Free tools Windows power users keep installed
One-click scans. No signup required.
Start now with a cross-functional owner, a maintained inventory of where public-key cryptography is used, and a risk-ranked migration roadmap. You do not need to assume that a cryptographically relevant quantum computer is available or predict when one might arrive: migration spans systems, suppliers and operational dependencies, while sensitive data encrypted today could be collected and targeted for decryption in the future.
What post-quantum cryptography means for your organization
Post-quantum cryptography (PQC) refers to cryptographic methods designed to resist attacks from both conventional and quantum computers. Unlike quantum cryptography, which is based on quantum physics, PQC uses mathematical techniques and runs on ordinary computing systems. That makes it a matter of updating cryptographic software, protocols, products and infrastructure—not replacing an organization’s computers with quantum hardware.
As an Amazon Associate I earn from qualifying purchases.
The immediate planning issue is organizational complexity. Public-key cryptography can be embedded in services, applications, devices, certificates, signing processes and supplier products, including systems that are difficult or risky to change. Long-lived confidential information also creates a reason to act before any future threat is realized: an adversary might collect encrypted data now and seek to decrypt it later. This “harvest now, decrypt later” concern is a reason to assess how long information must remain secret; it is not evidence that current encryption has already been broken.
Which PQC standards are ready, and what is not a deadline
NIST says three PQC standards released in 2024 are ready for implementation. Its standards overview identifies ML-KEM and ML-DSA among the finalized standards and says these standards are unaffected by the separate algorithm selection also noted on that page. The standards provide key-establishment and digital-signature algorithms. They are not interchangeable names for one universal replacement: determine which standardized method and implementation fits each use, and confirm support in the relevant product, protocol and deployment scenario.
#1 Best Overall
Standardization does not make every product or service automatically compatible. NIST notes that implementation across cybersecurity products, services and protocols requires updates. A standard’s existence is therefore a technical baseline for planning, not proof that a particular supplier’s product supports it or that a migration can safely be made without testing.
NIST IR 8547, published as an initial public draft on November 12, 2024, describes NIST’s expected transition from quantum-vulnerable cryptographic standards to post-quantum signature and key-establishment schemes. Its public comment period closed January 10, 2025. It is a draft transition plan, not a final universal deadline for private organizations. Requirements depend on jurisdiction, sector, system and contractual obligations; NIST’s FAQ describes U.S. federal agency requirements separately from national and sector roadmaps.
1. Assign ownership and define what is in scope
Name an executive sponsor accountable for decisions and a migration lead responsible for coordinating the work. Establish a team that reflects how cryptography is actually deployed and changed, rather than treating PQC as a security-team-only project.
- Include cybersecurity, enterprise architecture, IT, procurement, privacy and risk, application owners, and business or mission stakeholders.
- Include operational technology (OT) specialists wherever industrial, building, medical or other operational environments are relevant.
- Bring in suppliers and service providers whose products or services contain cryptographic functions or affect migration dependencies.
- Set the scope: legal entities, environments, products, data flows, suppliers and systems covered by the program.
CISA, NSA and NIST recommend forming a project team and roadmap before migration. The practical output should be an owned program with decision rights, a way to resolve cross-team blockers and a roadmap that can change as inventory findings and vendor support become clearer.
2. Create a cryptographic inventory that can be maintained
A cryptographic inventory is a descriptive record of the cryptography used across an organization’s systems, applications, services, devices and data flows. Its purpose is to make dependencies visible enough to assess risk, identify owners and plan changes. It is not a store for secret key material.
For each relevant use, record the algorithm and protocol or service; the application, system, device or component; the owner and supplier; dependent systems; protected information and its confidentiality needs; and the available upgrade path and operational constraints. For keys and certificates, record lifecycle details such as owner, algorithm, application and expiration without copying private keys or other secrets into the inventory.
Include public-facing and internal services, as well as cryptography that may not be visible from a network scan: TLS, SSH, VPNs, email encryption, code and firmware signing, libraries, embedded devices, and development or deployment pipelines. A system inventory that omits a supplier’s embedded cryptography or a signing process can miss a dependency that later blocks a migration.
Use several discovery methods, and record what each can see
No single discovery method establishes enterprise-wide cryptographic visibility. Combine automated scans with endpoint, code, supplier and owner reviews, then connect findings to asset and change-management processes. The tools named in NIST’s FAQ are examples, not a ranked list or a guarantee of complete coverage.
| Discovery approach | Useful for finding | Coverage limit to account for |
|---|---|---|
| Network and public-service scans | Exposed TLS or SSH endpoints and observable protocol configuration | Cannot establish what is embedded in every application, device, library or internal workflow. |
| Endpoint, server and application inspection | Installed software, libraries and cryptographic configurations on systems available for inspection | Coverage depends on access, asset completeness and what the inspection method can detect. |
| Code and CI/CD dependency review | Cryptographic libraries and signing dependencies in source, build and deployment pipelines | May not reveal runtime behavior or cryptography hidden in external services and firmware. |
| Certificate and domain review | Certificates associated with known domains and their visible lifecycle information | Does not enumerate all private, internal, device or non-certificate cryptographic uses. |
| Supplier questionnaires and architecture review | Embedded cryptography, product dependencies, support plans and planned upgrades | Answers need to be specific and verified against product versions and deployment scenarios. |
NIST’s FAQ lists pqcscan for SSH/TLS servers, sslscan2 for SSL/TLS cipher suites, crt.sh for certificates associated with domains, and CyberZero’s PQC Edge Scanner as example starting points. It also names a PQC Coalition inventory workbook. Their capabilities and scope differ; consult each tool’s own site or repository for what it detects. Treat scan results as evidence about the scanned surface, not proof that cryptography elsewhere has been found.
