Quantum computers that can break today’s public-key encryption may still be years away. The data they would decrypt is being collected now.
The tactic is called “harvest now, decrypt later.” An adversary captures encrypted traffic and stored data today and holds it until quantum computing can crack it. Anything that needs to stay confidential for years, such as financial records, health information, intellectual property or defense-related work, is already exposed if it moves over classical key exchange.
The standards and deadlines are set
NIST released its first three finalized post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. “We encourage system administrators to start integrating them into their systems immediately,” said Dustin Moody, the NIST mathematician who leads the project.
NIST’s draft transition guidance, NIST IR 8547, proposes deprecating quantum-vulnerable algorithms such as RSA and elliptic curve cryptography by 2030 and disallowing them after 2035. The NSA’s CNSA 2.0 suite sets a 2035 deadline for national security systems to complete the move, with earlier milestones for some system types.
Those dates sound distant, but migrations of this size take years. And none of them can start until a client knows where its cryptography is.
Start with the inventory
Most organizations don’t have a complete picture of where they use encryption. It sits in firewalls, VPNs, cloud platforms, identity systems, databases, applications, backups and endpoint tools. It also sits in the MSP’s own remote access and RMM connections. Before anything gets migrated, clients need to know what depends on what.
That gap is where MSPs come in.
What MSPs can productize now
- Cryptographic discovery and inventory. Map where key establishment and digital signatures are used across the environment. Prioritize long-lived data stores and high-value traffic.
- Quantum readiness assessment. Score the current posture against NIST guidance, identify where hybrid classical and post-quantum approaches make sense and flag vendor readiness.
- Vendor and application compatibility reviews. Document which tools already support post-quantum algorithms, which have them on the roadmap and which will need replacement or compensating controls.
- A living migration roadmap. Update it quarterly as standards and vendor support change. Higher tiers can add tabletop planning or fold the roadmap into the compliance and insurance evidence packs clients already receive.
How to price it
Price discovery and the initial assessment as a project. Price ongoing monitoring, quarterly re-inventory and roadmap updates as a recurring service, either on its own or as an add-on to a vCISO or compliance retainer. Keep major remediation, such as algorithm swaps, certificate reissues and hardware refreshes, as separate projects.
Pick three clients
Start with three clients that hold long-lived sensitive data. Deliver the inventory and a one-page readiness score, then use the findings in the next QBR to propose the ongoing tier.
Clients and their insurers will eventually ask for a post-quantum plan. The MSPs that start the inventory now will have one ready when they do.
