Post-quantum cryptography migration services with regulator dates built in
We inventory the cryptography you run, score what a quantum-capable adversary could break and when it would matter, and sequence a migration to NIST FIPS 203 and 204 algorithms that your auditors can follow. The work is classical security engineering. The deadlines, from SAMA, the UAE Cyber Security Council, India's DST and the US OMB, are already published.
The business challenge is harvest now, decrypt later, on a regulator's clock
Data encrypted today with RSA or elliptic-curve keys can be captured now and decrypted once a sufficiently large quantum computer exists. For records that must stay confidential for 10 years or more, such as customer identities, health histories and government communications, the exposure has already begun. Nobody knows the date the machine arrives, so regulators have set their own.
Most organizations cannot yet answer the first question an auditor will ask: where is every key, certificate, library and protocol, and which ones are quantum-vulnerable? Without that inventory there is no risk assessment, no plan and no defensible board paper. That is where post-quantum cryptography migration services start.
What is post-quantum cryptography migration and when do the deadlines fall?
Post-quantum cryptography (PQC) migration replaces quantum-vulnerable public-key algorithms with standardized quantum-resistant ones, and restructures systems so the next algorithm change is a configuration task rather than a rebuild. NIST published the standards in August 2024: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. NIST's draft IR 8547 then deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035.
Regional regulators have followed with dates of their own. Per SAMA's August 2026 circular, Saudi banks and finance companies must complete a cryptographic asset inventory by 31 December 2026 and a quantum risk assessment with action plans by 31 March 2027. The UAE National Encryption Policy of November 2025 requires government entities to hold PQC transition plans and cryptographic inventories. India's DST roadmap of February 2026 has critical sectors starting PQC implementation by 2027 and nationwide adoption by 2033. In the United States, OMB M-26-15 of June 2026 targets quantum-safe key establishment for high-value assets by 2030.
Our post-quantum cryptography services
Six services that run in sequence or stand alone, depending on where your estate already is.
Cryptographic inventory and CBOM
Discover keys, certificates, libraries, protocols and HSM dependencies across applications, infrastructure and vendors, and record them as a cryptographic bill of materials your auditors can query.
Quantum risk assessment
Score every quantum-vulnerable asset by data lifetime, exposure and migration difficulty, producing the risk register and action plan that SAMA, the UAE Cyber Security Council and India's roadmap expect.
Migration roadmap
Sequence system groups by risk and dependency into a dated plan that aligns with NIST IR 8547 and your regulator, with budget phases and decision points for the board.
Crypto-agility architecture
Redesign key management, certificate lifecycle and protocol negotiation so algorithms can be swapped by configuration, with abstraction layers around libraries that will change again.
PQC integration and testing
Implement ML-KEM and ML-DSA, hybrid TLS and hybrid certificates in pilot systems, then test interoperability, latency and payload size against your current performance baseline.
Governance and board reporting
Define ownership, metrics and the reporting rhythm for the migration program, with quarterly board papers that show progress against each regulator date.
Enterprise use cases by sector
The same six services, applied where long-lived data and regulator attention meet.
Banks and payment companies
Inventory and risk assessment to SAMA, RBI and SEBI expectations, with card, core banking and open-banking APIs sequenced first. See our banking and financial services work.
Learn more →Telecom operators
Subscriber identity, signaling and inter-operator interfaces where hybrid TLS pilots start, and where telecommunications clients will be asked to lead national migrations.
Learn more →Energy and critical infrastructure
OT and SCADA estates with 20-year asset lives and vendor-locked firmware, planned with the energy and utilities constraints we already work under.
Learn more →Government entities
Transition plans and automated inventories as the UAE National Encryption Policy requires, and critical-sector readiness as India's 2027 milestone approaches.
Healthcare and life sciences
Patient records and research data with confidentiality horizons measured in decades, where healthcare data residency rules shape the architecture.
Learn more →Software products and platforms
Vendors whose customers will soon require a CBOM and a PQC roadmap in procurement, integrated with enterprise application release cycles.
Learn more →How we deliver a quantum-safe migration roadmap
Each engagement follows our five quantum steps, applied here to cryptography. Steps 1 to 3 produce the inventory, risk assessment and tested design. Steps 4 and 5 are engineering.
- 01
Discover
Scope the estate, agree data classification and build the cryptographic inventory and CBOM.
- 02
Validate
Score risk by data lifetime and exposure; confirm which regulator dates apply to which systems.
- 03
Simulate
Pilot ML-KEM, ML-DSA and hybrid TLS in a test environment; measure latency and interoperability.
