Executive summary — Post-quantum cryptography (PQC) refers to public-key algorithms designed to resist attack from large-scale quantum computers. In 2026, NIST’s first PQC standards — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) — are finalised, and the migration from RSA and ECC has begun in regulated sectors. This guide defines PQC, explains the quantum threat and its timeline, breaks down the new NIST standards, and gives enterprise leaders a structured framework for evaluating PQC migration tools. The Threat Is Already Active The quantum computer that breaks RSA does not yet exist. The data it will decrypt has already been stolen. That is the central asymmetry of the harvest-now-decrypt-later threat — and the reason every credible regulator now treats post-quantum cryptography as a present-tense priority rather than a 2030 problem. Multiple intelligence agencies have publicly attributed harvest-now-decrypt-later programmes to state-level adversaries. Petabytes of encrypted traffic — financial messaging, government communications, healthcare records, intellectual property — sit in adversarial storage today, waiting for the cryptographic key that future quantum capability will deliver. Any enterprise with long-term confidential data is already affected; the only open question is when the data becomes readable. The Q-Day Timeline Credible analyses place the arrival of a cryptographically relevant quantum computer (CRQC) — one capable of running Shor’s algorithm against RSA-2048 — somewhere in the 2030–2040 window. The exact year is unknowable. What is knowable is that enterprise migration timelines run three to five years, and data signed today must retain integrity for decades. Subtracting the migration timeline from the threat timeline leaves a planning horizon of less than five years for the highest-stakes data. Regulators have read the same arithmetic. NSA CNSA 2.0 sets US national security migration deadlines staged across 2027–2033. BSI in Germany has issued binding guidance for federal systems. ANSSI in France has published an aggressive transition timetable. Singapore’s CSA, the UK’s NCSC, Japan’s CRYPTREC, and equivalents across the EMEA-APAC corridor have all published comparable frameworks. The window for waiting closed in 2024. The Three NIST Post-Quantum Standards In August 2024 NIST finalised the first three post-quantum standards. For enterprise planning purposes, three things matter. ML-KEM (FIPS 203) — Key Establishment Module-Lattice-Based Key-Encapsulation Mechanism replaces Diffie-Hellman and RSA key exchange. It is fast, has manageable key and ciphertext sizes, and is the default PQC algorithm for everyday key agreement in TLS, IKE, and message-layer encryption protocols. ML-DSA (FIPS 204) — General-Purpose Signatures Module-Lattice-Based Digital Signature Algorithm replaces RSA and ECDSA for most signature use cases. Signature sizes are larger than current standards, which has implications for certificate sizes and bandwidth, but verification is fast. ML-DSA is the right default for X.509 certificates, code signing, and document signing where size constraints are tolerable. SLH-DSA (FIPS 205) — Conservative Signatures Stateless Hash-Based Digital Signature Algorithm relies only on hash function security — a more conservative cryptographic assumption than lattice mathematics. Signatures are very large, but the algorithm is the right choice for long-lived signatures (root certificates, code signing for safety-critical systems, archival documents) where conservative assumptions outweigh performance concerns. The 5-Phase Enterprise PQC Migration Playbook Phase 1 — Crypto Discovery (Months 1–3) Inventory every use of public-key cryptography across the enterprise. Network protocols, certificate hierarchies, software libraries, hardware modules, document archives, and embedded systems all contribute. The output is a cryptographic bill of materials (C-BOM) — the foundational artefact for every subsequent migration phase. Phase 2 — Risk Prioritisation (Months 4–6) Rank discovered assets by harvest-now-decrypt-later exposure. Data that crosses public networks and retains confidentiality value beyond 10 years sits at the top. Internal-only traffic with short-term confidentiality value sits at the bottom. The output is a prioritised migration backlog. Phase 3 — Hybrid Certificate Pilots (Months 7–12) Deploy hybrid certificates carrying both classical and post-quantum algorithms in the highest-priority channels. Hybrid is the only safe migration vehicle: it interoperates with legacy systems while providing PQC protection wherever both sides support it. Hybrid pilot deployments depend on certificate lifecycle management platforms that