The deadlines for moving away from today’s public-key cryptography are no longer abstract. Draft guidance from the U.S. National Institute of Standards and Technology (NIST IR 8547) proposes deprecating RSA and elliptic-curve algorithms by 2030 and disallowing quantum-vulnerable algorithms entirely by 2035. The NSA’s CNSA 2.0 suite expects U.S. national security systems to use quantum-resistant algorithms by 2033. In Canada, federal departments must migrate high-priority systems by the end of 2031 and the remainder by the end of 2035.
The technology side is moving quickly as well. Cloudflare reported in April 2026 that more than 65 percent of human traffic to its network already uses post-quantum key exchange, and both Google and Cloudflare aim to complete their own migrations by 2029. In many cases, customers’ browsers are ready for post-quantum connections before the servers they connect to.
For most organizations, however, the first obstacle is not choosing an algorithm. It is knowing where cryptography is used at all. Few security teams can say with confidence which systems rely on which algorithms, who owns each system, which data must remain confidential for many years, and which suppliers have committed to post-quantum dates. Cryptography is embedded in applications, libraries, network devices, certificates, cloud services and third-party products, and it is rarely documented in one place.
This gap matters because the quantum threat is already a present-day data problem. Encrypted traffic can be captured now and decrypted later, a risk known as “harvest now, decrypt later.” Digital signatures on firmware, documents and identities face a related risk, sometimes called “trust now, forge later.” Researchers often use Mosca’s inequality to judge urgency: if the time data must stay secret plus the time needed to migrate is longer than the time until a quantum computer can break current cryptography, the organization is already late. Applying that test requires knowing, system by system, how long data must stay protected and how long migration will take.
Industry bodies including the Canadian Forum for Digital Infrastructure Resilience, FS-ISAC and the Canadian Centre for Cyber Security consistently place cryptographic inventory and readiness assessment at the start of any migration plan. Without that baseline, organizations cannot prioritize systems, estimate budgets, hold vendors accountable or show regulators and boards credible progress.
Canadian quantum security company SuperQubit Inc. has introduced SQP Assess, a browser-based post-quantum readiness assessment designed to provide that baseline. According to the company, teams sign in over a post-quantum protected connection, and all results are encrypted and saved on the organization’s own devices rather than on SuperQubit’s systems.
SQP Assess produces a readiness score from either a 60-question quick scan or a full 120-question assessment across four dimensions: vulnerabilities, governance, data protection and infrastructure. It also measures migration maturity in seven domains, from inventory to crypto agility, on a scale from 0 (unaware) to 5 (optimized). The company notes that the overall maturity score is set by the weakest domain, so a strong area cannot hide a weak one.
The assessment includes a cryptographic exposure map covering more than 60 algorithms and 18 protocol families, each paired with a recommended replacement. Timing checks apply harvest-now-decrypt-later and trust-now-forge-later scenarios, service life and the earliest applicable deadline. A vendor tracker records whether each supplier’s post-quantum date is committed, forecast, announced or unknown. A deadline tracker covers 20 jurisdictions and notes whether each requirement is law or guidance. The output is an action plan sorted into “now,” “next,” “later” and “keep.”
Reporting is designed to fit existing governance frameworks. Results map to ISO 27001, DORA, NIS2 and NIST Cybersecurity Framework 2.0, with evidence graded on a five-level scale and trend snapshots that show progress between reviews. Reports can be exported to PDF, CSV, Markdown or JSON, including an executive brief with red, amber and green status and 14 leadership questions. Seven sector modules cover financial services, payments, telecommunications, operational technology and critical infrastructure, government and defence, digital assets, and cross-sector organizations.
SuperQubit positions the assessment as the first step in a broader sequence: assess where the organization stands, protect the most exposed data in transit, and strengthen key generation at its root. The company says a first readiness picture can be produced in a single working session.
With regulatory dates now set and major technology providers already migrating, the window for planning is narrowing. For many organizations, the most practical starting point is not a large migration programme but a clear, evidence-based answer to a simple question: where do we stand today?
Source: https://superqubit.ai/
By Superqubit.AI