Quantum‑Safe by Design: The G7’s Blueprint for the Post‑Quantum Era

Why this advisory lands differently this time

On 3rd to 4th September 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the G7 Cyber Security Working Group issued a joint call to action entitled “Preparing for the Post-Quantum Era”. The message is direct and is rather specific for a document from the G7: organisations and governments can no longer delay their work on switching to post-quantum cryptography (PQC).

This is not a hypothetical warning concerning “some day” quantum computers; it is a coordinated message indicating that the period of uncertainty has become shorter, the standards are in place, and the cost of delaying action is now greater than the cost of beginning.

The core threat: “store now, decrypt later”

Almost all online activity is protected by public-key cryptography, which includes algorithms such as RSA and elliptic-curve cryptography (ECC); this encompasses TLS connections, digital signatures, code signing, secure email, VPNs, and a large part of the trust infrastructure for important systems.

A powerful enough quantum computer that has cryptographic significance (CRQC) would be able to use Shor’s algorithm to break these algorithms, making today’s encrypted data readable and today’s signatures forgeable.

The fact that such machines exist today is not the immediate concern; adversaries are already collecting encrypted traffic and stored data with the intention of decrypting it later. The threat known as “store now, decrypt later” (SNDL) therefore means:

• The long-lived secrets (such as state secrets, intellectual property, health records and financial data) which are intercepted today could end up being made public once a CRQC has been put in place.
• Digital signatures made today might have their validity compromised if the private keys are based on flawed algorithms.

Since this is the case, the G7 and CISA are making a strategic error by waiting for a confirmed CRQC timeline. The move to PQC should start at once, with the confidentiality lifetime of the data serving as the basis rather than relying on optimistic predictions regarding quantum hardware.

What the G7 is actually asking for

The G7 Cyber Security Working Group’s statement, prepared under France’s 2026 G7 Presidency and coordinated by ANSSI, lays out five priority areas to accelerate the PQC transition:

1. Make people in both the government and the industry aware of the quantum risks and of the importance of PQC.
2. Prepare national strategies to promote the adoption, integration, and coordination of PQC.
3. Push research and development for quantum-safe technologies and how to use them.
4. Strengthen the partnerships between the public and private sectors so that they can share their expertise, tools, and lessons learned.
5. Make sure that quantum-resistant cryptography is included in the cybersecurity requirements and procurement processes so that new systems are purchased in a quantum-ready manner.

The overall approach makes it clear that the following action points should be taken: begin with an inventory, rank the items by their level of risk, and regard the migration of PQC as a programme that spans multiple years not as a one-off patch.

The standards are no longer “coming soon”

The reason why this advisory comes across as different is that the cryptographic building blocks have now been put in place.

In August 2024, NIST published its first three finalised PQC standards:

• FIPS 203 (ML-KEM) is based on CRYSTALS-Kyber and is used for key establishment/key encapsulation.
• FIPS 204 (ML-DSA) provides digital signatures based on CRYSTALS-Dilithium.
• FIPS 205 (SLH-DSA) is based on SPHINCS+, a hash-based signature scheme which has been designed as a conservative fallback.

They form the basis of the majority of the near-term deployments. NIST anticipates that they will support most of the transition to post-quantum cryptography, with quantum-vulnerable algorithms being withdrawn and taken out of its standards by about 2035, and high-risk systems making the move earlier.

In parallel, regional bodies are aligning:

• The guidance on cybersecurity certification issued by the EU (with updates in 2025 and again in April 2026) specifies particular parameter sets for ML-KEM and ML-DSA, this being in line with the effort taking place between 2026 and 2027 under the EU Cyber Resilience Act.
• The NCSC in the UK suggests that a move to hybrid PQ/T (post-quantum plus traditional) cryptography should be made “where it is reasonable” as a temporary measure, this being a practical and risk-oriented method.
• Roadmaps in the industry such as that of Google Cloud aim to achieve full readiness with respect to post-quantum cryptography by 2029, with measures to protect confidentiality being introduced before the updates to digital signatures and key management.

The position taken by standards organisations and the big cloud providers is the same: the algorithms are ready; the issue now is how fast companies can put them into operation.

