TL;DR: Forty-eight percent of organisations say they are not prepared for post-quantum cryptography, while only 28% have both budget and personnel committed to readiness, according to a Keyfactor survey of 450 security professionals across North America and Europe. The issue is less about algorithms than about governance, inventory, and ownership across identity-linked cryptographic assets.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Post-quantum cryptography readiness is being held back by weak governance, unclear ownership, and incomplete monitoring of cryptographic assets.
Why it matters: IAM, PKI, and security teams need to treat PQC as an identity and asset governance problem because migration success depends on inventory, ownership, and funded accountability.
Context
Post-quantum cryptography readiness is the discipline of finding where cryptographic assets live, deciding who owns them, and planning migration before current algorithms become unsafe. In identity and access environments, that means certificates, keys, and dependent systems must be inventoried and governed as part of a broader lifecycle.
Keyfactor’s analysis argues that the real blocker is not a lack of awareness but a lack of operating structure. The article links readiness to governance, budget, and monitoring gaps, which is why PQC planning now belongs in security architecture, IAM, PKI, and audit conversations rather than being treated as a future crypto refresh.
Key questions
Q: What is the biggest failure mode in PQC readiness programmes?
A: The biggest failure mode is treating PQC as a future crypto swap instead of a governed inventory and ownership problem. When teams cannot identify cryptographic assets, map dependencies, or name accountable owners, migration becomes speculative and delayed. That leaves the organisation exposed to rushed decisions once deadlines or external pressure finally arrive.
Q: Why does PQC readiness depend so heavily on governance?
A: Because PQC affects many teams at once, including PKI, application owners, security architecture, procurement, and executive budget holders. If those groups do not have clear decision rights, readiness work stalls even when the risk is understood. Governance turns scattered technical tasks into a coordinated transition programme with accountability.
Q: How can security teams tell whether PQC visibility is real?
A: Visibility is real only when cryptographic assets are actively monitored and tied to business services, not when a survey answer says teams know where things are. If certificates, keys, and dependencies are not tracked continuously, hidden exposure will survive the next migration plan. Monitoring is the proof point, not the claim.
Q: Should organisations wait for regulator pressure before funding PQC work?
A: No. Waiting for external pressure usually means the programme starts too late and with too little flexibility. The article shows that many organisations are already underprepared, so deferring funding only increases the chance of rushed migrations, weak ownership, and missed dependencies when timelines tighten.
Technical breakdown
Why PQC readiness fails before migration begins
PQC programmes usually stall before any algorithm change happens because organisations cannot answer basic ownership and inventory questions. If teams do not know where cryptographic assets are deployed, who manages them, and which applications depend on them, migration becomes a guesswork exercise. That is why the article’s readiness gap is really a governance gap: visibility without active monitoring, funding without personnel, and urgency without a plan all delay the work that has to happen first.
Practical implication: build a complete cryptographic inventory and assign accountable owners before planning any migration sequence.
Why governance matters more than crypto choice
Post-quantum readiness is often framed as a technology selection exercise, but the article shows the limiting factor is organisational coordination. PQC touches application teams, PKI operators, security architecture, procurement, and executive budget holders. Without cross-functional sponsorship, even validated algorithms and published timelines do not translate into action. The operational challenge is therefore not just changing cryptography, but aligning decision rights across systems that depend on it.
Practical implication: treat PQC as a governance programme with explicit ownership, funding, and decision authority across teams.
How inventory becomes the control plane for transition
Inventory is the control plane for PQC because migration only works when teams can map cryptographic dependencies to business services. That includes certificates, key usage, and where cryptography is embedded in applications, devices, and trust chains. The article’s point is that implementation follows visibility, not the other way around. If the dependency map is incomplete, migration plans will miss hidden exposure and create avoidable service disruption.
Practical implication: map cryptographic dependencies to business services so transition planning can be sequenced and tested with less risk.
NHI Mgmt Group analysis
PQC readiness is an identity governance problem before it is a cryptography problem. The article shows that organisations are not failing because the algorithms are unavailable, but because ownership, funding, and monitoring are not aligned. That pattern matters to IAM and PKI teams because cryptographic assets sit inside the same governance structures that manage access, trust, and lifecycle. The practitioner conclusion is that readiness must be governed as an operating model, not a one-time technical upgrade.
