7 Questions Every CISO Should Ask Before Starting a Post-Quantum Cryptography Program

Executive Summary

Post-quantum cryptography (PQC) has rapidly moved from academic research into enterprise boardroom discussions. Following the publication of the National Institute of Standards and Technology (NIST) quantum-resistant cryptographic standards, organizations across industries have begun evaluating what quantum computing could mean for their long-term cybersecurity strategies.

The challenge is that many organizations are approaching the transition as a technology upgrade rather than a business transformation.

Discussions often begin with questions about algorithms, migration timelines, product compatibility, and implementation planning. While these are important considerations, they are rarely the first questions enterprise leaders should ask.

Successful cybersecurity programs begin with understanding the business.

They identify the assets that matter most, establish governance, evaluate operational readiness, assess supplier capabilities, and define measurable objectives before selecting technologies.

Post-quantum readiness should follow the same discipline.

CyberTech Intelligence believes organizations that ask the right strategic questions early will build more resilient modernization programs while avoiding unnecessary complexity, duplicate investments, and operational disruption.

This article outlines seven critical questions every Chief Information Security Officer (CISO), Chief Information Officer (CIO), enterprise architect, and cybersecurity leader should address before launching a post-quantum cryptography initiative.

These questions are designed to help organizations establish governance, improve visibility, align investments with business priorities, and prepare for a multi-year transition toward quantum-resilient digital trust.

Why Strategy Should Come Before Technology

Every significant cybersecurity transformation has followed a familiar pattern.

Organizations recognize an emerging challenge.

Technology vendors respond with new products.

Implementation projects begin.

Only later do many organizations realize that technology alone cannot solve governance, ownership, operational processes, or business alignment.

Cloud security, Zero Trust, software supply chain security, and identity modernization all demonstrated this pattern.

Post-quantum cryptography is no different.

Unlike traditional technology refresh initiatives, PQC affects the mechanisms that establish trust across nearly every digital interaction within an enterprise.

Customer authentication.

Cloud services.

Digital certificates.

Secure APIs.

Software signing.

Identity platforms.

Financial transactions.

Connected devices.

Because cryptography is deeply embedded throughout modern IT environments, organizations should resist the temptation to begin with implementation planning.

Instead, leadership should first establish whether the organization possesses the governance maturity required to support long-term modernization.

The following seven questions provide a structured decision sequence for assessing these capabilities within the CyberTech Intelligence Enterprise PQC Readiness Framework™.

Question 1: Do We Know Where Enterprise Cryptography Exists?

The first and arguably most important question has nothing to do with quantum-resistant algorithms.

Instead, it focuses on visibility.

Most enterprises have accumulated cryptographic assets over many years through digital transformation initiatives, cloud adoption, acquisitions, application development, and vendor integrations.

As a result, cryptography now exists across virtually every technology domain.

Common examples include:

• Public Key Infrastructure (PKI)
• TLS/SSL certificates
• Identity and Access Management (IAM)
• Cloud Key Management Services (KMS)
• Database encryption
• API authentication
• Code-signing infrastructure
• Secure email systems
• VPN technologies
• SaaS platforms
• DevSecOps pipelines
• Container environments
• Operational Technology (OT)
• Internet of Things (IoT) devices

Many organizations possess only partial visibility into these assets.

Without a comprehensive inventory, leadership cannot accurately estimate modernization effort, business impact, supplier dependencies, or operational risk.

CyberTech Intelligence recommends that every PQC initiative begin with an enterprise-wide cryptographic discovery exercise.

The objective is not merely to count certificates.

It is to understand how cryptography supports business operations, customer trust, regulatory compliance, and enterprise resilience.

Organizations that achieve this visibility create a reliable foundation for every subsequent modernization decision.

Why Visibility Matters More Than Immediate Migration

Some organizations feel pressure to begin replacing cryptographic algorithms immediately following the publication of new standards.

However, migration without visibility introduces unnecessary risk.

Leadership may unknowingly prioritize low-risk systems while overlooking mission-critical applications.

Business services may experience unexpected disruptions because hidden cryptographic dependencies were never documented.

Supplier readiness may remain unknown until implementation begins.

Visibility prevents these problems by providing evidence-based planning.

