Foundations
The quantum threat and the lifetime of data
What you will understand
Prioritize confidentiality and authenticity without inventing a quantum-computer deadline.
Last reviewed:
Understand the context
A sufficiently capable cryptographically relevant quantum computer would threaten widely deployed public-key systems. Its arrival date is uncertain. Planning should therefore consider how long information must remain confidential and how long a system transition takes, rather than treat a speculative year as a guaranteed deadline.
Plan the work
For confidentiality, consider harvest-now-decrypt-later: an adversary may retain encrypted traffic for future analysis. Record data categories, required secrecy periods, interception opportunities, and the key-establishment mechanisms involved. For authenticity, separately examine how long signatures, trust anchors, and software-update mechanisms must remain trustworthy.
Evidence to review
Ask owners to explain the retention and protection requirements of specific records. Map the entire path, including exports, backups, integrations, and partner endpoints. An encryption-at-rest setting does not describe the protection of every transport or key-wrapping path. Label unknown retention requirements instead of substituting an industry average.
Limits and next steps
Use scenarios rather than predictions. A system protecting long-lived information may warrant earlier discovery even where replacement technology is not ready. Record legal or contractual requirements only when they actually apply; a foreign migration target is not automatically a requirement for every SME.
Evidence and limitations
Educational guidance with referenced standards; no customer system has been assessed for this article. Implementation and protocol support must be verified for the selected environment.