# Post-quantum readiness: where to start

> The EU PQC roadmap, NSA CNSA 2.0 and NIS2 start with a cryptographic inventory. Harvest now, decrypt later, ML-KEM in plain words, and a plan.

Source page: https://netsenx.com/en/blog/2026-11-12_post-quantum-readiness-guide · NetSenX Team · 2026-11-12

Post-quantum readiness starts with a question you can answer today, long before any quantum computer exists: where does your organisation use public-key cryptography that a future quantum computer could break, and which of those places protect data that must stay secret for years? Regulators and customers have started to ask exactly that. The EU's coordinated roadmap, the US National Security Agency's CNSA 2.0 and the cryptography duty in NIS2 all point to the same first step: a cryptographic inventory, then a prioritised migration.

This guide covers what is actually being asked, how to judge the risk without hype, what the new standards are in plain words, how much of the inventory you can build from network traffic, and a migration plan.

## What regulators are asking for

**The EU roadmap.** Commission Recommendation (EU) 2024/1101 of 11 April 2024 asked Member States to coordinate the transition to post-quantum cryptography. On 23 June 2025 the NIS Cooperation Group published the coordinated implementation roadmap: first steps by the end of 2026, including national plans and inventories of where quantum-vulnerable cryptography is used; high-risk use cases moved by the end of 2030; and as many systems as feasible by 2035. The roadmap is addressed to Member States and their public and critical sectors, not directly to your company, but national authorities are turning it into guidance, and its logic applies to anyone: by the end of 2026, know where your cryptography is.

**NIS2.** Directive (EU) 2022/2555 requires covered entities to have policies and procedures on the use of cryptography and, where appropriate, encryption, among the risk-management measures of Article 21. It names no algorithm. But "state of the art" moves, and once standards bodies and agencies treat post-quantum key exchange as normal, a cryptography policy that ignores it becomes harder to defend.

**United States.** The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) sets the algorithms for US national security systems: ML-KEM-1024 for key establishment and ML-DSA-87 for signatures. The NSA expects the transition of those systems to be complete by 2035, in line with National Security Memorandum 10. It binds US national security systems and their suppliers, not European companies, but suppliers to defence and government customers meet it in contracts.

None of these makes a product, including ours, "compliant" on your behalf. They ask organisations to know their cryptography and to plan its replacement.

## Harvest now, decrypt later, without the panic

An attacker who records encrypted traffic today can store it and decrypt it once a capable quantum computer exists. That is "harvest now, decrypt later". It does not threaten everything equally. Data that is worthless in two years, such as most session traffic, is not at risk. Data that must stay confidential for ten or twenty years is: contracts, health and personal records, intellectual property, credentials that are never rotated, and anything a state actor would want.

Michele Mosca's inequality turns that into a priority list. For each important data set, X is how many years it must stay secret, Y is how many years it will take you to migrate the systems that carry it, and Z is how many years remain until a quantum computer can break today's public-key cryptography. If X plus Y is greater than Z, the data you send today is already exposed. Z is unknown, so try a cautious and a relaxed value and see which systems fail even under the relaxed one. Those are the ones to move first.

## The new standards in plain words

In August 2024 NIST published the first three post-quantum standards. **FIPS 203 (ML-KEM)** is a key-encapsulation mechanism: it lets two parties agree on a secret key over an open network, the job RSA and elliptic-curve Diffie-Hellman do in key exchange today. **FIPS 204 (ML-DSA)** is the main digital-signature scheme, and **FIPS 205 (SLH-DSA)** a slower, hash-based alternative. In practice you will first meet ML-KEM inside TLS as the hybrid group X25519MLKEM768, which combines a classical and a post-quantum exchange so that the connection stays protected if either one holds. The [plain-words guide to ML-KEM and ML-DSA](/en/blog/2026-11-12_ml-kem-ml-dsa-explained) goes further, including why the larger keys break some old middleboxes.

## How much of the inventory the network can show

A cryptographic inventory, sometimes published as a CBOM (cryptography bill of materials), lists where each algorithm, protocol version and key is used, by which system, and who owns it. A good part of it is visible on the wire, without decrypting anything:

- **Key exchange per connection.** Every TLS handshake announces, before encryption starts, which key-exchange groups the client offers and which one the server picks, and the TLS version. SSH does the same for its key exchange. So a sensor can list, per server and per client, where quantum-vulnerable key exchange is still used and where hybrid post-quantum key exchange already is.
- **Devices nobody inventoried.** It covers printers, appliances, OT gateways and old servers that cannot run an agent and are often the last to be updated.
- **Keys where the handshake exposes them.** In TLS 1.2 the server certificate travels in clear, and SSH host keys are exchanged in clear, so their algorithms and key sizes are visible; in TLS 1.3 the certificate is encrypted.
- **Regressions.** Once a service has moved to hybrid key exchange, a later connection that falls back to a classical group shows up.

What it cannot see: cryptography inside applications and databases, keys and certificates stored on disk, code signing, encrypted backups, and any segment no sensor watches. Combine the network view with a certificate inventory, your software bills of materials and supplier questionnaires. The [crypto inventory from network traffic](/en/blog/2026-11-12_cryptographic-inventory-from-network-traffic) article walks through it.

## A migration plan in five steps

1. **Inventory.** Build the list above, starting with internet-facing services and the systems that carry long-lived secrets.
2. **Prioritise with Mosca.** Rank systems by how long their data must stay secret and how long they take to change.
3. **Turn on hybrid key exchange where it is already available.** Current browsers, TLS libraries and SSH versions support it; often it is a configuration or update away. Verify it on the wire afterwards.
4. **Ask suppliers.** Put post-quantum key exchange and signatures on the roadmap questions of every tender and renewal, with dates.
5. **Plan signatures and PKI.** Post-quantum certificates and code signing take longer, because whole chains of trust must change. Start the planning now; the deadlines above give you years, not months.

## What NetSenX shows

NetSenX does not protect anyone against quantum computers, and no monitoring product can: protection comes from changing the cryptography in your systems and your suppliers'. What NetSenX gives you is the visibility a migration starts from. NQCI, the NetSenX crypto inventory (in preview), is visible on every plan and active from the Pro plan with the packet-capture sensor switched on for a Linux agent or a sensor on a SPAN or TAP port. It shows which connections in monitored traffic still use quantum-vulnerable key exchange and which already use hybrid post-quantum key exchange, flags weak public keys seen in handshakes (for example RSA keys that share a factor with another key, the trace of a faulty random-number generator), and records changes over time, so you can see where updates have done the work and spot regressions later.

## Sources

- [Commission Recommendation (EU) 2024/1101 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography — EUR-Lex](https://eur-lex.europa.eu/eli/reco/2024/1101/oj)
- [A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography — European Commission](https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography)
- [NIST releases first 3 finalized post-quantum encryption standards — NIST](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)
- [Announcing the Commercial National Security Algorithm Suite 2.0 — NSA](https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF)
- [Directive (EU) 2022/2555 (NIS2), Article 21 — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)
- [Mosca, Cybersecurity in an era with quantum computers, IACR ePrint 2015/1075](https://eprint.iacr.org/2015/1075)

---

*Written by the NetSenX Team at TriStiX S.L. Questions: [info@netsenx.com](mailto:info@netsenx.com).*