It enables leadership to answer questions such as:

• Which business services rely on legacy cryptography?
• Which applications contain embedded cryptographic libraries?
• Which vendors influence migration timelines?
• Which systems protect long-lived confidential information?
• Which modernization initiatives should receive priority investment?

Only after these questions have been answered should organizations begin evaluating implementation strategies.

The Leadership Perspective

Executive teams often ask how they can measure progress during the early stages of post-quantum readiness.

CyberTech Intelligence recommends focusing on visibility metrics rather than migration metrics.

Examples include:

• Percentage of enterprise cryptographic assets inventoried.
• Business-critical applications mapped to cryptographic dependencies.
• Certificates documented.
• Strategic suppliers identified.
• Executive ownership assigned.
• Governance committee established.

These indicators provide leadership with measurable evidence that the organization is building a strong foundation before technical modernization begins.

Organizations that invest in visibility today will make faster, more informed decisions as standards, vendor capabilities, and regulatory expectations continue to evolve.

Question 2: Do We Have Executive Ownership for Post-Quantum Readiness?

One of the most common reasons enterprise security initiatives struggle is not because of inadequate technology—it is because no single executive owns the outcome.

Post-quantum cryptography is particularly vulnerable to this challenge.

Unlike traditional cybersecurity initiatives, PQC modernization spans multiple business and technology functions. It affects infrastructure teams responsible for certificates and Public Key Infrastructure (PKI), application development teams managing cryptographic libraries, cloud engineering groups overseeing encryption services, procurement teams engaging technology vendors, legal departments reviewing contractual obligations, and business leaders responsible for critical digital services.

Without executive ownership, these activities often proceed independently.

Infrastructure teams focus on certificate management.

Security teams evaluate risk.

Developers concentrate on application delivery.

Procurement negotiates vendor agreements.

Each function performs its role effectively, yet no one maintains a comprehensive view of enterprise readiness.

CyberTech Intelligence recommends assigning clear executive accountability before technical planning begins.

Typically, executive sponsorship should include:

• Chief Information Security Officer (CISO) for governance and cyber risk.
• Chief Information Officer (CIO) for enterprise architecture and modernization planning.
• Chief Technology Officer (CTO) for software engineering and application strategy.
• Chief Risk Officer (CRO) for business risk and regulatory oversight.
• Procurement leadership for supplier engagement.
• Executive business sponsors for operational prioritization.

Rather than assigning responsibility to a single department, organizations should establish a governance structure that enables these leaders to make coordinated decisions throughout the modernization journey.

Why Executive Sponsorship Matters

Large-scale transformation programs require sustained investment over multiple years.

Without executive sponsorship:

• Modernization priorities frequently change.
• Funding becomes inconsistent.
• Departments pursue conflicting objectives.
• Supplier engagement is delayed.
• Business units receive inconsistent guidance.

Executive sponsorship provides continuity.

It enables organizations to maintain strategic focus even as technologies, standards, and regulatory expectations evolve.

CyberTech Intelligence has consistently observed that organizations with clearly defined executive ownership make modernization decisions more quickly, allocate resources more effectively, and reduce organizational friction during implementation.

Question 3: Which Business Data Must Remain Confidential for Decades?

Much of the urgency surrounding post-quantum cryptography stems from a simple reality:

Not all information loses value at the same rate.

Some business information remains highly sensitive long after it is created.

Examples include:

• Intellectual property
• Pharmaceutical research
• Product designs
• Financial records
• Healthcare information
• Government communications
• Legal evidence
• Customer identity information
• Critical infrastructure documentation
• Defense-related information

This long-term sensitivity is central to the "Harvest Now, Decrypt Later" (HNDL) risk model.

Adversaries may intercept and store encrypted information today with the expectation that future advances in quantum computing could enable decryption years later.

For organizations managing long-lived confidential information, waiting until quantum computers become commercially practical may be too late.

However, that does not necessarily mean immediate migration.

It means identifying where the organization's most valuable long-term information resides.

CyberTech Intelligence recommends beginning with business impact rather than technology.

Leadership should ask:

• Which data must remain confidential for ten years or more?
• Which applications process that data?
• Which encryption mechanisms protect it?
• Which external vendors participate in those workflows?
• Which regulations apply?

These answers help organizations prioritize modernization according to business risk rather than technology age.

Creating a Long-Term Confidentiality Inventory

Many organizations maintain data classification policies that distinguish between public, internal, confidential, and highly confidential information.

