PQC uses cryptographic algorithms designed to resist attacks from both classical and future quantum computers. It includes methods for establishing keys and for digital signatures, and it runs on today's computing systems.
Start before it's urgent
Protect business-critical information
Updating the systems that protect data and verify identities takes time. Start with what matters most.
Encrypted today, exposed later
Attackers can save encrypted data now and decrypt it with future quantum computers. Customer records and other sensitive information that must stay private for years are at risk.
Keep trust intact
Quantum attacks could let an impostor pose as a trusted device or make altered software look genuine. The result: unauthorized access or harmful code running in your environment.
Choose where to begin
Identify your most critical information and the systems that protect it. Bring the responsible teams together, then pick a practical first step.
Four capabilities for post-quantum protection
Each capability closes a different point of exposure. Together, they form a layered defense that evolves with you.
Boot with trust
Verify the software your infrastructure starts with. Supported Cisco platforms validate signed code at boot. Check hardware and release requirements for PQC boot and software-signature support.
Keep communications confidential
Protect long-lived data on priority connections. Supported Cisco routers have documented support for hybrid post-quantum key establishment. Confirm platform, release, and deployment, then verify the mode actually negotiated.
Assess and prioritize
Identify long-lived data, critical systems and cryptographic dependencies. Weigh assessment findings for supported Cisco equipment against business priorities, and account for inventory outside the assessment scope.
Modernize in phases
Plan supported software updates and selective hardware refresh. Test interoperability and policy continuity, confirm the protection in place, and track progress before expanding adoption.
Explore Cisco for your needs
Start with the part of your environment that matters most. Use the links below to explore Cisco offerings and the PQC guidance for your devices and connections.
1
Routing
Share sensitive information between offices, branches and data centers. Include the routers and connections carrying it in your plan.
2
Firewall
Connect remote employees and sites while controlling access to your systems. Include your firewall and VPN connections in your plan.
3
Switching
Keep employees and business systems connected. Check how your campus switches verify the software they run.
4
Wireless
Support employees connecting over Wi-Fi. Include wireless controllers and the connections used to manage them in your plan.
5
Data center
Connect the systems that run your applications. Plan for the network and management connections your data center relies on.
6
Secure access service edge
Bring networking and security into one access plan for users, sites, and cloud applications. Include the connections and identities behind it.
Explore PQC resources
Building resilience
How Cisco connects quantum-safe data protection with trust across your infrastructure
Getting started
How sensitive information and assessment findings influence your starting point
Trusting devices and software
How startup and software integrity checks work on supported platforms
Securing site connections
How to protect information on supported router connections between sites
Upgrading identity checks
Why identity protection needs its own transition plan
Planning for change
How protection stays current as security methods evolve
Frequently asked questions about PQC
There is no agreed arrival date for a quantum computer capable of breaking today's public-key cryptography. The migration itself can take years across products, protocols, and suppliers. Attackers could store encrypted data now and try to decrypt it later, so prioritize information that must remain confidential for years.
Start with information that must remain confidential for years and the systems that protect or move it. Include high-value connections, devices, identities, and software-signing paths. Prioritize by data lifetime, business impact, exposure, and upgrade dependencies.
NIST has published FIPS 203 for ML-KEM key establishment and FIPS 204 and 205 for ML-DSA and SLH-DSA digital signatures. These standards do not set one deadline for every organization; check the requirements that apply to your sector, contracts, and jurisdiction.
PQC migrations can happen in phases, letting you introduce quantum-safe cryptography gradually. Where supported, hybrid key establishment combines post-quantum and classical methods, easing transition without replacing all infrastructure at once. Support and negotiation varies by product, protocol, and configuration.
PQC includes digital-signature standards as well as key-establishment standards. Plan for how certificates, device identity, and software signatures are verified. Support for post-quantum signatures varies by platform and release; boot-integrity evidence alone does not prove that a post-quantum signature was checked.
Some changes may be available through supported software updates; others may require hardware prerequisites or refresh. Key and handshake sizes, interoperability, and performance can vary by implementation and deployment. Check product guidance and test the target configuration before expanding adoption.
Check current documentation for the exact product, hardware, software release, protocol, and deployment mode. Separate released capabilities from roadmap plans, then verify the cryptographic mode observed in operation. Support for one model or function does not establish support across a product family.
This page includes imagery created with the assistance of AI.