Quantum computing still sounds distant to many business owners. For most small organisations, it is not something to prioritise above backups, patching, multi-factor authentication, website maintenance or supplier access control.
But one part of the quantum conversation has become practical: encryption planning. The UK National Cyber Security Centre has now set clear milestone dates for post-quantum cryptography migration, and NIST has published the first main post-quantum cryptography standards. This does not mean a small business needs to rebuild its systems today. It does mean that businesses with long-lived data, customer portals, VPNs, industrial systems, bespoke software or connected products should start mapping where cryptography matters.
The sensible first step is not buying a fashionable quantum-safe product. It is understanding which systems protect valuable data, which suppliers control those systems, and which upgrades will depend on contracts, hardware replacement cycles or software roadmaps.
What Post-Quantum Cryptography Means
Much of today’s internet security depends on public key cryptography. It is used in HTTPS, VPNs, software updates, digital signatures, identity systems, device certificates and many other places where systems need to agree keys or prove trust.
The concern is that a future large-scale, fault-tolerant quantum computer could break important forms of current public key cryptography. That machine does not exist today, and no credible guidance says that ordinary business websites are suddenly unsafe. The risk is a planning risk: cryptography is buried deep in software, devices, cloud services and supplier platforms, and changing it across an estate takes time.
Post-quantum cryptography, often shortened to PQC, means cryptographic algorithms designed to resist attacks from both classical and quantum computers. The aim is to replace quantum-vulnerable public key algorithms without weakening the rest of the security model during the change.
The Timeline Is Now Concrete Enough to Plan Around
The NCSC’s timelines for migration to post-quantum cryptography set three headline milestones for organisations planning the move:
- By 2028: define migration goals, carry out a discovery exercise and build an initial migration plan.
- By 2031: carry out the highest-priority migration activities and refine the plan into a fuller roadmap.
- By 2035: complete migration of systems, services and products to post-quantum cryptography.
The guidance is aimed mainly at larger organisations, critical national infrastructure, industrial control systems and bespoke IT estates. That matters for Bloom’s audience because smaller firms increasingly sit inside those supply chains. A manufacturer, engineering business, software supplier or managed service provider may be asked by a larger customer how it is preparing, even if the business itself is not running a complex cryptography programme.
NIST’s post-quantum cryptography project says organisations should begin migrating systems to quantum-resistant cryptography now that the first three standards are available. Those standards include FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA. In plain English, these cover key establishment and digital signatures, two of the building blocks used to secure modern systems.
Why Small Businesses Should Care Before 2035
For many small businesses using standard cloud services, browsers, managed hosting and mainstream devices, a lot of the eventual change should arrive through normal vendor updates. That is good news. It also means the immediate job is often supplier management rather than cryptographic engineering.
The risk becomes more direct when a business has systems that are not easy to swap out. Examples include:
- customer portals, booking platforms or membership systems with sensitive personal data;
- VPNs, firewalls, remote access tools and private certificates;
- ERP integrations, API gateways, EDI services and supplier portals;
- industrial controllers, IoT devices, sensors or connected products with long service lives;
- software update mechanisms, firmware signing, secure boot or device identity systems;
- archived data that needs to remain confidential for many years.
The last point is easy to overlook. If encrypted data is valuable for a long time, an attacker could collect it now and try to decrypt it later when technology improves. Not every business holds data with that kind of lifetime, but some do: commercial designs, legal files, health-related records, credentials, contracts, industrial data, financial records and customer datasets may all have a longer useful life than the systems currently protecting them.
Do Not Turn This Into A Buying Panic
The practical mistake would be to treat post-quantum readiness as a single product purchase. NCSC guidance is careful about this: migration needs discovery, planning, testing, supplier coordination and cryptographic agility. It also notes that most organisations and suppliers should not be writing their own PQC implementations.
For smaller businesses, that translates into a simple rule: buy boring, standards-aligned, well-supported upgrades from credible suppliers when they become available. Be wary of vague claims such as “quantum-proof”, “future-proof encryption” or “PQC-ready” if the supplier cannot explain which standards are involved, what is already implemented, what remains experimental and how the upgrade will be tested.
There will be a transition period where old and new cryptography need to coexist. That makes compatibility and rollback planning important. A rushed change to certificates, VPNs or software signing can create outages or new security gaps if clients, servers, devices and suppliers are not ready at the same time.
A Practical First Checklist
A useful PQC preparation exercise can be modest. The aim is to make future decisions easier, not to create a huge security programme overnight.
- List the systems that use strong trust. Include websites, portals, VPNs, APIs, payment systems, cloud platforms, device fleets, firmware updates and private certificates.
- Identify long-lived data. Note which data would still matter if exposed in five, ten or more years.
- Record who controls each layer. Separate your web host, DNS provider, cloud provider, software vendor, IT support partner, ERP supplier and equipment manufacturer.
- Ask suppliers about their roadmap. Look for standards-based answers, expected upgrade paths, testing plans and support timelines.
- Prioritise hard-to-replace systems. Long-life hardware, industrial devices, bespoke software and embedded products need earlier planning than commodity SaaS.
- Build crypto-agility into new work. When commissioning software, integrations or connected devices, avoid designs where algorithms, certificates or trust stores are impossible to update.
- Use normal refresh cycles. Align PQC readiness with server upgrades, firewall replacement, platform migrations, device refreshes and contract renewals.
What To Ask When Buying Or Renewing Technology
Procurement is one of the best places to reduce future pain. A small business does not need to demand immediate PQC support in every system, but it should avoid buying technology that will become a dead end.
Useful supplier questions include:
- Which cryptographic libraries, protocols or managed services does the product rely on?
- Will security updates include support for NIST-standardised post-quantum algorithms?
- How will certificates, keys, firmware signing or device identity be updated?
- Does the product support algorithm agility, or is cryptography fixed into the design?
- What is the expected support lifetime of the hardware or software?
- Can the supplier provide a roadmap for VPNs, private PKI, APIs, secure boot or update signing where relevant?
These questions are especially important for industrial and connected-product environments. A normal laptop may be refreshed every few years. A machine controller, sensor network or embedded device may remain in place for a decade or more, sometimes in locations that are difficult to service. That is where early planning has the most value.
The Bottom Line
Post-quantum cryptography is not an emergency for most small businesses today. It is a long technology transition that has moved from theory into planning. The best response is calm inventory work: know where cryptography protects valuable data, know which suppliers control it, and avoid new systems that cannot be upgraded.
That approach also improves ordinary cyber resilience. A business that understands its certificates, VPNs, APIs, software updates, device estate and supplier responsibilities is better prepared for many current risks, not just future quantum ones.