- 04
Engineer
Implement crypto-agile key and certificate management; migrate the first system group.
- 05
Scale
Roll out by system group against the roadmap, with board reporting at each milestone.
Business outcomes and measurement
The outcome is evidence: a complete CBOM, a risk register with every quantum-vulnerable asset scored, a dated roadmap mapped to your regulator, and pilot results showing that hybrid PQC works in your systems at acceptable latency. Progress is measured as the share of assets inventoried, assessed and migrated, reported quarterly.
An honest note. We have no completed PQC migrations to cite yet. Our proof is method and standards alignment: NIST FIPS 203, 204 and 205, NIST IR 8547, SAMA's circular, the UAE National Encryption Policy and India's DST roadmap are the references every deliverable is checked against, and our security engineering work on RHEL hardening, OT assessments and SAMA and NCA ECC compliance is already in production.
Where we deliver. In Saudi Arabia, inventory and assessment work is scoped to SAMA's 31 December 2026 and 31 March 2027 dates and NCA ECC-2:2024. In the UAE, government entities follow the National Encryption Policy of November 2025. In India, critical sectors prepare for the 2027 start under the DST roadmap and CERT-In guidance. In the United States, OMB M-26-15 sets 2030 for high-value assets. Our locations cover each market.
Security, governance and quality during a cryptographic migration
A cryptographic inventory is itself sensitive. Discovery tooling runs read-only, findings are classified before they are recorded, and the CBOM stays in your estate under your access controls. Every migration change goes through review, a rollback plan and test evidence before it reaches production.
Data residency follows the strictest rule that applies: SDAIA's PDPL in Saudi Arabia, the UAE PDPL, India's DPDP Act 2023. Regulated workflows also receive specialist legal and compliance review before a recommendation goes to the board. Our cloud and DevOps team handles the pipeline and secrets-management changes a migration requires.
Why Constient for PQC readiness
Three reasons, none of them a badge.
Security engineering already in production
Cybersecurity remediation on RHEL estates, OT and ICS assessments in Saudi Arabia and SAMA and NCA ECC compliance work give us the operational habits a migration needs.
Quantum context, not just cryptography
Our quantum research team tracks the hardware roadmap, so risk assessments reflect realistic timelines rather than vendor headlines.
Regulator-literate in four markets
We write deliverables in the structure SAMA, the UAE Cyber Security Council, CERT-In and OMB expect, so your compliance team is not translating them.
Frequently asked questions
How does a PQC readiness assessment with Constient start?
With a scoping call to agree the estate boundary, data classifications and which regulator dates apply. We then run discovery tooling read-only across the agreed scope, interview application owners, and deliver the CBOM and risk register together. Contact us and we will propose a fixed scope within a week.
How long does the cryptographic inventory take?
A single business unit with a few hundred applications typically takes 6 to 8 weeks; an enterprise-wide inventory runs in waves of 8 to 12 weeks each. Timelines depend on how much of your estate is discoverable by tooling and how quickly vendors supply their own cryptographic details.
Can you meet SAMA's 31 December 2026 inventory deadline if we start now?
For a bank starting in late 2026, a prioritized inventory covering customer-facing, payment and core systems is achievable before 31 December 2026, with remaining systems in early 2027. Per SAMA's August 2026 circular, the risk assessment and action plan then follow by 31 March 2027. We scope to those dates explicitly.
Where does our inventory data stay?
In your estate. Discovery outputs, the CBOM and the risk register are stored under your access controls, in your region, in line with SDAIA's PDPL, the UAE PDPL or India's DPDP Act 2023 as applicable. We do not move cryptographic findings to Constient systems without written approval.
Does PQC migration mean replacing our PKI and HSMs?
Usually not in the first phase. ML-KEM and ML-DSA can run in hybrid mode alongside existing algorithms, and most HSM and KMS vendors now ship PQC firmware. We test your specific products in the pilot step and recommend replacement only where a device cannot support the new algorithms.
What is the commercial model?
Inventory, risk assessment and roadmap are fixed-scope, fixed-price deliverables. Crypto-agility architecture and PQC integration are scoped per system group after the roadmap, either as fixed projects or through a dedicated engineering team if the program runs for several quarters.
Have you completed a PQC migration for a client?
No, and we say so. Our evidence is method and standards alignment with NIST FIPS 203, 204 and 205, IR 8547 and the regional regulators named on this page, plus security engineering work that is already in production. We will not present a hypothetical migration as a reference.
Build your quantum-safe migration roadmap
Tell us your regulator, your estate size and your most sensitive data. We will come back with a scoped inventory and assessment plan mapped to the dates that apply to you.