Make inventory upkeep part of normal operations. Update it when systems, suppliers, services or dependencies change, and assign owners to resolve unknowns. A one-time spreadsheet will become stale as products and environments evolve.
3. Rank findings by risk and migration difficulty
Inventory alone does not tell you what to migrate first. For each use, assess both the consequences of leaving it in place and the practical effort and risk of changing it. Record the information protected, sensitivity, required secrecy lifetime, business or mission impact, external exposure, dependencies, supplier, current algorithm or protocol, upgrade path and operational constraints.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Secrecy lifetime: Give early attention to information that must remain confidential for many years. A long confidentiality requirement makes the harvest-now-decrypt-later concern more relevant.
- Criticality: Consider the consequences if a system or service is unavailable, impaired or unable to communicate during a change.
- Exposure and trust: Assess externally exposed services, identity and trust infrastructure, and digital-signature functions that validate software or firmware updates.
- Dependencies: Identify upstream and downstream systems, counterparties, protocols and suppliers that must support a compatible change.
- Migration complexity: Note hardware or firmware constraints, change windows, unsupported products, validation needs and recovery options.
Use your organization’s risk framework and applicable regulatory obligations to turn these factors into sequencing decisions. The aim is not to label every cryptographic use equally urgent: prioritize high-consequence and long-lived data while identifying enabling dependencies that could delay multiple systems.
4. Map each priority to a supported standard and supplier plan
For each prioritized use, determine which NIST standard applies and what supported implementation is available in the relevant product or protocol. A standardized algorithm is only one part of the decision: the product version, protocol profile, deployment configuration, counterparties and lifecycle processes all matter.
Ask suppliers for concrete, product-specific information rather than accepting a general claim such as “quantum-safe.” Request:
- The standardized algorithm and protocol profile supported, and the exact product versions and deployment scenarios covered.
- Release timelines, support windows, compatibility constraints, and any hardware or firmware dependencies.
- Certificate and key lifecycle implications, including how existing identities and trust relationships will be handled.
- Validation status and interoperability or performance evidence relevant to your environment.
- A migration plan, known dependencies and the process for handling defects or rolling back a change.
Bring procurement into supplier discussions and involve OT specialists where a change affects operational environments. Replacing or updating OT products may require longer planning, supplier coordination and controlled maintenance windows. Record unanswered questions and dependencies in the roadmap so that a supplier’s broad statement is not mistaken for an implementation commitment.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. Build crypto agility and test before production
Crypto agility is the ability to replace or adapt cryptographic algorithms across protocols, applications, software, hardware, firmware and infrastructure while preserving security and ongoing operations. NIST’s final CSWP 39 describes mechanisms, challenges and trade-offs, and emphasizes approaches suited to the environment. In practice, agility means designing systems and processes so a later cryptographic change is manageable rather than entangled with a complete application redesign.
Best Value
Before deployment, pilot the change in a controlled non-production environment. NIST’s NCCoE migration work focuses on identifying compatibility issues and resolving them in controlled settings so organizations do not have to repeat the same work independently. Test with the systems and counterparties that will actually communicate with the production service.
- Interoperability with suppliers, clients, services and other protocol participants.
- Performance, message and certificate sizes, and hardware or firmware constraints.
- Key and certificate issuance, renewal, storage, rotation and retirement processes.
- Logging, monitoring and alerting, including whether existing operational tools can interpret failures.
- Backup and restore, failure recovery, rollback procedures and the criteria for stopping a rollout.
Document test conditions and results, including which versions and configurations were exercised. A successful lab test is useful evidence for that scenario; it does not automatically establish compatibility across every product combination in the organization.
6. Roll out in stages and keep the program current
Move from a successful pilot to production through controlled stages, with named owners and change controls for each deployment. Define service-level monitoring and rollback criteria before the change, and coordinate timing with suppliers and affected business or mission teams. Retire quantum-vulnerable algorithms where feasible, while tracking residual exceptions and dependencies that cannot yet be changed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Keep the inventory, risk ranking and roadmap current as products, support commitments, protocols and guidance evolve. PQC preparation is a continuing program: new supplier information or system changes can alter both priority and sequencing.
Which deadlines apply to your organization?
Do not assume that a U.S. federal agency requirement applies automatically to a private company, another country or every system in a regulated sector. Identify the rules that actually govern your organization and the systems in scope. Check with legal, compliance, procurement and system owners for:
- The applicable national regulator and any sector-specific transition roadmap.
- Critical-infrastructure obligations and requirements tied to government contracts.
- Jurisdiction-specific rules, system classifications and dates that apply to particular data or services.
Use NIST’s standards as a technical baseline where applicable, but confirm regulatory and contractual obligations directly. NIST IR 8547’s initial public draft is not a universal private-sector compliance date, and the available guidance does not establish one migration duration that fits every organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
