Red Hat is advising organizations to inventory their cryptography, prioritize sensitive systems and begin testing quantum-resistant algorithms as government deadlines put pressure on security teams to prepare for migration.
The software company’s guidance divides migration to post-quantum cryptography, or PQC, into four stages, beginning with an assessment of sensitive data and ending with deployment across operating systems and applications.
The concern is that sufficiently powerful quantum computers could defeat widely used public-key cryptography, which helps protect information and verify identities. Such machines are not yet known to exist, and their arrival remains uncertain. But attackers could collect encrypted information today and decrypt it later, exposing data that needs to remain confidential for years.
Federal requirements add urgency. A June memorandum from the Office of Management and Budget requires agencies to submit migration plans within 120 days, placing the deadline in late October 2026. It lays out prioritized migration for key establishment by 2030, digital signatures by 2031 and remaining systems by 2035, subject to risk and commercial availability. The memorandum excludes national security systems.
1. Map Sensitive Data and Its Protections
Red Hat recommends assembling a team spanning business operations, legal, compliance and IT to identify sensitive information and trace the ways it can be accessed.
That assessment should consider both current sensitivity and how long information will need protection. Data with a lengthy confidentiality requirement can face exposure well before a quantum computer capable of decrypting it becomes available.
Organizations should then inventory their cryptographic protocols, identifying which need urgent updates, which can be modified and which face hardware or software restrictions. This establishes the scope of the work before teams begin making changes.
2. Rank Systems for Migration by Priority
Organizations cannot realistically update every asset at once, according to Red Hat. Instead, teams should use their initial assessment to determine which systems require immediate attention and which can follow later.
The process connects migration decisions to the information being protected and the constraints surrounding each system. A ranked plan also gives teams a practical sequence for allocating resources and scheduling upgrades.
3. Test Algorithms in the Working Environment
Red Hat advises organizations to test quantum-resistant algorithms early so they can uncover compatibility problems before deployment.
The National Institute of Standards and Technology finalized its first three PQC standards in August 2024 and encouraged organizations to begin transitioning.
As part of its guidance, Red Hat promotes Enterprise Linux 10.2 as a platform for testing and adoption. Its PQC capabilities include ML-KEM, used to establish shared secret keys, and ML-DSA, used for digital signatures that help verify authenticity and detect tampering.
Testing should establish how new cryptographic protections interact with existing applications, connected systems and operational requirements.
4. Move Into Production Gradually
The final stage is deploying quantum-resistant cryptography across production systems, a process Red Hat describes as a sustained effort.
Teams should follow the priorities established earlier and account for dependencies uncovered during testing. Changing one component can affect others that rely on it, creating compatibility problems or downtime.
Red Hat’s guidance places that preparation at the center of migration, with assessment, prioritization and testing providing the basis for a manageable rollout.
