CISA and the G7 Just Told Enterprises to Move on PQC. Here Is What That Means.

· Industry · 6 min read

Governments rarely speak in unison. This time they did.

In late August 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) published a document titled "Preparing for the Post-Quantum Era: A Call to Action" - issued in coordination with G7 partners. The message was blunt: advances in quantum computing could eventually enable cryptographically relevant quantum computers to break the public-key cryptography that protects most digital infrastructure, and organizations should begin preparing now.

When a single agency publishes guidance, enterprises can debate the timeline. When CISA and the G7 coordinate the same message in the same window, the debate is over. The planning clock has started.

What the call to action actually asks for

Strip away the diplomatic language and the guidance converges on one first step - the same one NIST, the EU, and Gartner have all landed on:

You cannot protect what you cannot see. Before any migration, before any budget request, before any vendor conversation, you need a complete inventory of the cryptography running across your organization.

This is the recurring theme across every serious 2026 framework:

  • Gartner calls cryptographic inventory the first step of the transition and warns that enterprises with data that must live beyond 2030 should already be moving.
  • The EU coordinated roadmap asks member states to complete cryptographic inventories by the end of 2026.
  • NIST IR 8547 sets the destination - quantum-vulnerable public-key algorithms deprecated after 2030, disallowed after 2035.

The pattern is unmistakable: discovery first, then a prioritised plan, then execution.

Why "start now" is not alarmism

Two forces make early action rational rather than reactive:

1. Migration is measured in years

An enterprise cryptographic estate - certificates, key exchange, code signing, VPNs, key management, hardcoded crypto in source - takes multiple years to migrate. Starting the discovery work in 2026 is what makes a 2030 deadline achievable.

2. Harvest Now, Decrypt Later is already running

Encrypted data with long-term sensitivity that is intercepted today can be decrypted once quantum computers arrive. For data that must stay confidential beyond 2030, the exposure has already begun. No future migration retroactively protects traffic captured today.

The gap between "we have a plan" and "we have visibility"

Here is the uncomfortable truth surfacing in 2026 survey data: most organizations that say they are "working on PQC" have not actually mapped their cryptography. They have a slide, not an inventory.

That gap is exactly what a full-lifecycle platform closes. Scanners and agents map the cryptography across external endpoints, internal services, cloud, code, and vendor integrations - score each one for quantum exposure, produce a prioritised migration plan mapped to the framework your auditors will cite, and generate the migration artifacts (PQC keys, certificates, CSRs, hybrid-TLS configs) for the team to deploy.

Execution is where the industry is heading. The next step is orchestrated execution, where the platform applies each change with human approval and rolls back on failure. Ask any vendor, including us, exactly which of those steps ships today.

What to do this quarter

  1. Run a cryptographic discovery pass. Get a real inventory - a Cryptographic Bill of Materials - not an estimate.
  2. Score by exposure and regulation. Know which assets are quantum-vulnerable and which framework requires action.
  3. Produce a prioritised plan. Sequence the migration by risk, business impact, and regulatory urgency.
  4. Assign an owner. Recent research found nearly half of organizations have no single person leading PQC migration. Fix that first.

CISA and the G7 did their part - they removed the excuse to wait. The next move is yours.

Qypher runs the discovery pass, generates your CBOM, scores quantum exposure, delivers a prioritised, regulator-mapped migration plan, and generates the migration artifacts your team deploys. Run a free scan →

Sources: CISA / G7 "Preparing for the Post-Quantum Era: A Call to Action" (Aug 2026); NIST IR 8547; EU Coordinated PQC Implementation Roadmap; Gartner cryptographic governance research.