can issue, distribute, and renew hybrid certificates at production scale. Phase 4 — Wholesale Migration (Months 13–36) Roll hybrid certificates through the full estate. Re-key endpoints, update certificate hierarchies, transition application-layer signing, replace embedded cryptographic libraries where required. This is the longest phase by elapsed time and the largest by operational cost. Phase 5 — Pure PQC and Crypto-Agility (Months 36+) Once hybrid coverage is universal and regulator deadlines permit, retire the classical algorithm from each hybrid certificate. The end state is pure-PQC operation across the estate, with the crypto-agility infrastructure in place to handle the next algorithm transition without restarting the playbook. Looking at the platform layer? eMudhra’s emCA post-quantum ready certificate authority issues hybrid PQC certificates today across all three NIST standards — with a documented migration runway aligned to NSA CNSA 2.0, BSI, and equivalent regulator timelines. PQC Readiness Scorecard Six questions, scored on a 0–2 scale, locate an enterprise on the PQC readiness curve. A total below 6 indicates a 12–24 month catch-up programme. A total above 9 indicates an enterprise on the leading edge of the migration. Has a cryptographic bill of materials (C-BOM) been completed in the last 12 months? (0 = no, 1 = partial, 2 = comprehensive) Is hybrid certificate issuance available from the enterprise CA today? (0 = no, 1 = pilot only, 2 = production) Has a risk prioritisation of harvest-now-decrypt-later exposure been completed? (0 = no, 1 = informal, 2 = documented) Are application-layer signing libraries algorithm-agnostic? (0 = hard-coded RSA/ECC, 1 = abstracted via config, 2 = pluggable PQC-ready) Is there a documented migration plan with regulator deadlines mapped? (0 = no, 1 = draft, 2 = approved) Has the CLM platform been verified to support PQC algorithms? (0 = no, 1 = roadmap commitment, 2 = production support) Key Takeaways Harvest-now-decrypt-later makes PQC a present-tense priority — the threat to today’s traffic is already active. Regulator deadlines (NSA CNSA 2.0, BSI, ANSSI, CSA, NCSC) close the planning horizon to under five years. NIST has finalised ML-KEM, ML-DSA, and SLH-DSA — the three algorithms enterprises need to plan around. The five-phase migration playbook starts with C-BOM discovery and ends with pure-PQC operation 3–5 years later. Hybrid certificates are the only safe transition vehicle; CLM platform PQC-readiness determines feasibility. Frequently Asked Questions What is post-quantum cryptography? Public-key cryptography that remains secure even against future large-scale quantum computers — built on mathematical problems (lattices, hashes, codes) that quantum computers cannot solve at scale. When is Q-Day? Estimates place a cryptographically relevant quantum computer in the 2030–2040 window. The exact year is unknowable, which is why migration cannot wait for certainty. What is harvest-now-decrypt-later? An attack pattern in which adversaries capture encrypted traffic today and store it for future decryption once quantum capability exists. The threat is active now for any data with long-term confidentiality value. What is a hybrid PQC certificate? A certificate carrying both a classical algorithm (RSA or ECC) and a post-quantum algorithm (ML-DSA or SLH-DSA). It interoperates with legacy systems while providing PQC protection wherever both sides support it. What is a cryptographic bill of materials (C-BOM)? A comprehensive inventory of every use of public-key cryptography across an enterprise — protocols, certificates, libraries, hardware modules. The foundational artefact for any PQC migration plan. How does PQC migration affect CLM platforms? CLM platforms must issue, distribute, and renew hybrid PQC certificates at production scale. Without first-class crypto-agility, the migration cannot proceed without breaking renewal automation. Run the PQC Readiness Scorecard Against Your Estate eMudhra’s emCA issues hybrid PQC certificates today across all three NIST standards, with a documented enterprise migration runway. Explore emCA post-quantum ready certificate authority or book a strategy call with the eMudhra team. Tags: Post Quantum Cryptography Certificate Lifecycle Management About the Author CertiNext Editorial CertiNext Editorial represents the collective voice of CertiNext, delivering expert insights on PKI modernization, crypto-agility, and the future of machine identity. Our team of PKI architects, security engineers, and digital trust specialists curates practical, in-depth content to help enterprises manage certificates at scale, eliminate outages, and prepare for the post-quantum era with confidence