Short answer: you don’t need to rush, but you should start paying attention.

What governments are doing

– Canada: In June 2025, the Canadian Centre for Cyber Security published a roadmap for migrating Government of Canada non-classified systems to post-quantum cryptography. Departments were to submit initial migration plans by April 2026, complete high-priority systems by the end of 2031, and finish all remaining systems by 2035.

– United States and United Kingdom: Similar roadmaps point to the early-to-mid 2030s for completing transitions.

– Financial sector: International regulators have called for coordinated transition planning.

The Cyber Centre notes that not all existing systems can be retrofitted. Some will need to be replaced.

Why it matters to private businesses

– Suppliers to government may face contract requirements for quantum-safe systems over time

– Customers in finance and healthcare may begin asking about your plans

– Your vendors will roll out PQC in browsers, operating systems, VPNs, and cloud platforms, usually through normal updates

– Equipment bought today may still be in use in 2035. Choose vendors that commit to updates.

A sensible business approach

Now:

– Make an inventory of where you use encryption (VPNs, certificates, applications, hardware)

– Identify data that must remain confidential long-term

– Ask key vendors for their PQC timelines

Over the next few years:

– Keep systems and firmware current

– Prefer vendors with a clear PQC roadmap in purchasing decisions

– Retire unsupported systems

Later:

– Test and adopt PQC features as they appear in your platforms

What not to do

– Don’t buy “quantum-proof” products from unproven vendors

– Don’t build your own encryption

– Don’t let this distract from basics like MFA and patching, which prevent far more attacks today

Sources: Canadian Centre for Cyber Security, ITSM.40.001 (June 2025).

DBR Soft can help you build a cryptography inventory and plan sensible next steps. Contact us for more information.