC has published its own milestones, targeting discovery by 2028, early migration by 2031, and completion by 2035, giving international organizations a comparable pacing reference.