G7 and CISA Set 5 Post-Quantum Migration Priorities

A Shared Playbook for Post-Quantum Migration

The G7 Cybersecurity Working Group, with CISA among the contributing agencies, published a call to action on September 3, 2026 titled "Preparing for the Post-Quantum Era." It is not an alert about a new attack, and there is no CVE attached. It is something more useful for defenders: an agreed international framing of what post-quantum migration involves and a phased method for starting it, which is exactly the thing most organizations have been missing.

• Five stated priorities: raise awareness of quantum-related risk, develop national PQC strategies, advance research and deployment, strengthen public-private coordination, and integrate PQC into cybersecurity requirements and procurement
• The recommended method is a phased, risk-based migration — inventory cryptographic assets, identify critical systems, map dependencies, then plan transitions
• The stated threat today is "harvest now, decrypt later" — encrypted data captured now and held for future decryption
• The UK has set 2035 as its completion deadline, with banking, finance and telecommunications expected to move first

Why the Threat Is Present Tense

The most common objection to post-quantum work is that cryptographically relevant quantum computers do not exist yet, so the migration can wait. The advisory's answer is the one cryptographers have been making for years, and it is the correct one: the exposure is already live for any data whose confidentiality has to outlast the machine.

"Harvest now, decrypt later" means an adversary captures encrypted traffic or exfiltrates encrypted archives today and simply stores them. Nothing needs to be broken at the time of collection. If the data still matters when a capable quantum computer arrives — government records, health data, identity documents, long-lived trade secrets, source code — the encryption protecting it was already insufficient at the moment of capture.

The advisory also flags a second exposure that gets less attention than confidentiality: authentication. Quantum-enabled attacks against signature schemes would let an attacker impersonate trusted entities and forge data. That risk is not retroactive in the same way, but it lands on every system that validates a signature, which is most of them.

What Should You Actually Do First?

The document's phased, risk-based approach is worth restating as a sequence, because the order is what makes it tractable.

Inventory first. You cannot migrate cryptography you cannot enumerate. That means a cryptographic bill of materials: which algorithms, key sizes and protocol versions are in use, in which systems, terminated where. For most organizations this step alone takes months and surfaces surprises — embedded devices with hardcoded algorithms, vendor appliances with no upgrade path, internal PKI nobody owns.

Then rank by data lifetime, not by system importance. The right prioritization question is not "which system is most critical" but "which system protects data that must stay secret past 2035." Those are different lists. A quarterly reporting database may be more business-critical than an archive of personnel records, and far less exposed to harvest-now-decrypt-later.

Then map dependencies. Cryptographic changes propagate. A library upgrade affects every service that links it; a certificate change affects every client that pins it.

Then fold PQC into scheduled refresh cycles. This is the advisory's most practical recommendation and the one most likely to actually happen: integrate quantum-resistant algorithms into routine hardware and software upgrades rather than running a separate rip-and-replace programme. Migration that rides existing budget lines gets done. Migration that needs its own budget line frequently does not.

Vendors Are Already Moving

The encouraging part is that the supply side is ahead of most buyers. Google Cloud has published a post-quantum readiness roadmap targeting 2029, OpenSSH shipped post-quantum signature support in 10.4, and Cloudflare has added downgrade protection for post-quantum IPsec tunnels. The primitives are standardized, the implementations exist, and in many stacks the hybrid key exchange is already on by default.

Which reframes the task. For most organizations this is not a research problem or a procurement problem. It is an inventory and rollout problem — knowing what you run, and turning on what your vendors have already shipped. More defensive guidance is in our AI security section.

On timelines: the advisory is explicit that the date of a cryptographically relevant quantum computer is uncertain, and treats that uncertainty as an argument for starting early rather than a reason to wait. The UK's 2035 target, with finance and telecoms in the first wave, is currently the clearest published national deadline to plan against.

Sources: Canadian Centre for Cyber Security — G7 Cybersecurity Working Group call to action on preparing for the post-quantum era — September 3, 2026; The Record by Recorded Future — September 4, 2026; CISA Post-Quantum Cryptography Initiative — 2026.