What it actually means to begin the transition.

The G7 and CISA make it clear that the transition to PQC is a step-by-step, risk-based programme, not a simple switch-over upgrade; their recommendations can be summed up in a number of specific steps.

1. Cryptographic asset inventory

If we want to carry out a migration, we first need to know what we currently have. The advisory stresses that carrying out a cryptographic asset inventory should be our first actual task:

• Find out which systems make use of public-key cryptography (such as TLS, VPN, code signing, S/MIME, PKI, HSMs, IoT, OT, etc.).
• Write down the algorithms, key sizes, protocols, libraries, and vendors.
• What applications, services, and suppliers depend on which cryptographic components.

For most organisations this takes several months, particularly in the case of legacy systems and third-party products.

2. Set priorities based on how long the data will be kept and how important it is.

It is not necessary for all systems to operate simultaneously. The G7 and CISA suggest that you should prioritise:

• Systems which hold long-lived and high-value data (such as state secrets, data relating to the control of critical infrastructure, and long-term health or financial records).
• The infrastructure concerned with authentication and trust (such as PKI roots, code-signing keys and identity providers).
• In sectors or environments that are subject to SNDL attacks such as defence, critical infrastructure, finance, and advanced manufacturing. The general rule derived from recent analysis is straightforward: it is necessary to prioritise according to the data’s confidentiality level rather than according to speculative dates for CRQC availability.

3. Use hybrid cryptography when it is possible.

Given PQC algorithms are new and implementations are still maturing, many agencies and vendors recommend hybrid schemes:

• Establish a key by combining a traditional algorithm (for example, ECDH) with a PQC algorithm (for example, ML-KEM).
• Use hybrid signatures provided that policy permits and performance allows.

This approach:

• Security is maintained even if one family of algorithms is subsequently weakened.
• Makes it easier to achieve interoperability during the transition period.

The UK NCSC’s recommendation to move to PQ/T hybrid cryptography “where appropriate” reflects this practical approach.

4. Incorporate PQC into the procurement and refresh cycles.

The G7 explicitly calls for integrating PQC into cybersecurity requirements and procurement:

• New tenders should specify a requirement for products that are PQC-capable or PQC-ready.
• Introduce support for PQC by making use of regular technology refreshes (of network equipment, HSMs, end points and cloud services).
• Ask the vendors for clear roadmaps regarding PQC and for support with the migration.

For CISOs and members of the procurement team, PQC becomes a contractual and governance tool rather than remaining a purely technical project.

5. Draw up a plan for cryptographic agility

A common topic in recent technical reviews is that cryptographic agility, which means being able to change the algorithms and parameters without having to carry out major re-architecture, is more durable than relying on any one PQC algorithm. Implications:

• Construct design systems in such a way that cryptographic modules can be updated or replaced.
• Do not hard-code the algorithms and key sizes directly into the application logic.
• Continue to carry out a process for keeping an eye on developments in cryptanalysis and standards updates.

Sector momentum: finance, cloud, and critical infrastructure

The G7 advisory is not developed in isolation; it is based on and strengthens the work that is currently being carried out in each sector.

Financial sector

In January 2026 the G7 Cyber Expert Group published a coordinated roadmap for the financial sector, which set out the various stages starting with awareness and inventory (2026–2028) and then moving on to risk assessment, migration, testing and validation into the 2030s.

In September 2026 the U.S. Treasury established a Quantum-Readiness Task Force in order to coordinate the financial sector’s transition, with a focus on:

• Planning for sector alignment and migration.
• Third‑party and vendor readiness.
• Risks that come with digital assets and new technologies.

The task force expressly bases itself on the G7 roadmap, which shows that the financial sector is now considering quantum-resistant cryptography as a systemic risk and not merely as an IT upgrade.

Cloud and technology providers

Major cloud providers are publishing concrete PQC roadmaps:

• Google Cloud intends to achieve complete readiness with respect to post-quantum cryptography by 2029, with confidentiality protections to be introduced by the end of 2027 and updates to the signature and key management features to follow about a year later.
• Other suppliers and vendors are also introducing PQC into TLS, VPN, and identity services, usually beginning with ML-KEM for key establishment.