CyberTech Intelligence recommends extending these frameworks by introducing a confidentiality lifespan dimension.

For example:

This additional perspective enables executive teams to prioritize systems most likely to be affected by future cryptographic developments.

Question 4: Are Our Technology Partners Ready?

Enterprise cybersecurity increasingly depends on external technology ecosystems.

Cloud providers.

Identity platforms.

Network infrastructure.

Software vendors.

Managed security providers.

Certificate Authorities.

SaaS applications.

System integrators.

Every one of these organizations influences enterprise cryptographic readiness.

Yet many enterprises have only limited visibility into supplier preparedness.

CyberTech Intelligence recommends engaging strategic vendors early rather than waiting until migration planning begins.

Leadership should seek evidence—not marketing statements.

Important questions include:

Product Roadmaps

• Which products already support NIST-standardized algorithms?
• Which releases will introduce quantum-resistant capabilities?
• What implementation timelines should customers expect?

Migration Guidance

Organizations should request:

• Migration documentation.
• Compatibility guidance.
• Deployment recommendations.
• Operational best practices.
• Customer reference architectures.

Well-prepared suppliers should already be developing structured customer guidance rather than waiting for demand to increase.

Interoperability Testing

Technology ecosystems rarely operate in isolation.

Organizations should ask vendors:

• Have products been tested with major certificate authorities?
• Have hybrid cryptographic deployments been validated?
• Which interoperability challenges have been identified?
• What customer testing programs are available?

These discussions help organizations anticipate operational challenges before modernization begins.

Long-Term Support

Migration represents only one phase of enterprise readiness.

Organizations also need confidence that suppliers will continue supporting future cryptographic standards.

CyberTech Intelligence recommends evaluating:

• Product lifecycle commitments.
• Standards monitoring processes.
• Security update policies.
• Customer communication strategies.
• Long-term roadmap transparency.

Supplier maturity should become an ongoing governance discussion rather than a one-time procurement activity.

Looking Beyond Technology Selection

One of the biggest mistakes organizations can make is assuming that choosing the right technology vendor automatically creates organizational readiness.

Technology is only one component.

Successful modernization also depends upon:

• Executive leadership.
• Governance.
• Business prioritization.
• Data classification.
• Cross-functional collaboration.
• Supplier engagement.
• Continuous measurement.

Organizations that strengthen these capabilities before implementation begins consistently experience lower operational risk and more predictable modernization outcomes.

CyberTech Intelligence therefore recommends evaluating organizational readiness before evaluating products.

Doing so ensures that future technology investments are guided by business priorities rather than implementation urgency.

Question 5: Is Our Technology Architecture Built for Crypto Agility?

Most discussions surrounding post-quantum cryptography focus on replacing algorithms. However, organizations should ask a more fundamental question before planning migration:

Can our technology environment adapt to cryptographic change without significant disruption?

This capability is known as crypto agility.

Crypto agility is the ability to introduce, replace, or update cryptographic algorithms, certificates, protocols, and key management processes without requiring widespread application redesign or business interruption.

For many enterprises, this capability does not yet exist.

Years of technology evolution have resulted in cryptographic implementations being deeply embedded within applications, custom code, legacy infrastructure, middleware, embedded devices, and third-party software. These implementations were often designed when algorithm replacement was not considered a realistic operational requirement.

As a result, organizations now face environments where changing cryptographic components may require extensive development effort, application testing, vendor coordination, and operational planning.

CyberTech Intelligence believes crypto agility should become a long-term architectural objective rather than a short-term implementation project.

Organizations that invest in architectural flexibility today will respond far more efficiently to future cryptographic standards, regulatory requirements, and emerging security threats.

Characteristics of a Crypto-Agile Enterprise

A crypto-agile organization typically demonstrates several common characteristics.

Cryptography Is Abstracted from Business Logic

Rather than embedding cryptographic functions directly into applications, organizations use centralized services, standardized APIs, or reusable libraries that simplify future updates.

This approach enables security teams to modernize cryptographic mechanisms without requiring extensive application redesign.

Certificate Management Is Automated

Manual certificate management creates operational risk.

Organizations with mature certificate lifecycle management capabilities reduce the likelihood of outages, expired certificates, and inconsistent renewal practices.

Automation also improves governance by providing continuous visibility into enterprise trust relationships.

