Some of the world's leading democracies are pushing governments and companies to start preparing for post-quantum cryptography before quantum computers become powerful enough to break the encryption systems that protect global digital infrastructure today.

In a joint advisory released Thursday, the G7 Cybersecurity Working Group and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said organizations should begin their transition to post-quantum cryptography now, rather than waiting until cryptographically relevant quantum computers (CRQCs) are available to threat actors.

Why the Post-Quantum Cryptography Shift Cannot Wait

The publication, titled "Preparing for the Post-Quantum Era: A Call to Action," warns that the quantum computing threat is no longer a distant concern. While the exact timeline for CRQC development remains uncertain, the working group said recent technological advances suggest such machines could emerge sooner than expected, putting widely used public-key cryptography mechanisms at risk.

One of the most immediate dangers is a tactic known as "harvest now, decrypt later," where malicious actors intercept and store encrypted data today with the intention of decrypting it once a CRQC becomes available. This poses a serious risk to governmental records, sensitive personal data, and trade or business secrets that require long-term confidentiality.

The advisory also cautions that CRQCs could eventually be used to target authentication mechanisms, allowing bad actors to impersonate trusted entities, forge data, or compromise equipment. Because supply chain vulnerabilities can cascade, a single organization's delay in adopting post-quantum cryptography could expose entire sectors to compromise.

According to the report, organizations that fail to act may also face business consequences beyond security risk, including exclusion from public procurement contracts and loss of competitive advantage.

Five Priorities for the PQC Transition

The G7 Cybersecurity Working Group outlined five priority areas to guide the global shift toward post-quantum cryptography:

1. Raising awareness — Many organizations still view the quantum threat as a distant or purely technical issue. The group called for awareness campaigns, technical guidance, and workforce upskilling to reframe it as an economic and business risk.
2. Developing national strategies — Countries are encouraged to build strategies that ensure an adequate supply of quantum-safe hardware and software while encouraging adoption, integrating the effort into broader digital privacy and security policies.
3. Advancing research and development — Governments should fund research programs and support pilot projects and testbeds to help organizations test and refine their transition to post-quantum cryptography.
4. Building public-private partnerships — Collaboration between government, industry, and academia is seen as key to developing domestic expertise, lowering transition costs, and sharing playbooks and case studies across sectors.
5. Integrating PQC into cybersecurity requirements — The group recommends treating post-quantum cryptography adoption as a natural evolution of cryptographic best practice, and embedding requirements into public procurement to push both vendors and organizations toward quantum-safe systems.

The advisory emphasizes that the shift to post-quantum cryptography cannot be solved by individual organizations in isolation. Instead, it calls for early engagement, coordinated planning, and informed decision-making across public and private sectors worldwide.

Tackling the risks that the impending quantum computing era poses to current cryptographic systems... requires a coordinated global effort to transition to PQC," the report states, adding that public and private organizations must act now to safeguard confidential data, supply chains, and critical systems.

The document was jointly published by cybersecurity authorities from Canada, Germany, Italy, Japan, the United Kingdom, the United States, and France's ANSSI, with participation from the European Commission and support from the EU Agency for Cybersecurity (ENISA).

How is NCAF 2.0 Different?

• New descriptions of maturity levels reflect the dynamic nature of cybersecurity challenges, enabling more accurate assessments of national capabilities.  
• The framework includes updated goals that address emerging cybersecurity threats and align with evolving EU policies, such as the NIS2 Directive, which came into force in January 2023.  
• A set of comprehensive questions designed to assess the maturity of various cybersecurity areas, including governance, risk management, and incident response.  

Who Can Benefit from NCAF 2.0? 

The EU Cybersecurity Landscape 

Challenges in Assessing National Cybersecurity Strategies 

• Coordination Across Stakeholders: Ensuring effective collaboration between government agencies, businesses, and cybersecurity experts can be difficult, especially in countries with fragmented governance structures.  
• Adapting to Evolving Threats: As cyber threats continue to evolve, national strategies must be flexible and adaptive. Member States must continuously update their plans to address emerging risks.  
• Measuring Effectiveness: It is not enough to track the implementation of cybersecurity measures; it is also important to assess the long-term impact and success of these efforts. This requires a comprehensive evaluation of outcomes, not just outputs.  

The Benefits of Using NCAF 2.0 

1. Self-Assessment and Continuous Improvement: The framework provides a voluntary tool for Member States to evaluate their cybersecurity maturity and track progress over time. By identifying gaps and areas for improvement, countries can strengthen their cybersecurity capabilities.  
2. Alignment with EU Regulations: NCAF 2.0 is aligned with key EU legislation, including the NIS2 Directive and the Cyber Resilience Act. This ensures that national strategies comply with EU-wide cybersecurity standards.  
3. Support for Peer Reviews: NCAF 2.0 can be used as part of the voluntary peer review process established under NIS2. This allows Member States to collaborate, share best practices, and enhance their collective cybersecurity efforts.  

Maturity Levels in NCAF 

• Level 1: Foundation: Countries at this level have begun their cybersecurity journey but lack a comprehensive, coordinated approach.  
• Level 2: Developing: At this stage, national strategies are in place, but implementation is still in the early stages.  
• Level 3: Established: Member States at this level have a well-established cybersecurity framework with clear governance structures and resource allocation. 
• Level 4: Mature: A mature cybersecurity strategy is aligned across all sectors, with ongoing evaluations and adjustments based on performance data.  
• Level 5: Advanced: Countries at this level demonstrate an adaptive, forward-looking cybersecurity strategy that is responsive to emerging threats and technological advancements.