Post-quantum readiness: start with your inventory

Migration to post-quantum cryptography is a multi-year program, and the expensive part is discovery.

Build a cryptographic bill of materials You cannot migrate what you cannot see. Enumerate every place your systems use asymmetric crypto: TLS termination, code signing, JWTs, document signing, VPNs, hardware, and every third-party dependency.

Prioritize by confidentiality lifetime Data that must stay secret for a decade is the urgent case. Session tokens that expire in an hour are not.

Practical near-term moves - Turn on hybrid key exchange where your TLS stack already supports it - Make crypto agile: no hardcoded algorithms, rotate through configuration - Require post-quantum roadmaps from critical vendors - Shorten certificate lifetimes so rotation is routine

Do not hand-roll Use vetted libraries implementing the standardized algorithms. Novel cryptography written under deadline pressure is the bigger risk.