How to Build a PQC Migration Roadmap Your Board Can Approve
A Post-Quantum Cryptography (PQC) migration roadmap defines how an organisation will identify, prioritise and migrate cryptographic assets that need to transition to quantum-safe cryptography.
A credible roadmap should connect ownership, cryptographic discovery, inventory, risk prioritisation, migration milestones, supplier dependencies, crypto-agility and measurable progress.
For FINMA-supervised institutions, this has additional urgency: FINMA Guidance 05/2026 recommends establishing a PQC strategy and roadmap by mid-2027 at the latest. This is a recommendation for having the roadmap in place — not a deadline for completing PQC migration.
This article explains how to turn cryptographic evidence into a PQC migration roadmap that senior management can evaluate, fund and govern.
-
FINMA recommends that supervised institutions draw up a PQC roadmap by mid-2027 at the latest.
But putting “migrate to PQC” on a timeline isn't a roadmap.
A roadmap that can actually be put in front of a governing body needs to answer harder questions:
- What is in scope?
- What needs to move first?
- How long will migration take?
- Who owns it?
- What depends on third parties?
- What resources will be required?
- And critically: What evidence supports the target dates?
FINMA recommends a strategy adopted by the institution's most senior governing body together with an implementation plan containing milestones and priorities, including target dates for full migration and for critical processes.
That means the roadmap needs to be more than a statement of intent.
It needs to be defensible.
Who should own the PQC migration roadmap?
PQC migration requires both executive accountability and cross-functional operational ownership. The programme can affect security, infrastructure, applications, procurement, risk management and third-party services, so responsibility should not sit informally between technical teams.
Before discovery and planning progress too far, establish clear ownership.
- Executive sponsor : accountable at governing-body level and able to secure mandate and budget.
- Operational owner : responsible for coordinating the programme across teams.
- Technical owners : responsible for the affected systems, applications and infrastructure.
- Reporting cadence : defining how progress, dependencies and risks reach senior management.
FINMA's recommendation calls for the strategy to be adopted by the institution's most senior governing body.
That makes ownership a governance question, not simply a technical one.
Why does cryptographic discovery come before the PQC roadmap?
A roadmap needs dates.
But target dates are difficult to defend when the organisation doesn't yet know what needs to migrate.
FINMA's inventory recommendation extends across encryption, signatures, key management and authentication within ICT systems, applications and infrastructure, including environments that are outsourced or consumed as a service.
No single discovery mechanism will find everything.
Network scanning provides one view.
Container-image scanning provides another.
Static source-code analysis can expose cryptographic dependencies inside applications.
CMDB and certificate lifecycle management integrations add system context and certificate visibility.
Cloud, OT, embedded systems, firmware, legacy environments and third-party services introduce additional blind spots. The campaign's discovery methodology explicitly identifies this multi-source approach.
That's why discovery needs to begin before the final roadmap is written.
The roadmap should be built from evidence about the environment, not assumptions about it.
Without a cryptographic inventory, there are no defensible target dates , only statements of intent.
This is one of the campaign's central arguments.
Read: Cryptographic Discovery: How to Build a PQC Cryptographic Inventory →
How should organisations prioritise PQC migration?
PQC migration should be prioritised according to risk, data protection requirements, migration complexity, business dependencies and organisational control , not simply by asset count.
Long-lived roots, code-signing keys and information that must remain confidential for many years deserve particular attention when establishing migration priorities.
For each relevant asset or dependency, organisations need to consider questions such as:
- How long must the information remain protected?
- How difficult will the asset be to migrate?
- Which applications and business processes depend on it?
- Does the organisation control the migration itself?
- Are other systems dependent on the same cryptographic component?
This turns a cryptographic inventory into a migration sequence.
Long-lived roots, code-signing keys and information that must remain confidential for many years deserve particular attention within this analysis. The campaign methodology specifically identifies these areas when moving from inventory to prioritisation.
How does crypto-agility affect a PQC migration roadmap?
PQC migration should not be treated simply as replacing one algorithm with another.
Crypto-agility is the capability to replace or adapt cryptographic algorithms across applications, protocols, software, hardware and infrastructure while maintaining secure operations.
That introduces another useful question: How long would it take us to execute a fleet-wide cryptographic change today?
