🏭 Sector Urgency
Sector Quantum Migration Urgency Guide
Post-quantum migration urgency varies dramatically by sector. Finance and government must act immediately. SaaS and startups have more runway. Here is the breakdown.
Banking & Financial Services
Data retention: 7–15 years. High-value HNDL target. SWIFT, interbank, customer account data.
- SWIFT interbank communications — quantum-safe channel required by 2025 guidance
- Core banking system (CBS) encryption — RSA/ECC key wrapping must migrate to ML-KEM
- Customer data encrypted in transit — TLS hybrid PQC for all API channels
- HSM key storage — most banking HSMs need firmware or hardware upgrade
- Digital banking app signatures — code signing must move to ML-DSA
Healthcare
Patient data retained 25–50+ years. Lifetime records. Cannot be re-encrypted after a breach.
- EHR (Electronic Health Record) system encryption — patient data has 30+ year secrecy requirement
- Medical device communication — many devices use hardcoded RSA. Brittle migration path.
- Lab data and genomic data — highest long-term value to nation-state adversaries
- Telehealth platform TLS — patient consultations captured now, decryptable later
- Prescription and pharmacy systems — HNDL risk for controlled substance data
Government & Defence
Classified data 20–50+ years. NSA CNSA 2.0 mandate. Active HNDL attacks assumed.
- All NSS (National Security Systems) — CNSA 2.0 mandatory by 2030
- Government email and communication infrastructure — active HNDL target
- Border control and citizen databases — biometric data cannot be re-issued
- Critical infrastructure control systems — power grid, water, transport SCADA
- Inter-agency data sharing — PQC required for cross-agency communications
Telecommunications
Core network infrastructure, signalling, subscriber data. 5G security architecture must be quantum-aware.
- 5G core network encryption — 3GPP adding PQC to 5G SA security specifications
- Signalling network (SS7/Diameter) — legacy protocols already under attack; PQC upgrade path needed
- Subscriber data protection — IMSI, location data, call records
- TLS/DTLS in network function virtualisation (NFV) — migrate to PQC hybrid
- Law enforcement interception interfaces — highly sensitive, nation-state target
Energy & Critical Infrastructure
Operational technology (OT), SCADA systems. Attack on energy infrastructure = national security event.
- OT/SCADA communication encryption — many systems use outdated cryptography
- Substation communication (IEC 61850) — long equipment lifecycle means planning must start now
- Industrial control systems — brittle cryptographic agility. Replacement-level migration.
- Remote access VPN for OT — must migrate to PQC-hybrid IKEv2
- Smart grid metering — AMI communication encryption, 15+ year device lifecycle
Defence & Aerospace Contractors
Classified and sensitive data, ITAR/EAR regulated. NSA CNSA 2.0 applies to all NSS work.
- Controlled Unclassified Information (CUI) systems — CMMC 2.0 will incorporate PQC requirements
- Classified network segments — CNSA 2.0 mandatory with hard deadlines
- Supply chain communications — tier-2/3 supplier secure comms must also migrate
- Engineering data repositories — classified design data with 30+ year sensitivity
- Contractual compliance — CMMC audit findings for quantum-vulnerable crypto expected post-2026
Insurance
Policyholder data, actuarial data, long-term contracts. Claims data retained 20+ years.
- Policyholder records encryption — health and life data with 20+ year retention
- Reinsurance data exchange — sensitive actuarial data transferred between carriers
- Claims processing systems — fraud detection data with long retention
- Digital document signing — policy contracts require long-term signature validity
Legal & Professional Services
Attorney-client privilege, court records, M&A data. Long retention requirements.
- Client-matter confidential data — litigation strategy data is a nation-state target
- M&A transaction data — target company data, deal terms — 5–10 year secrecy
- Digital signature validity — court-filed digital signatures need long-term integrity
- Document management system encryption — privileged document vaults
Retail & E-commerce
Payment card data (PCI DSS), customer PII. Shorter retention cycles. Lower urgency than regulated sectors.
- Payment processing TLS — PCI DSS will incorporate PQC requirements post-2026
- Customer PII database encryption — GDPR breach notification still applies to future-decrypted data
- Code signing for app distribution — ML-DSA for app store submissions
- API authentication — JWT, OAuth should migrate to PQC-signed tokens over time
Cloud & SaaS Providers
Infrastructure provider: much depends on customer data retention. Ephemeral SaaS: lower urgency.
- TLS for all customer-facing endpoints — enable PQC hybrid immediately (often just a config change)
- Key management service (KMS) — upgrade HSMs and key wrapping when vendor ready
- FedRAMP-authorised systems — must align with NIST PQC migration guidance
- Customer data encryption — urgency depends on retention and customer industry sector
Manufacturing & Industrial
IP, trade secrets, supply chain data. Long equipment lifecycles create migration challenges.
- Industrial IoT device communication — 15–20 year device lifespan means design decisions now affect 2040
- ERP system encryption — trade secrets and supplier data with 5–10 year sensitivity
- Engineering data (CAD/CAM) — IP theft via HNDL is a realistic nation-state threat
- Supply chain communication encryption — tier-1 suppliers to OEM
Startups & SaaS (Short Lifecycle)
Modern cloud stack, short data lifetimes, ephemeral sessions. Least urgent but not zero.
- Adopt PQC-ready libraries now when updating cryptographic dependencies — zero migration cost
- Monitor cloud provider PQC updates — AWS, GCP, Cloudflare deploy automatically
- Avoid locking into old cryptographic APIs — ensure cryptographic agility in new code
- TLS hybrid PQC is already enabled by Cloudflare/AWS — no action needed for most
Urgency Factor Summary
| Factor | High Urgency | Lower Urgency |
|---|---|---|
| Data secrecy period | 20+ years (medical, classified, legal, genetic) | 1–3 years (ephemeral sessions, most SaaS data) |
| Nation-state threat interest | Critical infrastructure, defence, government, finance | Consumer apps, small business, low-value data targets |
| Regulatory mandate | NSA CNSA 2.0 (NSS), SWIFT CSCF, DORA, upcoming CMMC update | No current PQC-specific regulatory mandate |
| Migration complexity (brittleness) | Legacy mainframes, IoT, HSMs, SCADA — brittle — must start now to finish in time | Modern cloud-native, API-driven stacks — agile — can migrate quickly when needed |
| HNDL exposure | Long-term communications intercepted at scale (classified, legal, financial) | Short-lived session data with no long-term value |
| Vendor dependency | HSM, embedded system, and mainframe vendors have 12–18 month PQC delivery cycles | Cloud providers (AWS, GCP, Cloudflare) already deploying PQC — vendor handles migration |