Cryptographic Standards Are Consistently Applied

Different business units frequently adopt different cryptographic implementations based on project timelines or vendor recommendations.

CyberTech Intelligence recommends establishing enterprise-wide standards covering:

• Approved cryptographic algorithms
• Key lengths
• Certificate policies
• Lifecycle management
• Secure software development practices
• Vendor compliance expectations

Consistency reduces operational complexity while improving long-term adaptability.

Technology Modernization Supports Future Change

Crypto agility extends beyond cryptography itself.

Organizations should evaluate whether broader modernization initiatives—including cloud migration, application modernization, API security, DevSecOps transformation, and identity modernization—also improve their ability to respond to future cryptographic requirements.

The goal is not simply preparing for post-quantum cryptography.

It is creating an enterprise architecture capable of continuous evolution.

Question 6: How Will We Measure Readiness?

Transformation initiatives frequently lose momentum because organizations cannot clearly demonstrate progress.

CyberTech Intelligence recommends establishing measurable executive indicators before implementation begins.

Rather than focusing solely on technical deployment, leadership should measure organizational capability.

Visibility Metrics

Executive teams should understand how comprehensively enterprise trust has been documented.

Recommended indicators include:

• Percentage of enterprise cryptographic assets discovered.
• Critical business applications mapped.
• PKI environments documented.
• Certificate inventory completeness.
• Cloud encryption services assessed.

Visibility metrics demonstrate whether leadership possesses sufficient information to make informed modernization decisions.

Governance Metrics

Governance maturity can be evaluated through indicators such as:

• Executive sponsor appointed.
• Governance committee established.
• Business units participating.
• Governance meetings completed.
• Enterprise policies approved.
• Ownership assignments documented.

These indicators measure organizational alignment rather than technology deployment.

Operational Metrics

Operational readiness should include:

• Certificate lifecycle automation.
• PKI modernization progress.
• Legacy cryptographic dependencies identified.
• Crypto agility assessments completed.
• Secure software development standards implemented.

Operational indicators help leadership evaluate modernization capability over time.

Vendor Readiness Metrics

External partners will significantly influence enterprise timelines.

Organizations should therefore monitor:

• Strategic suppliers assessed.
• PQC product roadmaps received.
• Migration guidance reviewed.
• Interoperability testing completed.
• Contractual commitments confirmed.

Supplier readiness should become a recurring executive reporting category.

Business Metrics

Ultimately, executive leadership should understand how modernization supports enterprise objectives.

Examples include:

• Business-critical services prioritized.
• Long-lived sensitive data protected.
• Regulatory obligations addressed.
• Customer-facing systems assessed.
• Operational resilience improved.
• Investment roadmap approved.

When viewed together, these metrics provide a comprehensive picture of organizational readiness rather than isolated technical activity.

Question 7: What Will Success Look Like Three Years From Now?

Many organizations define success as completing a migration.

CyberTech Intelligence believes this perspective is too narrow.

Technology will continue evolving beyond today's standards.

Organizations should instead define success in terms of long-term organizational capability.

Three years from now, a mature enterprise should be able to demonstrate:

• Comprehensive visibility into enterprise cryptographic assets.
• Executive governance integrated into enterprise risk management.
• Clearly assigned ownership across business functions.
• Mature crypto agility practices.
• Structured supplier governance.
• Continuous executive reporting.
• Modernized PKI governance.
• Business-driven modernization priorities.
• Repeatable governance processes supporting future cryptographic evolution.

Success is therefore measured by adaptability rather than completion.

Organizations capable of responding efficiently to future change will possess a lasting competitive advantage.

Seven Executive Readiness Questions within the CyberTech Intelligence Enterprise PQC Readiness Framework™

Based on enterprise modernization trends and emerging post-quantum guidance, CyberTech Intelligence recommends using the following seven executive readiness questions as a practical decision sequence within the CyberTech Intelligence Enterprise PQC Readiness Framework™.

Step 1 — Build Executive Awareness

Ensure boards, executive leadership, and business stakeholders understand why post-quantum readiness matters and how it supports long-term digital trust.

Step 2 — Discover Enterprise Cryptography

Develop a comprehensive inventory of certificates, cryptographic libraries, PKI environments, cloud encryption services, identity platforms, software signing infrastructure, and third-party dependencies.

