The security impact of quantum computing arrives before a cryptographically relevant machine. Public bodies hold information with long confidentiality lives, depend on complex supplier estates and operate systems that take years to replace. Post-quantum preparation is therefore an asset, dependency and governance programme as much as a technical upgrade.
Build a cryptographic inventory
Identify protocols, libraries, certificates, hardware modules, embedded devices and supplier services that use public-key cryptography. Record ownership, data sensitivity, replacement cycle and whether the component can be updated. The inventory should focus first on high-consequence and long-lived systems.
Prioritise by exposure and lifetime
Some information may be collected now and decrypted later. Other systems create operational risk because they cannot be patched quickly. Combining confidentiality lifetime, external exposure and upgrade difficulty produces a more useful migration order than treating every certificate equally.
Design for crypto agility
Standards and implementation guidance will continue to evolve. Systems should be able to change algorithms and parameters without a full rebuild. Contract terms, architecture patterns, testing and incident processes all need to support that flexibility.
A useful review rhythm
Public value should remain visible throughout discovery, procurement and assurance. Teams can ask who benefits, who carries risk, how a claim will be tested and whether a smaller supplier can compete fairly. The answers help emerging technology enter government through accountable decisions rather than novelty alone.
Evidence should be reusable across the organisation wherever security and commercial conditions allow. Shared questions, test methods and lessons reduce duplicated effort and give later buyers a stronger starting point. They also help policy, digital and operational teams understand one another's constraints.
The strongest next step is a bounded piece of work with an owner, a current baseline and an explicit decision at the end. It should improve confidence without requiring the organisation to predict the whole technology market.
Practical actions
- Assign ownership for cryptographic discovery.
- Prioritise long-lived sensitive information and hard-to-update systems.
- Ask suppliers for migration and interoperability plans.
- Build algorithm change into future architecture and contracts.
Quantum advantage is an operational claim. It becomes credible when evidence, integration and responsibility are considered together.