G7 Cyber Agencies Urge Immediate Post-Quantum Migration Planning

Cybersecurity agencies from the Group of Seven are urging governments and businesses to begin preparing now for the migration away from public-key cryptography vulnerable to future quantum computers, warning that the transition will require years of coordinated work across digital infrastructure.

The G7 Cybersecurity Working Group’s September 3 call to action says organizations should treat the quantum threat as a near-term security problem rather than wait for a cryptographically relevant quantum computer to emerge. The group includes national cybersecurity authorities from the G7 countries, with participation from the European Commission and support from ENISA.

The immediate risk includes data being collected today for decryption later. The agencies highlight “harvest now, decrypt later” attacks, in which adversaries retain encrypted information until sufficiently capable quantum computers become available. They also warn that quantum attacks on public-key cryptography could undermine authentication, allowing attackers to impersonate trusted parties or forge digitally signed information.

The group recommends a phased, risk-based migration. Organizations should inventory where cryptography is used, identify critical systems and long-lived sensitive data, map dependencies, establish governance and budgets, and build cryptographic agility so algorithms can be replaced without redesigning entire systems. The September appeal builds on more detailed G7 migration guidance published earlier this year.