Step 3 — Establish Governance

Create a cross-functional governance model with clearly defined executive ownership, reporting structures, and decision-making responsibilities.

Step 4 — Prioritize by Business Risk

Evaluate applications, business services, and data according to confidentiality requirements, operational criticality, customer impact, and regulatory obligations.

Step 5 — Assess Technology Partners

Engage strategic suppliers to review product roadmaps, migration guidance, interoperability testing, and long-term support commitments.

Step 6 — Improve Crypto Agility

Strengthen enterprise architecture by standardizing cryptographic services, automating certificate management, and reducing hard-coded dependencies.

Step 7 — Measure and Improve Continuously

Implement executive dashboards, recurring governance reviews, supplier assessments, and maturity evaluations to ensure readiness improves over time rather than remaining a one-time initiative.

This framework provides organizations with a structured path from awareness to operational resilience while maintaining flexibility as standards and technologies continue to evolve.

Looking Beyond the First Migration

Organizations often view post-quantum cryptography as a destination.

CyberTech Intelligence encourages a different perspective.

The real objective is building an enterprise capable of adapting continuously to changes in cryptographic standards, digital trust requirements, and technology ecosystems.

Organizations that invest in governance, visibility, and crypto agility today will be better prepared not only for quantum-resistant cryptography but also for future transformations involving artificial intelligence, confidential computing, decentralized identity, and next-generation cybersecurity architectures.

CyberTech Intelligence Perspective

The Organizations That Ask Better Questions Today Will Build Stronger Resilience Tomorrow

The discussion surrounding post-quantum cryptography often begins with technology and ends with implementation. Enterprise leaders compare algorithms, evaluate vendor roadmaps, and estimate migration timelines.

While these conversations are necessary, they are not sufficient.

The organizations that will navigate the transition most successfully are unlikely to be those that migrate first. They will be the organizations that prepare most effectively.

Preparation begins with asking the right questions.

Do we understand our cryptographic landscape?

Do we know which business services depend on it?

Have we established executive ownership?

Can our technology adapt to future cryptographic changes?

Are our vendors prepared?

Do we have meaningful metrics that demonstrate progress?

CyberTech Intelligence believes these questions are more valuable than debating migration schedules during the early stages of readiness.

CyberTech Intelligence Research Desk Observation

The earliest indicator of post-quantum maturity is not algorithm deployment. It is the quality of executive decision-making before deployment begins. Organizations that can connect cryptographic assets to business services, confidentiality lifespans, supplier dependencies, architecture constraints, and measurable risk are better positioned to sequence modernization without creating avoidable disruption. Where these relationships remain unclear, technical activity may increase while enterprise readiness remains largely unchanged.

Technology will continue to evolve.

NIST standards will mature.

Commercial products will expand support.

Vendor ecosystems will improve interoperability.

However, organizations that lack governance, visibility, and executive alignment will continue to struggle regardless of how advanced future technology becomes.

The lesson is clear.

Successful post-quantum readiness is built on strategic preparation rather than rapid implementation.

Five Strategic Recommendations for CISOs

1. Treat PQC as an Enterprise Transformation Program

Post-quantum cryptography should not be managed as an isolated cybersecurity initiative.

It impacts enterprise architecture, software development, infrastructure, cloud platforms, procurement, compliance, digital identity, operational resilience, and long-term business strategy.

CISOs should position PQC as an enterprise transformation program with executive sponsorship, governance, and measurable business outcomes rather than as a purely technical migration effort.

2. Build Visibility Before Building Roadmaps

Migration planning without visibility introduces unnecessary uncertainty.

Organizations should first develop a comprehensive understanding of:

• Cryptographic assets
• PKI environments
• Business-critical applications
• Third-party dependencies
• Long-lived sensitive data
• Cloud encryption services
• Identity infrastructure

Visibility allows leadership to prioritize investments using evidence rather than assumptions.

3. Invest in Crypto Agility Instead of One-Time Migration

Replacing existing algorithms is only one milestone.

Future cryptographic standards will continue evolving.

CyberTech Intelligence recommends investing in architectures capable of adapting repeatedly rather than designing environments optimized for a single migration event.

Crypto agility should become a permanent enterprise capability.

4. Make Vendor Readiness Part of Executive Governance

Enterprise resilience increasingly depends upon technology suppliers.

