On August 14, 2024, the National Cyber Security Centre (NCSC) published a blog post titled 'Post-Quantum Cryptography: What Comes Next?.' The blog provides details on how the NCSC plans to assist organizations in their migration to post-quantum cryptography (PQC), following the standardization of key PQC algorithms by the National Institute of Standards and Technology (NIST).

Initial discovery work

The blog highlights that migration to PQC involves more than just adopting new algorithms and requires robust implementations and updates to existing services and protocols. The blog emphasizes that organizations, particularly larger ones and those with bespoke IT or operational technology, should begin their 'initial discovery' work now which involves:

• assessing the value and longevity of the data they hold;
• documenting the systems that process and store this data;
• understanding how data is protected, with a focus on the use of public key cryptography; and
• reviewing how their supply chain is planning for PQC migration.

According to the blog, the highest priority should be given to systems holding long-lived valuable data and those with infrequent update opportunities due to hardware dependencies.

The NCSC's role in supporting PQC migration

In the blog, the NCSC outlines several ways it will support the migration to PQC including:

• assisting regulators in developing guidelines and policies for PQC migration, particularly in regulated sectors like finance and telecoms;
• collaborating with the Cabinet Office and the Department for Science, Innovation and Technology (DSIT) to establish migration policies for Government departments; and
• helping all organizations access good advice, from migration planning to large-scale system integration and exploring efficient ways to connect organizations with the necessary expertise.

Finally, the blog notes that the NCSC is planning further guidance in the coming months, including FAQs on challenging aspects of PQC migration and expanded details on consultancy assurance.

You can read the blog here.