A quantum-readiness checklist for business owners

1. Give the work a home

Name a business sponsor and a technical contact. In a small organization the technical contact may be an outside IT provider. Agree who can request evidence, approve spending, and communicate with suppliers. CISA, NSA, and NIST recommend a quantum-readiness roadmap and engagement with vendors as preparation steps. [1]

Our suggested first deliverable is a one-page project note. Write its purpose, the services it initially covers, and the date of the next decision. Avoid beginning with an organization-wide promise that cannot yet be supported. A useful opening objective might be to understand the dependencies of three essential services before their next renewal.

2. Identify the services that matter most

Ask each business owner to describe an activity whose failure or unauthorized alteration would cause a serious problem. Capture what the service does, which systems support it, and whom to contact. Include important outsourced services; an activity does not stop being your concern because another company operates the software.

Then note the information used by that service. Consider confidentiality, accuracy, and availability separately. A public document may not need secrecy, but an unauthorized change to instructions or a software update can still be important. The resulting service list should be understandable to a manager who does not recognize cryptographic algorithm names.

3. Obtain evidence and record the gaps

For each priority service, request a written supplier answer about present cryptographic dependencies and the supported migration route. Save the date and product version alongside the answer. Use a simple status such as not yet investigated, evidence received, testing underway, or verified for the defined scope.

Keep a separate entry for unanswered questions. Do not convert the absence of detail into a green status. NIST’s migration project includes work on cryptographic visibility and interoperability, reflecting that identifying dependencies and checking how changes work together are different jobs. [2]

• What product and version are we discussing?
• Who owns the next action?
• What evidence would close the question?
• When will that evidence be reviewed?

4. Turn the findings into a funded plan

For each unresolved item, choose a proposed route: seek clarification, apply a supported update, test a replacement, align a change with an existing project, or obtain specialist advice. State the reason for the priority. Include staff time and the possible need for provider help when estimating effort.

The UK NCSC publishes planning milestones for 2028, 2031, and 2035, with early attention to discovery and higher-priority migration. These are UK guidance milestones. They are not a universal United States private-sector legal deadline. [3] Establish the actual requirements relevant to your contracts, industry, systems, and jurisdiction before putting a mandatory date in your plan.

5. Review what changed

Use existing management meetings to check whether a vendor answered, a pilot passed, or a replacement was approved. Report evidence and blockers in plain language. A count of completed questionnaires says less than a clear explanation of which important service now has a tested path forward.

Bring an accurate summary to insurance discussions, including limitations. Do not mark controls as fully implemented merely because a purchase has been approved. The next useful action for most teams is a focused conversation with the person responsible for one priority service, followed by a written decision and a review date.