Organizations should regularly evaluate whether strategic vendors are progressing toward:

• NIST-standardized algorithm support
• Hybrid cryptographic deployments
• Migration guidance
• Interoperability testing
• Long-term lifecycle planning

Vendor readiness should become a recurring board and executive discussion rather than an annual procurement exercise.

5. Measure Organizational Capability—Not Just Technical Progress

Leadership should avoid measuring success exclusively through deployment milestones.

Instead, executive dashboards should demonstrate improvements in:

• Governance maturity
• Enterprise visibility
• Business prioritization
• Executive accountability
• Crypto agility
• Supplier engagement
• Operational resilience

These indicators provide a more accurate picture of long-term readiness than migration status alone.

The Future of Enterprise Cryptographic Strategy

The transition to quantum-resistant cryptography represents more than a security upgrade.

It reflects a broader shift in how organizations manage digital trust.

Historically, cryptography has often been treated as a technical implementation detail hidden beneath applications, networks, and infrastructure.

The quantum era changes that perspective.

Digital trust is becoming an executive responsibility because it directly influences:

• Customer confidence
• Regulatory compliance
• Brand reputation
• Business continuity
• Digital transformation
• Supply chain resilience
• Operational risk

Future cybersecurity leaders will increasingly be evaluated by their ability to coordinate governance, technology, business priorities, and supplier ecosystems rather than by technical expertise alone.

Organizations that strengthen these leadership capabilities today will be better positioned to adapt not only to quantum-resistant cryptography but also to future cybersecurity transformations involving artificial intelligence, confidential computing, machine identities, decentralized architectures, and emerging trust technologies.

In this sense, post-quantum readiness is not the final destination.

It is the beginning of a more adaptive approach to enterprise cybersecurity governance.

Final Thoughts

There is no universal checklist that instantly makes an organization quantum-ready.

Every enterprise has unique technology environments, regulatory obligations, supplier ecosystems, and business priorities.

However, every successful journey begins with asking the right questions.

The seven questions discussed throughout this article provide a practical framework for executive decision-making.

They encourage organizations to think beyond algorithms and focus instead on the capabilities that enable long-term resilience:

• Enterprise visibility
• Executive governance
• Business prioritization
• Vendor collaboration
• Crypto agility
• Continuous measurement
• Strategic adaptability

Organizations that build these capabilities today will be significantly better prepared for tomorrow's cryptographic landscape.

Ultimately, post-quantum readiness is not defined by how quickly an organization deploys new algorithms.

It is defined by how effectively leadership governs digital trust across an evolving technology ecosystem.

Ready to Assess Your Enterprise PQC Readiness?

CyberTech Intelligence helps enterprise security leaders evaluate their preparedness for the transition to post-quantum cryptography through research-driven assessments and strategic advisory services.

Our Enterprise Post-Quantum Readiness Assessment helps organizations:

• Assess cryptographic visibility across the enterprise.
• Evaluate governance maturity and executive accountability.
• Identify business-critical cryptographic dependencies.
• Review crypto agility capabilities.
• Assess supplier and technology ecosystem readiness.
• Prioritize modernization based on business risk.
• Develop phased, governance-led implementation roadmaps.

Whether your organization is beginning its quantum readiness journey or refining an existing modernization strategy, our advisory approach provides actionable recommendations aligned with evolving industry standards and enterprise best practices.

Contact CyberTech Intelligence to learn how our research and advisory services can help your organization build a governance-first, business-driven approach to post-quantum readiness.

References

1. National Institute of Standards and Technology (NIST). Post-Quantum Cryptography Project. https://csrc.nist.gov/projects/post-quantum-cryptography
2. NIST. FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM). https://csrc.nist.gov/pubs/fips/203/final
3. NIST. FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA). https://csrc.nist.gov/pubs/fips/204/final
4. NIST. FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA). https://csrc.nist.gov/pubs/fips/205/final
5. National Cybersecurity Center of Excellence (NCCoE). Migration to Post-Quantum Cryptography Project. https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc
6. Cybersecurity and Infrastructure Security Agency (CISA). Post-Quantum Cryptography Resources. https://www.cisa.gov/topics/post-quantum-cryptography
7. NIST. Considerations for Achieving Crypto Agility: Strategies and Practices (CSWP 39). https://csrc.nist.gov/pubs/cswp/39/final