PQC readiness starts with finding cryptographic dependencies, not choosing algorithms

Inventory before migration

The first useful deliverable is a cryptographic asset inventory. It should connect each dependency to an owner, business use, algorithm, key or certificate lifetime, data sensitivity, replaceability and migration priority.

• PKI and TLS certificates
• VPN and service-to-service authentication
• workload identities and application signing
• Key Vault, secrets and storage encryption
• legacy systems and long-lived encrypted data

Crypto agility is the immediate objective

Most organisations do not need a dramatic quantum programme today. They need to understand whether algorithms, certificates, keys and trust anchors can be replaced without redesigning every dependent service.

Keep the first engagement evidence-based

A readiness module should produce a dependency inventory, exposure view, crypto-agility score and sequenced 12–36 month roadmap. Implementation promises should follow only after the environment and vendor support are understood.