01DISCOVER
Know where cryptography lives
Map algorithms, certificates, keys, libraries, and dependencies across applications, PKI, network connectivity, cloud services, and infrastructure. Identify the owner of each dependency.
Post-Quantum Cryptography & Crypto-Agility
Prepare today. Protect what must stay confidential tomorrow.
Understand your cryptographic exposure and plan a practical transition toward quantum-resistant security.
Why preparation matters
The data lifecycle can outlast the protection around it.
A sufficiently capable quantum computer could undermine widely used public-key cryptography. An attacker may collect encrypted information now and attempt to decrypt it later. Long-lived sensitive information deserves attention before that capability exists.
Post-quantum cryptography uses mathematical algorithms designed to resist quantum attacks. It is different from quantum key distribution and does not require a quantum computer to use.
01Understand your cryptographic dependencies
02Prioritize long-lived sensitive information
03Identify vendor and integration constraints
04Plan a controlled, measurable transition
From readiness to a migration plan
Start with evidence.
Move through clear decisions.
Discuss these workstreams with IRIS to agree a scope suited to your environment. Product selection and implementation depend on verified vendor support and technical feasibility.
02PRIORITIZE
Protect the information with a long life
Consider how long data must remain confidential, the consequences of exposure, system replacement cycles, and the effort required to migrate. Start with business impact.
03ASSESS
Check vendor and platform readiness
Review supported versions, implementation maturity, interoperability, hardware constraints, and vendor roadmaps. Distinguish available features from future commitments.
04PLAN
Build a sequenced migration roadmap
Define scope, dependencies, ownership, procurement requirements, and decision gates. Coordinate certificates, applications, infrastructure, and third-party services.
05PILOT
Validate before changing production
Agree a controlled pilot around supported technologies. Assess handshake sizes, latency, throughput, certificate handling, compatibility, monitoring, and rollback.
06ADAPT
Make future cryptographic changes easier
Develop crypto-agility through maintained inventories, clear ownership, configurable cryptographic choices, and repeatable testing and certificate lifecycle processes.
Standards, not speculation
A foundation for informed decisions.
NIST finalized three principal PQC standards in August 2024. Their roles differ; migration requires more than replacing one algorithm everywhere.
FIPS 203KEY ESTABLISHMENT
ML-KEM
A key-encapsulation mechanism used to establish shared secrets.
Read the NIST standard ↗FIPS 204DIGITAL SIGNATURES
ML-DSA
A lattice-based digital signature standard.
Read the NIST standard ↗FIPS 205DIGITAL SIGNATURES
SLH-DSA
A stateless hash-based digital signature standard.
Read the NIST standard ↗An algorithm standard does not certify a complete product or deployment. Evaluate the actual implementation, protocol support, and operational controls. NIST PQC project and migration guidance ↗
Practical questions
Prepare with clarity.
Must we replace everything immediately?
Start with discovery and prioritization. Avoid a blanket upgrade before understanding dependencies, interoperability, and the support status of each platform.
Can we combine classical and post-quantum methods?
Hybrid approaches may be suitable where supported by the relevant protocol and vendors. Validate the exact implementation and operational impact rather than assuming compatibility.
Does this guarantee compliance?
No. Applicable obligations depend on your jurisdiction, sector, contracts, and systems. NIST standards are a technical reference, not automatic proof of Saudi or Jordanian regulatory compliance.
What should we bring to the first discussion?
Your critical applications, PKI and certificate architecture, VPN and network platforms, data retention requirements, vendor landscape, and planned technology refreshes.
Plan your next step
Make quantum readiness a practical business decision.
Discuss your environment and priorities with our team to define the appropriate assessment scope.