A Practical Path to Post-Quantum Readiness in Operational Technology

Excerpt Post-quantum readiness refers to an organization’s preparedness to protect its systems, data and communications against future attacks from quantum computers—machines powerful enough to break today’s widely used public-key cryptographic algorithms (such as Rivest–Shamir–Adleman [RSA] and elliptic curve cryptography [ECC]). It involves developing a roadmap to transition to post-quantum cryptography (PQC)—new algorithms designed to resist quantum-enabled decryption—before that threat becomes practical. For operational technology (OT) professionals, post-quantum readiness means starting now to identify which cryptographic algorithms and legacy devices are quantum-vulnerable, working with vendors on transition plans and layering in compensating controls when the hardware itself can’t yet support quantum-resistant encryption. A controller purchased today may still be operating decades from now. In some industrial systems, changing cryptography requires a firmware update, vendor support, a maintenance window and evidence that the change will not disturb the process. Decisions made during procurement and commissioning shape what an operator can safely change later. Post-quantum readiness belongs in ordinary asset governance, engineering, purchasing and maintenance decisions. While information technology (IT) and OT share cryptographic dependencies, OT migration must also account for physical processes, safety requirements, equipment lifecycles and limited maintenance opportunities, so each change must be supported by evidence that required operations will remain reliable. Georgianna Shea is chief technologist at the Foundation for Defense of Democracies, leading research, technology assessments and policy on cybersecurity, critical infrastructure resilience and emerging technologies. Shaun C. Six is president and CEO of UTSI International Corporation in Houston, Texas, an OT cybersecurity and systems integrator serving critical infrastructure asset owners and operators across public and private sectors.