1. Know what you run
You cannot migrate what you cannot see. Build an inventory of the algorithms, keys and certificates your estate actually uses, derived from what systems negotiate rather than from what documents say they should.
2. Rank by how long data must stay secret
Traffic recorded today can be decrypted once a large quantum computer exists. Data that must stay secret for years, such as identities, health records, evidence and state information, comes first. Mosca’s inequality makes the order concrete: work it out with your own numbers.
3. Turn on hybrid key exchange
NIST published ML-KEM as FIPS 203 in August 2024. Combining it with a classical exchange such as X25519 protects traffic against both kinds of attacker: breaking either half alone recovers nothing. Start with the connections that carry long-lived data.
4. Plan the signatures
Signatures matter for anything that must stay provable: software updates, commands and evidence. ML-DSA (FIPS 204) can sign beside a classical signature during the transition, and stateful hash-based signatures such as LMS suit long-lived roots.
5. Build agility
Algorithms will change again. Put the choice of algorithm behind policy, not code, so the next change is configuration, and measure progress against your inventory.
QUME and RCC already use hybrid key exchange and post-quantum signatures. See quantum-safe in QUME.
