{"id":1070,"date":"2026-09-09T15:11:49","date_gmt":"2026-09-09T07:11:49","guid":{"rendered":"https:\/\/www.cequrex.com\/?p=1070"},"modified":"2026-09-09T15:17:46","modified_gmt":"2026-09-09T07:17:46","slug":"canada-pqc-roadmap-security-leader","status":"publish","type":"post","link":"https:\/\/www.cequrex.com\/english\/canada-pqc-roadmap-security-leader\/","title":{"rendered":"Canada\u2019s PQC Roadmap: What Security Leaders Should Know"},"content":{"rendered":"
\"\"<\/figure>\n\n\n\n

Key Highlights<\/h2>\n\n\n\n

Canada\u2019s post-quantum cryptography (PQC) roadmap for Government of Canada non-classified IT systems sets migration milestones through 2035. Initial departmental migration plans were targeted for April 2026, high-priority systems for the end of 2031, and remaining systems for the end of 2035.<\/p>\n\n\n\n

The roadmap is organized around three phases: preparation, identification, and transition. Beyond the headline dates, several details stand out in how Canada approaches cryptographic inventory, migration prioritization, procurement, and systems that may be difficult to migrate.<\/p>\n\n\n\n

Read the full Government of Canada PQC migration roadmap<\/a><\/p>\n\n\n\n

Canada\u2019s PQC Migration Timeline<\/strong><\/h2>\n\n\n\n

The roadmap sets four key milestones:<\/p>\n\n\n\n

Timeline<\/strong><\/th>Milestone<\/strong><\/th><\/tr><\/thead>
April 2026<\/td>Develop an initial departmental PQC migration plan<\/td><\/tr>
Beginning April 2026<\/td>Report migration progress annually<\/td><\/tr>
End of 2031<\/td>Complete migration of high-priority systems<\/td><\/tr>
End of 2035<\/td>Complete migration of remaining systems<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

For the 2031 and 2035 completion milestones, supporting PQC alone is not sufficient. The roadmap states that quantum-vulnerable algorithms should be disabled, isolated, or tunnelled so that the associated quantum risk is mitigated.<\/p>\n\n\n\n

Three Phases of the Roadmap<\/strong><\/h2>\n\n\n\n

Canada organizes the migration into three recommended phases that may overlap:<\/p>\n\n\n\n

Phase<\/strong><\/th>Focus<\/strong><\/th><\/tr><\/thead>
Preparation<\/td>Governance, financial planning, education, procurement, and planning for identification<\/td><\/tr>
Identification<\/td>Discover where and how cryptography is used, build inventory data, and determine migration priorities<\/td><\/tr>
Transition<\/td>Plan and carry out migration or other measures for quantum-vulnerable systems<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The preparation phase includes establishing responsibilities for the migration, financial planning, education, and procurement considerations. The identification phase focuses on locating quantum-vulnerable cryptography and developing the information needed to prioritize systems. The transition phase covers the implementation of migration plans, including systems that may require alternatives to a direct upgrade.<\/p>\n\n\n\n

What Stands Out in Canada\u2019s Roadmap<\/h2>\n\n\n\n

1. Canada Says to Start With an Incomplete Inventory<\/h3>\n\n\n\n

The roadmap recognizes that identifying quantum-vulnerable cryptography across a large IT environment can be a significant undertaking. Rather than waiting until every cryptographic asset has been identified, it recommends beginning with an initial, incomplete inventory and iteratively improving the data.<\/p>\n\n\n\n

Canada also recommends using multiple discovery methodologies. These can include existing IT service management and security tools, network monitoring and inspection, endpoint detection and response tools, and independent tools capable of scanning networks, hosts, logs, and source code.<\/p>\n\n\n\n

2. The Recommended Inventory Contains More Than Cryptographic Information<\/h3>\n\n\n\n

Canada provides considerable detail on what should be captured during the identification phase.<\/p>\n\n\n\n

In addition to identifying system components that employ cryptography and their current cryptographic configurations, the roadmap recommends recording vendor and product versions, security controls that rely on cryptography, network zones, hosting platforms, and system dependencies.<\/p>\n\n\n\n

The inventory can also include relevant service contracts and expiry dates, expected system refresh years, responsible points of contact, and migration priority.<\/p>\n\n\n\n

Canada\u2019s inventory therefore extends beyond identifying algorithms and cryptographic assets to include information about the systems in which they are used.<\/p>\n\n\n\n

3. HNDL Is Specifically Included in Migration Prioritization<\/h3>\n\n\n\n

Harvest Now, Decrypt Later (HNDL) is specifically addressed when Canada discusses migration priorities.<\/p>\n\n\n\n

The roadmap recommends assigning high priority to systems susceptible to HNDL. This includes systems protecting information that travels across public networks and needs to remain confidential for a period long enough to face future quantum decryption risk.<\/p>\n\n\n\n

Other factors identified for prioritization include the lifespan of the information being protected, the crypto-agility of the system, and the potential impact if the system is compromised.<\/p>\n\n\n\n

4. PQC Is Already Part of Procurement Planning<\/h3>\n\n\n\n

Procurement is included in the preparation phase of Canada\u2019s roadmap.<\/p>\n\n\n\n

The guidance recommends that new procurements support PQC where appropriate. It also discusses including provisions for future PQC support in contracts involving cryptographic systems and considering cryptographic agility when acquiring new technology.<\/p>\n\n\n\n

The roadmap notes that incorporating PQC requirements earlier in procurement can reduce future migration costs. It also recommends taking advantage of existing equipment refresh and system modernization cycles where possible.<\/p>\n\n\n\n

5. The Roadmap Anticipates More Than One Transition Path<\/h3>\n\n\n\n

Canada does not assume that every quantum-vulnerable system can follow the same migration path.<\/p>\n\n\n\n

The transition phase includes several possible approaches:<\/p>\n\n\n\n

Upgrade | Replace | Tunnel | Isolate<\/strong><\/p>\n\n\n\n

Some systems may be upgraded to support PQC while maintaining backward compatibility during the transition. Quantum-vulnerable algorithms can then be disabled once compatibility with legacy systems is no longer required.<\/p>\n\n\n\n

For legacy systems that cannot be upgraded, the roadmap notes that complete replacement may be necessary. Where replacement or migration cannot be completed within the required timeframe, isolation or tunnelling through PQC-protected infrastructure may also be considered.<\/p>\n\n\n\n

Looking Ahead<\/h2>\n\n\n\n

Canada\u2019s roadmap sets out a transition extending through 2035, but much of the work described in the roadmap begins considerably earlier.<\/p>\n\n\n\n

Preparation covers governance, financial planning, education and procurement, while the identification phase focuses on discovering cryptography, building inventory data and determining migration priorities.<\/p>\n\n\n\n

The transition phase then uses that information to determine whether affected systems can be upgraded or require other approaches such as replacement, tunnelling or isolation.<\/p>\n\n\n\n

The roadmap applies specifically to Government of Canada non-classified IT systems. The full guidance is available from the Canadian Centre for Cyber Security.<\/p>\n\n\n\n

About CeQureX<\/h3>\n\n\n\n

CeQureX (CQX) helps organizations prepare for and manage the transition to post-quantum cryptography. The CQX Wave Series includes:<\/p>\n\n\n\n