How do I apply Mosca's inequality?
Put three numbers side by side for each important data set or system. X is how many years the data must stay secret. Y is how many years it will take you to move that system to post-quantum cryptography, including suppliers, testing and budget cycles. Z is how many years remain until a quantum computer can break today's public-key cryptography. If X plus Y is greater than Z, data sent today is already exposed to harvest now, decrypt later. Michele Mosca described the inequality in 2015, in a paper published as IACR ePrint 2015/1075. Z is unknown, so do not pretend to know it: try a cautious and a relaxed value and see which systems fail even under the relaxed one. For example, contracts that must stay confidential for 10 years, on a system that needs 5 years to migrate, fail for any Z under 15 years. The result is a priority list, not a forecast, and it is reasoning an auditor or a board can follow.
This answer is part of the guide: Post-quantum readiness: where to start