Preparing for the Quantum Revolution: Understanding the NCSC's New PQC Roadmap

fahd.zafar • April 29, 2025

The UK's National Cyber Security Centre (NCSC) has recently unveiled a critical new roadmap for organisations to prepare for the quantum computing era. As your trusted technology partner, Altiatech is committed to helping you understand these developments and their implications for your security strategy.

The Quantum Threat to Current Encryption

Quantum computing represents one of the most significant technological leaps of our generation. While these advanced systems promise revolutionary benefits across industries, they also pose a substantial risk to our current security infrastructure.

Today's encryption methods rely on mathematical problems that conventional computers find extremely difficult to solve. However, quantum computers have the theoretical capability to solve these same problems exponentially faster, potentially rendering current encryption methods obsolete.

This means sensitive data that is secure today could become vulnerable in the quantum future—including banking transactions, confidential communications, intellectual property, and personal identifiable information.


The NCSC's Three-Phase Migration Plan

To address this looming challenge, the NCSC has outlined a structured timeline for organisations to transition to post-quantum cryptography (PQC)—encryption methods designed to withstand quantum computing attacks. The roadmap consists of three key phases:

Phase 1: Planning and Assessment (Now to 2028)

  • Identify cryptographic services and systems requiring upgrades
  • Build a comprehensive migration plan
  • Begin educating teams on PQC requirements
  • Monitor developments in PQC standards

Phase 2: Priority Implementation (2028-2031)

  • Execute high-priority upgrades for the most sensitive systems
  • Refine migration plans as PQC standards mature
  • Implement dual-mode cryptography where appropriate
  • Begin testing PQC solutions in production environments

Phase 3: Complete Migration (2031-2035)

  • Finalise migration to PQC across all systems, services, and products
  • Phase out legacy cryptographic methods
  • Ensure supply chain partners have also completed their PQC migration
  • Validate security posture in the post-quantum environment


What This Means for Your Organisation

The good news is that for many small and medium-sized businesses, this transition will likely be relatively seamless. Much of the heavy lifting will be handled by service providers and technology vendors through routine updates and upgrades.

However, larger organisations and those in regulated industries or handling particularly sensitive data should begin preparing now. This proactive approach ensures a controlled, methodical migration rather than a rushed implementation when quantum computers eventually become a practical threat.

As Ollie Whitehouse, NCSC Chief Technical Officer, states: "As quantum technology advances, upgrading our collective security is not just important—it's essential."

How Altiatech Can Help

At Altiatech, we're committed to helping our clients navigate technological transitions securely and efficiently. As this post-quantum journey unfolds, we'll be:

  • Staying abreast of evolving PQC standards and best practices
  • Providing guidance on assessing your cryptographic inventory
  • Offering expertise in implementing quantum-resistant solutions
  • Ensuring your systems and data remain protected through the transition

The quantum revolution brings both exciting opportunities and security challenges. By starting preparations now, organisations can ensure they remain secure in the quantum future while leveraging the benefits these powerful new computing paradigms will offer.

For more information on how your organisation can prepare for the post-quantum era, contact our team today at innovate@altiatech.com or call us at +44 (0)330 332 5482.

October 31, 2025
Zero trust has become one of the most discussed concepts in cybersecurity, yet widespread misconceptions make it difficult for organisations to understand what it actually involves. Vendor marketing hasn't helped, with many claiming their products deliver "zero trust" when in reality, it's neither a product nor a simple switch you can flip.  This guide cuts through the confusion to explain what zero trust genuinely means and when your organisation should consider adopting it.
October 30, 2025
A critical vulnerability in Chromium's Blink rendering engine remains unpatched despite being disclosed to Google over two months ago, leaving billions of users vulnerable to browser crashes and system freezes.
October 30, 2025
Microsoft's Azure cloud platform experienced a significant global outage on Wednesday, taking down major websites including Heathrow Airport, NatWest, Minecraft, and numerous retailers across several hours before services were restored.
By fahd.zafar October 28, 2025
AI-powered browsers with agentic capabilities are introducing a fundamental security vulnerability that experts believe may never be fully resolved: prompt injection attacks.
October 28, 2025
The National Cyber Security Centre has taken the extraordinary step of co-signing a ministerial letter to chief executives and chairs of Britain's leading businesses, including all FTSE 350 companies. The message is unambiguous: cyber security is no longer just an IT concern—it's a matter of business survival.
October 24, 2025
Microsoft published an unscheduled security patch on Friday addressing a severe vulnerability in Windows Server Update Services (WSUS), creating weekend work for system administrators.
October 24, 2025
Alaska Airlines experienced its second mystery IT outage in three months, grounding its entire fleet for eight hours and cancelling over 360 flights. The incident raises uncomfortable questions about disaster recovery planning in critical infrastructure.
By fahd.zafar October 24, 2025
Amazon has revealed the shocking cause behind one of history's most devastating cloud outages: a simple race condition in DynamoDB's DNS management system brought down AWS services globally for an entire day, with damage estimates potentially reaching hundreds of billions of dollars.
By fahd.zafar October 21, 2025
When Amazon Web Services' US-EAST-1 region went down on 20th October, it didn't just affect services in Northern Virginia—it brought down websites and critical services across the globe, from European banks to UK government agencies. The incident has exposed a fundamental vulnerability in modern cloud infrastructure that no amount of redundancy planning can fully address.
By fahd.zafar October 20, 2025
The numbers are stark and deeply concerning. The National Cyber Security Centre (NCSC) handled a record 204 nationally significant cyber attacks in the year to September 2025—an average of four every single week. This represents a dramatic increase from 89 incidents in the previous year, more than doubling in just 12 months.  For British businesses, this isn't abstract threat intelligence—it's a clear warning that the cyber threat landscape has fundamentally changed, and urgent action is required.