Which of our data is at risk from harvest now, decrypt later?
Data that crosses a network today and must stay confidential beyond the arrival of a large quantum computer. Ask two questions of each data set: does it travel over a connection with quantum-vulnerable key exchange, and for how many years would its disclosure still hurt? Typical long-lived examples are patient and HR records, product designs and source code, merger and legal files, public-sector contracts, biometric data and credentials that are never rotated. Short-lived data, such as a one-time code or this month's prices, is not worth worrying about. Stored data is a different question: it is usually protected by symmetric encryption such as AES, which a quantum computer does not break, unless its keys are exchanged or wrapped with RSA. Write the list down with an owner and a retention period per item: it becomes the priority order for your migration and the basis for the Mosca calculation. A network sensor cannot classify your data; that list comes from your business.
This answer is part of the guide: Post-quantum readiness: where to start