Inventory is the decisive missing control in most PQC programmes. If 92% of organisations believe they have visibility but only 47% actively monitor cryptographic assets, the real issue is not awareness but operational control. Readiness requires a live dependency map of certificates, keys, and systems that depend on them, otherwise migration remains speculative. The practitioner conclusion is that hidden cryptographic sprawl is now a material governance risk.
Budget and staffing gaps turn PQC into deferred risk. Only 28% of organisations in the survey report both budget and personnel committed to readiness, which means most programmes are structurally underpowered before they begin. That is a governance failure, not a technical constraint, because unassigned work simply accumulates until deadlines force bad decisions. The practitioner conclusion is that PQC planning needs named ownership and resourced execution.
Waiting for external urgency is a failure mode, not a strategy. With 57% of respondents waiting for regulators, peers, or a stronger signal, organisations are outsourcing timing to the market instead of managing their own risk horizon. That approach leaves long-lived trust relationships exposed to a deadline-driven scramble. The practitioner conclusion is that the organisation that waits longest will have the least flexible migration path.
Cryptographic transition needs a lifecycle model, not an algorithm checklist. PQC affects the full lifecycle of identities, certificates, and dependent applications, from discovery through replacement and retirement. That makes it closer to identity governance than a pure cryptography project. The practitioner conclusion is that teams should manage PQC as a controlled lifecycle transition with clear ownership at every stage.
What this signals
Cryptographic dependency mapping is the practical bridge between PQC strategy and execution. Organisations that cannot trace which services depend on which certificates or keys will struggle to sequence migration, validate cutover, or retire old trust paths safely.
PQC also exposes a familiar governance weakness: visibility claims are often stronger than operational control. Teams should assume that self-reported inventory is not enough unless they can demonstrate active monitoring, named ownership, and a tested migration path.
For identity programmes, the lesson is broader than quantum readiness. Any trust transition that depends on certificates, authentication, or service dependencies will fail if ownership is diffuse and the asset baseline is incomplete.
For practitioners
- Build a cryptographic asset inventory Identify certificates, keys, and cryptographic dependencies across applications, infrastructure, and identity services before selecting migration targets.
- Assign named PQC ownership Give one accountable owner per system or trust domain so readiness work does not stall between PKI, security, application, and executive teams.
- Separate funded work from unfunded intent Translate readiness into a resourced programme with staffing, milestones, and executive sponsorship rather than waiting for a future mandate.
- Prioritise high-risk trust chains first Start with the systems where cryptographic failure would most directly affect sensitive data, authentication, or regulated services.
- Turn visibility into active monitoring Move from periodic asset awareness to continuous monitoring of cryptographic assets so drift and hidden dependencies are detected early.
Key takeaways
- PQC readiness is being slowed less by algorithm uncertainty than by weak governance over ownership, inventory, and monitoring.
- The article’s survey data shows a clear readiness gap, with most organisations lacking the resourcing needed to move beyond intent.
- Teams that want to reduce quantum-transition risk need a live cryptographic inventory, accountable ownership, and a funded migration plan.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventory | PQC readiness depends on knowing where cryptographic assets and dependencies exist. |
| GV.OC-03 — Legal, Regulatory, and Contractual Requirements are Understood and Managed | The article cites NIST and regional timelines, making regulatory timing central to PQC planning. | |
| Recommendation — Inventory cryptographic assets and dependencies so migration planning starts from a complete asset baseline. Map PQC deadlines and mandates into your governance programme and assign owners for compliance tracking. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Key and certificate lifecycle control is central to post-quantum transition planning. |
| Recommendation — Apply authenticator lifecycle controls to track, rotate, and retire cryptographic credentials before migration deadlines. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cryptographic assets underpin trusted access relationships and their lifecycle must be governed. |
| Recommendation — Use IAM governance to assign ownership, review dependencies, and control trust relationships tied to cryptographic assets. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | PQC readiness depends on a credible inventory of assets that rely on cryptography. |
| Recommendation — Maintain an inventory of cryptographic assets and dependencies before planning any migration work. | ||
Key terms
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
- Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.
- Cryptographic Transition Readiness: Cryptographic transition readiness is the ability to migrate identities and trust chains when existing algorithms or certificates no longer meet risk or compliance needs. It requires an inventory of dependencies, prioritised migration paths, and governance that links technical changes to business criticality.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org