Post-Quantum Readiness: Start with Your SaaS Cryptography Inventory
Map where your SaaS uses cryptography, who controls it and what needs protection before choosing a migration plan.
3 November 2026
If a customer asked how your SaaS is preparing for post-quantum cryptography, where would you start? Before choosing algorithms, I would ask a simpler question: where do you use cryptography, what does it protect and who can change it?
NIST published its final post-quantum transition report, IR 8547, on 27 October 2026. It is a useful planning reference. Its US federal migration milestones are not a blanket deadline for Belgian SaaS companies; sector obligations and customer contracts need their own assessment.
Why start before everything needs replacing?
A sufficiently powerful quantum computer would threaten public-key methods used for establishing encryption keys and creating digital signatures. That does not mean all encryption is already broken. NIST's announcement also highlights a longer-term concern: an attacker could collect encrypted traffic today and attempt to decrypt it later. Data that must stay confidential for many years deserves early attention, especially where changing the technology will take time.
For a small SaaS team, preparation can begin with an inventory and a few supplier questions. Keep existing protections working while you understand the transition.
Map cryptography across your SaaS
Start with customer connections, internal services, identity integrations, data protection and software signing. Record the system, purpose, protocol or library, algorithm where known, technical owner and provider. Mark unknowns for investigation instead of guessing. Here is an illustrative starting point, not an assessment of a particular product:
| Use | What it protects | Owner or provider | Next question |
|---|---|---|---|
| Customer HTTPS connections | Traffic confidentiality and server identity | Platform owner and CDN provider | Which key exchange and signature methods are used, and who controls upgrades? |
| Encrypted customer exports | Confidentiality beyond the download date | Application owner and recipient | How are keys exchanged, and how long must the information remain confidential? |
| Signed application releases | Release authenticity and integrity | Release owner and signing provider | What must change across signing, distribution and customer verification? |
Turn the inventory into decisions
- Prioritise the protection needed. Distinguish retention time from confidentiality lifetime. Include sensitive historical information and dependencies that are expensive or slow to replace.
- Ask suppliers specific questions. Which supported products and versions have a migration path? What remains your responsibility? Ask for documented scope and limitations behind a claim such as "quantum-safe".
- Test before rollout. Check client compatibility, performance, operational monitoring and recovery options in a controlled environment. Coordinate both ends of a connection. A protocol setting alone does not prove the entire service has migrated.
- Assign follow-up. Give each gap an owner, next action and review date. Revisit the inventory when architecture, libraries or suppliers change.
This approach fits the distinction in the NCCoE migration project between cryptographic discovery and interoperability testing. The project is ongoing and includes preliminary drafts, rather than a finished implementation recipe for every SaaS. Europe's roadmap, published on 23 June 2025, provides further context through recommendations aimed at Member States.
Make it part of your ISMS
In an ISO 27001 information security management system (ISMS), this work connects cryptography, risk treatment and supplier oversight. Keep the inventory, assessment, provider responses and migration decisions together. Choose proportionate actions for your scope and risks. An inventory or a new algorithm alone does not establish compliance.
Through our fractional CISO services, I help SaaS companies translate security developments into practical decisions. A useful first step is a named owner, a credible inventory and a plan for resolving the unknowns.