For organisations that place great reliance on cloud services and SaaS, the PQC transition will to some extent be determined by the providers’ schedules provided that you actively monitor and request PQC capabilities during contract negotiations and architecture reviews.

Critical infrastructure and government

For critical infrastructure operators and government agencies, the G7 and CISA guidance effectively sets an expectation:

• Begin cryptographic inventories now.
• Treat post-quantum cryptography as an issue relating to the resilience of critical infrastructure, just as with ransomware, supply-chain risk, and operational technology security. Keep in line with the national strategies and the sector regulators as they introduce more prescriptive requirements for PQC.

In the EU, the Cyber Resilience Act and the associated certification schemes are already calling for PQC-aligned cryptography by 2026–2027, thus adding a regulatory demand on top of the security imperative.

What this means for CISOs, CIOs, and boards

For leadership teams, the advice provided by the G7 leads to a number of clear conclusions.

1. PQC is about governance, not only about a crypto project.

The G7 statement makes it clear that the transition to PQC should be seen as a collaborative initiative involving active management oversight, rather than as a specialized job for the cryptography team.

Boards and executive committees should expect:

• We are providing regular updates regarding progress on the cryptographic inventory.
• Risk evaluations associated with the lifetime of data and with threats to different sectors.
• Incorporating the PQC milestones into the enterprise risk and technology roadmaps.

2. The advisory cautions that postponing migration could result in:

The advisory warns that delaying migration could lead to:

• The advantage that one has in competition disappears as partners and regulators accelerate.
• Being excluded from certain contracting opportunities, in particular from public procurement which is beginning to require PQC-ready systems.

In areas like defence, critical infrastructure, and finance, “quantum-readiness” is expected to play a key role in bids and partnerships.

3. Begin on a small scale but begin at once

The recommended approach is:

• Start a workstream for the discovery of cryptographic methods.
• Test the hybrid PQC in non-critical but typical environments (for example, internal TLS and test PKI).
• Use the pilots to help formulate a multi-year migration plan that is in line with the refresh cycles and regulatory timelines.

The way to proceed is to create momentum and promote organisational learning as early as possible when the ecosystem is still maturing.

A pragmatic 12‑month starter plan

For organisations that want to act without getting lost in theory, a practical first year might look like this:

Months 1–3: Awareness and scoping

• Give senior leadership a brief on SNDL risk and the guidance from G7 and CISA.
• Assign a lead person for PQC or create a working group (comprising members from the areas of security, architecture, and legal).
• Set the scope by identifying which business units, systems, and data classes will be included in the initial inventory.

Months 4–6: Cryptographic inventory and dependency mapping

• Look at the use of public-key cryptography in applications, infrastructure, and suppliers.
• Write down algorithms, key sizes, protocols, and vendors.
• Map dependencies and find high-risk, old data systems.

Months 7–9: Risk assessment and pilot design

• Evaluate the level of risk based on the data’s lifetime, how critical it is, and its exposure to SNDL.
• Choose the pilot use cases, for example those relating to internal TLS, code signing, and specific PKI domains.
• Talk to the vendors about their PQC roadmaps and their hybrid support.

Months 10–12: Pilot deployment and lessons learned

• Set up hybrid PQC in test settings.
• Measure the performance, compatibility, and operational impact.
• Improve the migration playbook and update the multi-year roadmap.

This plan won’t deal with all the issues within a year, but it will take the organisation from being ‘aware’ to ‘actively migrating’, which is precisely what the G7 and CISA are asking for.

The new baseline for security

The September 2026 G7 advisory marks a clear turning point: post-quantum cryptography has now moved from a stage of “preparation to preparation” to one of “starting to do the real work”. The relevant standards are in place, the threat model is well defined, and the cost of delaying action has become part of the risk assessment.

For governments, critical‑infrastructure operators, financial institutions, and any organisation holding long‑lived sensitive data, the question is no longer “if” but “how soon” and “how systematically.” The organisations that treat PQC as a strategic, board‑level resilience programme starting with inventory, prioritisation, and pragmatic pilots will be the ones that avoid being caught flat‑footed when the quantum era arrives.

About the Author

EdTeam

Administrator

View All Posts