A Practical Post-Quantum Readiness Checklist for Network Teams

Post-quantum readiness can become overwhelming if it starts as a cryptography debate. For network teams, it should start as an inventory and lifecycle exercise.

Design takeaway: know where cryptography lives before deciding what needs to change.

Step 1: Inventory Cryptography

• Site-to-site virtual private network (VPN).
• Remote access VPN and zero trust network access (ZTNA) transition paths.
• public key infrastructure (PKI) and device certificates.
• Transport Layer Security (TLS) on management interfaces and APIs.
• Secure Shell (SSH) access and automation tooling.
• Media Access Control Security (MACsec) and other link encryption.
• Secure boot and image validation.

Record platform, software version, algorithm, certificate authority, owner, and replacement path.

Step 2: Rank Data Longevity

Not all encrypted traffic carries the same future risk. Prioritize traffic where confidentiality matters years from now: regulated data, legal records, intellectual property, health information, payment data, credentials, and sensitive government or customer information.

If the data loses value quickly, it may be lower priority. If it must remain private for a decade, it belongs near the top.

Step 3: Check Platform Support

Some devices will support future cryptographic updates through software. Others will not. That turns post-quantum readiness into a refresh planning input.

Ask vendors which platforms support post-quantum-ready secure boot or signing, which software trains support newer algorithms, and which features are roadmap-only.

Step 4: Build a Migration Plan

1. Create a crypto inventory.
2. Prioritize by data longevity and exposure.
3. Lab-test new algorithms and certificate workflows.
4. Update automation and monitoring that depend on certificates or SSH.
5. Align hardware refresh with platforms that can support future requirements.
6. Document rollback and interoperability issues.

The checklist should become part of normal architecture review, not an annual security slide.

Design Detail: Certificates Are the Hidden Work

Certificate workflows are often the hidden work in post-quantum readiness. Device identity, controller trust, application programming interfaces (APIs), automation platforms, virtual private networks (VPNs), network access control (NAC), wireless authentication, and management interfaces all depend on them. If those workflows are undocumented, cryptographic migration will be painful.

Inventory should include certificate authorities, templates, validity periods, renewal methods, device enrollment, revocation, and automation dependencies. Then lab-test what happens when algorithms or trust chains change. Some failures will appear in places nobody expected, like old monitoring collectors or scripts pinned to legacy TLS behavior.

Crypto agility is an operational capability. It means the organization can change algorithms, certificates, and trust roots without rediscovering the network each time.

Implementation Details

• Map every certificate authority (CA) and certificate template used by network systems.
• Find systems with long certificate validity and weak renewal practices.
• Test automation tools against newer TLS and SSH requirements.
• Prioritize VPN and management-plane systems protecting long-lived data.
• Tie unsupported crypto dependencies to lifecycle replacement plans.

Inventory Schema

The checklist becomes useful when every row has enough detail to drive a change. Use the same schema for TLS, Internet Protocol Security (IPsec), SSH, PKI, MACsec, secure boot, and signing dependencies.

Field	Example	Why It Matters
System or flow	wide area network (WAN) IPsec tunnel from data center to claims processor	Names the thing being protected, not only the device.
Protocol and algorithm	IKEv2, DH group, authentication, ESP transform	Shows where quantum-vulnerable public-key dependencies exist.
Certificate or key source	Internal CA, vendor CA, local SSH key, TPM-backed identity	Identifies who controls renewal and trust-chain changes.
Data longevity	Seven-year regulated records	Ranks harvest-now-decrypt-later concern.
Exposure	Internet-facing, partner-facing, internal admin, campus only	Separates theoretical crypto risk from reachable attack paths.
Owner	Network, security, app, vendor, business unit	Prevents orphaned dependencies.
Upgrade path	Software update, certificate migration, hardware refresh, no known path	Turns inventory into a roadmap.
Rollback	Previous trust chain, previous VPN profile, old SSH host key package	Forces migration testing before production.

