NCSC Guidance on Post-Quantum Cryptography (PQC) What UK and EU Organisations Need to Know Now
Key Takeaways
- Timeline: NCSC three-phase roadmap (2028, 2031, 2035 deadlines) for UK/EU PQC standards migration
- For: CISOs, IT Directors, Risk Officers, Compliance Teams across UK/EU sectors
- Key Standards: ML-KEM-768 (Kyber), ML-DSA-65 (Dilithium), SLH-DSA (SPHINCS+)
- Regulatory Context: NCSC guidance aligns with DORA, GDPR, NIS2 compliance requirements
Reading Time: 8 minutes
Why the UK/EU is Paying Attention to Quantum Threats
Quantum computing promises transformational capabilities – from drug discovery to logistics optimisation. Quantum chips are rapidly becoming more scalable, stable, and usable, accelerating solutions beyond traditional computing capabilities.
But this power also threatens our cryptographic foundations. If quantum computers can decrypt sensitive data, trust in everything from online banking to digital healthcare records could erode overnight. For UK/EU organisations, this represents an existential threat to data sovereignty, regulatory compliance and customer confidence.
That’s why the UK’s National Cyber Security Centre (NCSC) has taken a proactive position, issuing clear NCSC post-quantum guidance to help organisations prepare for post-quantum cryptography UK/EU standards.
This isn’t just a technical update, it’s a foundational shift in how we need to protect our sensitive data in the decades ahead.
- For comprehensive quantum threat context: Why Post-Quantum Cryptography Matters
The Quantum Algorithms That Changed Everything
How real is this threat? Two quantum algorithms in particular have raised red flags for security professionals.
Shor’s algorithm (1990s)
Shor’s algorithm showed that a powerful enough quantum computer could efficiently factor large numbers (i.e., break them down into prime numbers much faster than classical computers ever could) – the core assumption behind public-key cryptography systems like RSA and ECC. This theoretical breakthrough instantly placed a countdown clock on the longevity of traditional encryption.
Grover’s algorithm
While not as catastrophic, still poses a major threat to symmetric cryptography by dramatically speeding up brute-force attacks. It reduces the security margin of algorithms like AES by effectively halving their strength.
As quantum computing matures, the risk of a “harvest now, decrypt later” strategy grows: adversaries may already be storing encrypted communications with the intent to decrypt them in the future once quantum capabilities catch up.
This is why cybersecurity communities in the UK, Europe and the world over are aligning around post-quantum readiness. The “harvest now, decrypt later” threat is active: adversaries collect encrypted communications today to decrypt once quantum computers mature (estimated 2030-2035). The NCSC has warned UK organisations that sensitive encrypted data should be assumed already collected.
We explore the harvest now, decrypt later threat in detail here.
“Migration to PQC is a national technology change programme. It comes with significant potential cyber risk, and we have a strong responsibility to manage that. But it also promises major opportunities.”
NCSC Annual Review
NCSC Post-Quantum Cryptography Guidance: Roadmap and Timelines
In March 2025, the NCSC released its Timelines for Migration to Post-Quantum Cryptography – a comprehensive roadmap for UK organisations across sectors, reflecting consensus among UK and EU security leaders on urgency and strategic approach – perspectives we explore in depth in our expert analysis of the future of post-quantum cryptography in the UK/EU (coming soon).
The NCSC emphasised that the severity of quantum risk facing the UK is being widely underestimated, particularly for critical infrastructure, supply chains, and the public sector. The gap between the evolving quantum threat and the cyber resilience of UK organisations needs to close as a matter of urgency, according to the NCSC’s 2024 Annual Review.
Discovery & Planning
High-Priority System Upgrades
Full Migration & Legacy Deprecation
NCSC Three-Phase Roadmap
The NCSC migration roadmap
The NCSC has explicitly warned that organisations must assume sensitive encrypted data is already being collected and will eventually be decrypted.
Phase 1: 2025-2028 – Discovery and Planning
Complete cryptographic inventories, identify quantum-vulnerable systems, assess data sensitivity periods, build migration roadmaps, test hybrid approaches, and engage vendors on PQC readiness. Deadline: 2028 – All UK organisations should have completed discovery and planning.
Phase 2: 2028-2031 – High Priority System Upgrades
Deploy hybrid cryptography at scale, migrate customer-facing systems and payment infrastructure, implement quantum-safe encryption for long-term data storage, validate interoperability, and conduct DORA-aligned resilience testing. Deadline: 2031 – Critical infrastructure and high-priority systems must be quantum-safe.