If certificates are discovered, renewed and replaced manually, changing cryptography across hundreds or thousands of systems may become a significant operational programme.
Automation therefore influences the roadmap.
Automated certificate lifecycle management, policy-based enforcement and repeatable processes can reduce the operational effort required to implement future cryptographic changes.
The roadmap should consequently consider not only what needs to migrate, but also which operational capabilities need to improve before migration can happen efficiently.
How should third-party suppliers be included in a PQC roadmap?
Third-party dependencies should be identified early because some of the most important dates in a PQC migration roadmap may be outside the institution's direct control.
Applications may depend on external software.
Cloud services may control parts of the cryptographic stack.
Hardware vendors may determine when firmware becomes available.
Managed services may have their own migration programmes.
FINMA explicitly addresses external service providers and states that responsibility remains with the outsourcing institution. It also recommends considering crypto-agility in new and existing outsourcing relationships.
Supplier dependencies therefore belong in the roadmap from the beginning.
For critical providers, organisations should understand:
- What cryptography does the service depend on?
- What is the provider's PQC migration approach?
- Which components will require customer action?
- What are the expected release cycles?
- Which dates are outside the institution's control?
- How will crypto-agility be addressed contractually?
A roadmap that ignores suppliers may contain dates the organisation cannot actually deliver.
What should a board-ready PQC roadmap contain?
A board-ready PQC roadmap should translate technical migration complexity into clear scope, priorities, milestones, target dates, accountability, resources, dependencies and measurable progress.
The technical programme may contain thousands of cryptographic assets.
The board doesn't need thousands of rows.
It needs a clear view of the programme.
A useful PQC roadmap should allow decision-makers to understand:
Board questionRoadmap should showWhat are we migrating?Defined scopeWhat comes first?Risk-based prioritiesWhen will it happen?Critical and full-migration target datesWho is accountable?Executive and operational ownershipWhat will it require?Resources and budgetWhat could delay us?Technical and supplier dependenciesAre we progressing?Milestones and measurable progress indicators
The campaign briefing specifically identifies scope, milestones, target dates, accountabilities, budget envelope and progress metrics as the elements needed for a board-ready roadmap.
The objective isn't to promise a date before the organisation has enough information.
It's to create enough visibility to make the dates defensible.
The objective isn't to promise a date before the organisation has enough information. It is to create enough visibility to make the dates defensible.
Is mid-2027 the deadline for completing PQC migration?
No. FINMA's mid-2027 recommendation concerns establishing the strategy and roadmap; it is not a deadline for completing the PQC migration.
That distinction matters.
Among the institutions in FINMA's survey that already had a specific roadmap, the expected timeframe to protect critical assets was four to five years.
The roadmap therefore marks the transition from understanding the problem to managing a multi-year programme.
A credible roadmap connects: Ownership → Discovery → Inventory → Prioritisation → Migration → Crypto-agility → Measurement
And gives senior management a defensible answer to the question:
What needs to happen, by when, and why?
-
Frequently asked questions about PQC migration roadmaps
What is a PQC migration roadmap?
A PQC migration roadmap is a structured plan for identifying, prioritising and migrating cryptographic assets and dependencies from quantum-vulnerable cryptography toward quantum-safe alternatives.
What should a PQC roadmap contain?
A roadmap should define scope, migration priorities, milestones, target dates, ownership, resources, dependencies and mechanisms for measuring progress.
Why is a cryptographic inventory needed before building a PQC roadmap?
An organisation needs visibility into where and how cryptography is used before it can reliably assess risk, migration complexity and dependencies or establish defensible target dates. NIST similarly identifies cryptographic discovery and inventory as a starting point for PQC migration planning.
How should PQC migration be prioritised?
Prioritisation should consider factors such as data sensitivity and protection lifetime, business criticality, migration complexity, system dependencies and third-party dependencies.
What is crypto-agility?
Crypto-agility is the capability to replace or adapt cryptographic algorithms across technology environments while maintaining security and ongoing operations.
Is mid-2027 the FINMA deadline for completing PQC migration?
No. FINMA's guidance discusses establishing a strategy and roadmap; the mid-2027 recommendation should not be presented as a deadline for completing the migration.
Who should own the PQC roadmap?
The programme should have clear executive accountability together with operational and technical ownership across the relevant functions.