Dependency Matrix

Area	Checklist Questions	Evidence
TLS	Which management portals, APIs, webhooks, telemetry endpoints, and controllers terminate TLS? Which clients are pinned to legacy libraries?	Protocol scans, certificate inventory, client error logs, application programming interface (API) test results.
IPsec and VPN	Which tunnels protect long-lived sensitive data? Which peers are vendor-managed or partner-managed? Which profiles are reused broadly?	IKE proposals, peer inventory, tunnel logs, data owner review.
SSH	Which automation jobs, backup systems, jump hosts, and scripts depend on current key exchange (KEX) or host key behavior?	SSH scans, config management logs, failed job history, privileged access records.
PKI	Where are CAs, templates, mutual Transport Layer Security (mTLS) identities, 802.1X certificates, NAC certificates, VPN certs, and device enrollment workflows documented?	CA exports, certificate transparency or internal inventory, renewal logs, revocation checks.
Secure boot and image signing	Which platforms can support future signature requirements, and which need refresh?	Platform support matrix, software train, hardware lifecycle, vendor confirmation.

NIST Caveats

Use National Institute of Standards and Technology (NIST) as a reference point, not as a shortcut. NIST's post-quantum cryptography (PQC) project identifies the core standards, and the National Cybersecurity Center of Excellence (NCCoE) migration project frames migration as discovery, prioritization, and roadmapping. A network team still has to validate what its vendors, software trains, peers, and clients support.

• Do not assume a future-ready certificate authority means all endpoints can use the new chain.
• Do not assume a post-quantum-capable library means the application, proxy, controller, or appliance exposes that capability yet.
• Do not migrate every flow at the same priority. Data confidentiality lifetime should drive the order.
• Do not forget integrity and signing. Device images, secure boot, firmware validation, and automation packages also depend on cryptographic trust.

Acceptance Tests and Rollback

• A representative TLS service accepts the target certificate chain, logs the negotiated protocol and cipher, and rejects deprecated settings intentionally.
• A representative IPsec tunnel negotiates the approved profile with both peers logging the same proposal outcome.
• SSH automation completes backup, config push, and emergency access tests with updated client and host key settings.
• NAC, wireless authentication, VPN, controller, monitoring, and API clients survive a lab trust-chain change.
• Rollback returns to the prior CA, VPN profile, SSH key package, or certificate template without losing the inventory of failed dependencies.

Evidence, Security Information and Event Management (SIEM), and Exception Handling

Signal	Fields	Workflow
Legacy algorithm found	System, protocol, algorithm, owner, exposure, data longevity	Create remediation item and set exception expiry based on data sensitivity.
Certificate nearing expiry	Subject, issuer, algorithm, template, dependent services, owner	security orchestration, automation, and response (SOAR) opens renewal task and checks whether the replacement chain is migration-ready.
Handshake failure after test	Client, server, protocol, failure reason, certificate chain, timestamp	Route to service owner with rollback decision and compatibility finding.
Unsupported device or peer	Model, software, peer owner, blocked feature, lifecycle date	Escalate to architecture review, refresh plan, or accepted-risk register.
Exception renewed	Approver, reason, expiry, compensating controls, affected data	Report repeated renewals as risk acceptance, not normal backlog.

What This Does Not Protect or Validate

• The checklist does not certify the organization as post-quantum safe. It shows the team where the work is.
• It does not protect data that has already been captured under older public-key exchanges.
• It does not remove the need for vendor confirmation, lab testing, change control, and rollback.
• It does not fix exposed management planes, weak access control, stale certificates, or unsupported devices.
• It does not make all protocols move together. TLS, IPsec, SSH, PKI, secure boot, and signing dependencies will mature on different timelines.

Cisco References

• Cisco IQ resilience announcement
• Cisco network foundation announcement
• Cisco 8000 Series Secure Routers

Related foundation post: Cisco Live 2026: Network Announcements That Matter.