A quantum-safe deadline starts with a cryptographic inventory

Cryptography is embedded in certificates, application libraries, network protocols, hardware and services owned by different teams. Microsoft’s 16 April guidance argues that discovering those uses is the foundation of a post-quantum migration. Choosing a replacement algorithm does little if an organisation cannot identify where the old one still runs.

The account calls for an ongoing lifecycle process, including responsibility for the systems involved. A useful record needs to connect cryptographic use with the application, dependency and owner that can change it. Otherwise, a future vulnerability or requirement produces another urgent search through disconnected systems. The inventory is also relevant to ordinary cryptographic maintenance before a quantum-capable adversary exists.

Microsoft’s 30 June announcement brought forward its Quantum Safe Programme goal to transition its products and services to post-quantum cryptography by 2029. It described the change as a response to a shifting risk horizon and the time needed for a multi-year migration. The date is Microsoft’s programme target; it is not a prediction that a particular quantum computer will arrive that year.

For customers, the two accounts point to a sequence: identify dependent systems, establish ownership, determine what can be upgraded and test the route through suppliers and applications. A claimed platform transition is one input to that plan. Compatibility and the customer’s own dependencies still need review. The useful planning question is which systems cannot change quickly and what evidence will show that a migration is complete. An inventory that stays current makes that question answerable as products, standards and deadlines evolve.