PQC tools · migration board · sample
What done means, asset by asset.
A migration board sorts every system that uses cryptography by where it stands. The rule that matters: an asset counts as migrated only when there is evidence, not when a team says it is finished.
This board is sample data for an invented organization, as of 2026-07-29. It shows how we report status in an engagement.
migrated with evidence: 2 of 9 assets in scope
claimed as done without evidence, so not counted
accepted exception, never counted as done
The board
Migrated, with evidence we can show you.
A team says it is done. Not counted until there is evidence.
Work has started.
Still on classical cryptography.
Accepted risk, with a reason and an end date. Never counted as done.
The dates it works against
31 December 2030 Post-quantum key establishment
31 December 2031 Post-quantum digital signatures
US federal agencies, for high value assets and high impact systems. It also directs a proposed rule requiring covered federal contractors to comply with NIST post-quantum standards by 31 December 2030.
31 December 2026 National transition plans and first pilots
31 December 2030 High-risk use cases transitioned
31 December 2035 Medium-risk use cases transitioned
A recommendation to EU Member States, not a law that binds a firm directly. It cites DORA and NIS2 as rules that already require state-of-the-art cryptography.
31 December 2030 Classical key establishment deprecated
After 2035 Classical public-key algorithms disallowed
US guidance, still a draft. US agencies must align their plans with it.
Your estate
A board for the systems you actually run.
The assessment finds what you run; the migration replaces it phase by phase.