FEATURE sustainable. So, organisations should separate cryptographic policy from application business logic where possible.
That does not magically solve every cryptographic dependency, but the principle is more pragmatic: centralise cryptographic change where you can and expose and manage it where you cannot.
Don’ t wait for the perfect deadline
So, what should organisations do now? Three steps matter more than a date to mark on a calendar. First, build and maintain a cryptographic inventory. Understand not just where certificates exist, but where cryptography is being used, what it protects, who owns it and what other systems depend on it.
Second, start asking every strategic technology supplier a very direct question: what is your post-quantum migration roadmap? And get the answer in writing. If an important supplier cannot answer that question, I would treat that as a supply chain risk rather than somebody else’ s technical problem.
Third, prioritise according to the lifetime and sensitivity of the data. Not everything needs to migrate tomorrow, but information that must remain confidential for many years needs to move towards the front of the queue because of harvest now, decrypt later.
Y2K was solved because there was a date that forced organisations to act. Q-Day gives us no such luxury, so this time we have to create the urgency ourselves.
And perhaps the best measure of whether we got this right is surprisingly simple: the next cryptographic transition should be boring. • www. intelligentcio. com
INTELLIGENT CIO APAC
27