Phase 3: 2031-2035 – Full Migration & Legacy Deprecation
Remove classical cryptography from production systems, achieve full cryptographic agility, establish continuous monitoring and governance, demonstrate regulatory compliance (GDPR, DORA, NIS2), and participate in sector-wide information sharing., Deadline: 2035 – Complete quantum-resistant cryptography UK infrastructure.
NCSC and NIST Alignment on Quantum-Safe Encryption Standards
The NCIS guidance is consistent with the US National Institute of Standards and Technology (NIST), which finalised its first post-quantum cryptographic standards in 2024. NCSC recommends adopting:
- ML-KEM-768 (Kyber) for key encapsulation
- ML-DSA-65 (Dilithium) and SLH-DSA (SPHINCS+) for digital signatures
Both are lattice-based cryptographic algorithms designed to withstand both classical and quantum attacks. The NCSC emphasises the importance of using standardised algorithms and warns against bespoke or non-validated approaches.
NCSC Recommendations
The NCSC PQC guidance recognises sector-specific challenges. For example:
Financial Services lead adoption due to strong regulatory alignment (DORA), high reliance on public-key cryptography, and significant “harvest now, decrypt later” exposure. For further financial sector guidance: Quantum Threats to UK/EU Financial Services | Implementing PQC in Financial Services
Critical National Infrastructure (CNI) providers may face challenges due to hardware constraints or legacy equipment with long refresh cycles.
Healthcare and Government must address extremely long data retention periods, GDPR Article 32 requirements and “harvest now, decrypt later” vulnerability.
Small and Medium Enterprises (SMEs) are advised to rely on managed service providers and mainstream software updates that include PQC-ready components (e.g., browsers, VPNs).
Together, these standards form the basis for UK/EU PQC standards and align the region with international quantum-safe encryption practices.
Key PQC Implications for UK/EU Organisations
Across industries, post-quantum cryptography (PQC) represents not just a technical shift, but a strategic imperative for quantum-safe cybersecurity in the UK and EU.
Financial Services: Quantum-Safe Security and Regulatory Readiness
The financial sector is both a high-value target and a critical dependency in the UK economy.
Institutions using TLS, digital signatures, and secure messaging must prioritise PQC to protect customer data, financial transactions and blockchain integrations. Adopting quantum-safe encryption early will also align financial institutions with UK/EU PQC standards and regulatory expectations.
Healthcare and Government: Managing Long-Term Data Risks
Long data retention cycles make these sectors particularly vulnerable to “harvest now, decrypt later” attacks – a key quantum threat identified in NCSC PQC guidance. Secure storage of medical records, census data, and citizen identifiers must transition to quantum-safe protocols.
Healthcare: Patient medical records (lifetime retention under GDPR), genetic data, NHS systems, and medical device communications require quantum-resistant cryptography.
Government: Census data, classified communications, tax records, social services data, and digital identity systems face decades-long sensitivity periods.
The NCSC has warned that organisations should assume sensitive encrypted data is already being collected by adversaries for future decryption (estimated 2030-2035).
Supply Chains and Critical National Infrastructure (CNI): Quantum-Resilient Upgrades
Transport, energy, and logistics providers face integration challenges with distributed systems and embedded devices. PQC deployment may require over-the-air firmware updates for IoT devices, hardware upgrades for industrial control systems (ICS/SCADA), protocol-level changes in telecommunications infrastructure, and supplier PQC readiness verification.
Critical sectors affected: Energy (smart grids, SCADA), transport (railway signalling, air traffic control), telecommunications (5G/6G infrastructure), and water treatment systems.
Each sector faces distinct migration challenges. For financial services organisations, we examine the regulatory and operational considerations in our guide to quantum-safe finance for UK and EU banks and insurers.
For organisations leveraging distributed ledger technology, blockchain systems present unique PQC challenges due to cryptographic immutability and permanent transaction records.
How UK/EU Organisations Can Prepare for Post-Quantum Cryptography
NCSC guidance provides the strategic framework for UK/EU PQC standards and supports phased adoption of quantum-safe encryption across industries. However, translating it into an actionable implementation plan requires careful planning and phased execution.
3 Steps to PQC Readiness
The NCSC has explicitly warned that organisations must assume sensitive encrypted data is already being collected and will eventually be decrypted.
