Skip to content
Cryptography
ASD ISMISM-2073

ASD ISM 2073 Develop a post-quantum cryptography transition plan

What it says

A post-quantum cryptography transition plan is developed, implemented and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Create and maintain a plan to move to cryptographic methods that are secure against quantum computing threats.

This control is about preparing your organisation to handle future threats from super-powerful computers called quantum computers. Right now, the way we scramble sensitive information might become vulnerable to these new computers, so we need a plan to start using stronger methods. If we don't do this, confidential information like customer data or trade secrets could be at risk.

Why it matters

Without a post-quantum transition plan, systems may retain vulnerable crypto and allow harvest-now-decrypt-later exposure, causing breaches and loss of trust.

How to implement

  1. The IT team should lead the development of a plan by first learning about what post-quantum cryptography is and why it is necessary.

    They can do this by attending training sessions or webinars on the topic, offered by reputable cyber security organisations like the Australian Cyber Security Centre (ACSC).

  2. System owners should work with the IT team to identify which systems and data will be most impacted by the shift to post-quantum security.

    Make a list of these systems and discuss why each one needs stronger protection against the new kinds of threats.

  3. Managers should ensure that staff know about the transition and see its importance.

    This can be done by organising a company-wide meeting or sending out an informative email that explains the impact of quantum computing on business security and how the organisation plans to handle it.

  4. The procurement team should look into new software and hardware that supports post-quantum cryptographic methods.

    They can attend industry expos or follow vendor announcements to understand what's available and keep a shortlist of potential products for evaluation.

  5. The entire organisation should schedule regular reviews of the transition plan.

    This could be quarterly meetings where progress is checked, adjustments are made based on new research or technology, and all stakeholders get updates on any changes affecting their roles.

Keep it running

Maintain a PQC transition plan by inventorying crypto, prioritising high-value/long-life data, tracking standards, and scheduling migration milestones and owners.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The documented post-quantum transition plan: Verify the existence of a structured plan outlining the steps for adopting new cryptographic methods.

    Look at

    Specific timelines and responsible parties for each major task.

    Good evidence

    Will be a clearly outlined plan with a timeline and assigned responsibilities.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see training records: Request evidence that IT staff have received training on post-quantum cryptography.

    Look at

    Attendance certificates or records of webinars completed.

    Good evidence

    Includes dated evidence of actual participation in relevant training events.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The list of systems identified for transition impact: Request a documented risk assessment that identifies which systems will be most affected by quantum threats.

    Look at

    A list that prioritises systems based on data sensitivity and business impact.

    Good evidence

    Includes a detailed assessment with prioritised system list and rationale.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Vendor evaluation notes: Request documentation or minutes showing how new products supporting post-quantum methods were evaluated.

    Look at

    A comparison of different solutions and documented reasons for selection or rejection.

    Good evidence

    Includes dated meeting notes or a report with detailed evaluations.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Review meeting notes: Request records of the periodic review meetings held to monitor the transition plan's progress.

    Look at

    Changes made to the plan based on these reviews and evidence of stakeholder engagement.

    Good evidence

    Shows regular involvement from different teams and updates to the transition plan.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.