MITRE Publishes Post-Quantum Cryptography Roadmap

In a significant development for cybersecurity readiness, the MITRE organization published a detailed Post-Quantum Cryptography (PQC) Transition Map in May 2025 .

See also: MITRE: Funding for critical CVE program ends

This strategic document aims to guide organizations in transitioning their cryptographic systems to be resilient to the emerging threat of quantum computers.

Although experts estimate that quantum computers capable of breaking current cryptographic standards (CRQCs) may still be 10 to 20 years away , MITRE's Post-Quantum Cryptography roadmap highlights the need for immediate planning for the transition. Early preparation is critical to a successful implementation before these supercomputers become a threat to data security

This document, developed by the Post-Quantum Cryptography Coalition (PQCC), places particular emphasis on a worrying vulnerability known as “harvest now, decrypt later,” where malicious actors harvest encrypted data today with the intention of decrypting it when quantum capabilities become available.

This threat poses serious risks to sensitive information of great historical value, with the potential to compromise critical infrastructure, personal data, and corporate secrets — even if they currently appear secure with existing encryption methods.

See also: MITRE: The new list of the 25 most dangerous software bugs

PQCC analysts identified four critical categories that organizations must manage during the transition: Preparation, Basic Understanding, Planning and Implementation, and Monitoring and Evaluation.

The document proposes a flexible approach to transition, recognizing that organizations vary significantly in the sensitivity of their data, the availability of information about their assets, and the resources available for extensive software and hardware upgrades. It provides specific actions and desired outcomes for each category, making it easier for organizations to track their progress throughout the transition process.

For organizations that handle highly sensitive data, the roadmap classifies them as “urgent adopters,” while those with a lower risk profile are classified as “regular adopters.” This classification helps organizations set appropriate timelines and allocate the necessary resources for their Post-Quantum Cryptography (PQC) transition efforts.

See also: MITRE: Unveils EMB3D, a threat modeling framework

As quantum computing technology continues to evolve, organizations are facing a new era in information security. Encryption methods that are considered secure today are at risk of becoming weak or even useless when quantum computers reach the necessary power. The timely transition to quantum-resistant cryptographic systems is not just a technical necessity, but a critical strategic priority for any organization seeking to ensure the long-term protection of its data.

Source: cybersecuritynews