Step 1: Conduct a Crypto Inventory and Quantum Risk Assessment
Begin by mapping where cryptography is used in your organisation: TLS certificates, VPNs, document signing, code signing, database encryption, etc. Identify dependencies on RSA, ECC, or other quantum-vulnerable protocols.
Assess data sensitivity periods: if data must remain confidential beyond 2030-2035, it requires quantum-safe encryption today.
Key questions: How long must this data remain confidential? When might quantum computers capable of breaking RSA/ECC emerge? Is this data likely being harvested now? What are the regulatory consequences of future decryption (GDPR, DORA, NIS2)?
Step 2: Implement Hybrid Cryptography During Migration
To ease the transition, NCSC supports hybrid cryptography: combining traditional and quantum-safe algorithms during migration. This allows for backward compatibility with partners not yet PQC-ready and resilience while new standards are adopted.
As organisations build quantum-resistant systems, many are also exploring advanced cryptographic techniques that offer enhanced privacy and security beyond traditional encryption, including zero-knowledge proofs and secure multiparty computation.
Step 3: Design for Cryptographic Agility and Long-Term Resilience
Design systems now with crypto-agility in mind: the ability to switch cryptographic algorithms without overhauling the underlying infrastructure. This will be essential as standards evolve and new quantum-safe options are introduced. By designing for quantum-resilient security now, organisations can meet future PQC standards without major infrastructure disruption.
DORA Article 6 explicitly requires this for financial entities, with similar expectations under GDPR for all organisations handling sensitive data.
Cryptographic agility requires: Algorithm independence (configurable services, not hard-coded algorithms), centralised key management supporting multiple algorithm types, continuous monitoring tracking algorithm usage, and rapid switchover capability via configuration changes.
By designing for quantum-resilient security now, organisations can meet future PQC standards without major infrastructure disruption.
Venari’s Perspective
Turning Guidance into Practice
As organisations across the UK and Europe prepare for the transition to post-quantum cryptography, many are finding the process more complex than expected – especially balancing compliance, vendor dependencies, and sector-specific risks.
The NCSC PQC guidance provides an excellent strategic framework, but requires complete visibility into cryptographic assets, understanding of dependencies, vendor PQC readiness assessment, regulatory gap analysis, and phased implementation maintaining operational continuity.
At Venari, we help enterprises across the UK and EU:
- Conduct cryptographic inventories(CBOM) and risk assessments
- Integrate NCSC-aligned timelines into digital transformation strategies
- Implement hybrid PQC/traditional models while maintaining interoperability
- Build long-term cryptographic agility
Our deep experience working across finance, government, telecoms, and critical infrastructure means we understand the practical constraints UK/EU organisations face – and we’re ready to help.
Talk to Us
Book a 30-minute strategy session with our PQC advisors to assess your current posture and define next practical steps toward crypto-agility and compliance with NCSC PQC guidance.
NCSC Post-Quantum Cryptography Guidance
Frequently Asked Questions
What is the NCSC's timeline for PQC migration?
The NCSC has defined a three-phase approach:
– By 2028: Discovery and planning
– By 2031: High-priority system upgrades
– By 2035: Full migration and legacy algorithm deprecation
Which algorithms are recommended by NCSC?
The NCSC aligns with NIST, recommending ML-KEM-768 (Kyber) and ML-DSA-65 (Dilithium) and SLH-DSA (SPHINCS+) for key exchange and signatures respectively.
What is the "harvest now, decrypt later" threat?
This refers to attackers collecting encrypted data now with the intention of decrypting it later once quantum capabilities become available. Sectors with long data retention (e.g., healthcare, finance, government) are especially at risk. The NCSC warns organisations should assume sensitive encrypted data is already being collected.
How can Venari help?
Venari offers consulting and technical services to guide organisations through discovery, roadmap development, hybrid implementation, and cryptographic agility planning and strategy aligned with NCSC timelines.
Ready to transform your security approach?
Related Content
A Practical Roadmap to Quantum-Safe Cryptography for UK/EU Enterprises
Key Takeaways Timeline: Start now-3-5 year migration timelines mean immediate action required For: CISOs, IT Directors, Security Architects,…
Post-Quantum Cryptography and Regulatory Compliance GDPR, DORA and Beyond
Key Takeaways Timeline: DORA effective January 2025, EU PQC roadmap milestones 2026-2035 For: CISOs, Compliance Officers, Risk Managers,…