Post-Quantum Cryptography and Its Impact on Critical Infrastructure

Quantum computing has been a decade away for a long time. What has changed is that the deadline is no longer set by the technology. It is set by the regulator. The Australian Signals Directorate expects organisations to have completed their transition to post-quantum cryptography by the end of 2030.

For operators of energy, water and communications infrastructure, that is a shorter runway than it appears, because the cryptography in question is embedded in assets commissioned decades ago that will still be running when the deadline arrives.

The Quantum Threat to OT Environments

A cryptanalytically relevant quantum computer (CRQC) is a quantum computer powerful enough to break the public-key algorithms in widespread use today. Algorithms such as RSA and ECC secure internet traffic, digital communications and the access controls that depend on them. CRQCs do not yet exist. Current machines lack the qubit count and stability to run the required computations reliably, and most estimates place a CRQC in the 2030s.

Operational technology carries this risk differently to IT. Asset lifecycles run to twenty or thirty years, so equipment procured now will still be in service well past any credible CRQC date. Field devices often have neither the compute headroom nor the firmware update path to accept larger post-quantum keys. Many industrial protocols were never designed to swap a cryptographic primitive at all. CISA made the point directly in its October 2024 guidance on post-quantum considerations for operational technology. OT owners need to start with discovery, because they cannot assume a vendor will hand them a drop-in replacement.

How Quantum Attacks Could Target Critical Infrastructure

The practical risks for OT operators fall into four categories.

• ‍Unauthorised remote access. Remote access functionality that depends on public-key cryptography could be exploited to reach IT and OT networks and the supervisory control mechanisms behind them.‍
• Manipulation of messages. Machine-in-the-middle attacks allow an adversary to intercept and modify communications between devices, taking control of OT systems or misrepresenting system behaviour to the operators watching it. The integrity risk here matters more than the confidentiality risk.‍
• Persistent malware. Secure Boot protections that rely on classical signatures could be bypassed, allowing an attacker to install malware and hold persistent access to a device.‍
• Harvest now, decrypt later. Encrypted OT traffic captured today can be stored and decrypted once quantum capability arrives, exposing credentials, network topology and intellectual property. Anything with a confidentiality requirement measured in decades is already exposed.

The Standards Are Final, and the Deadlines Are Set

NIST finalised three post-quantum standards on 13 August 2024: FIPS 203 (ML-KEM) for key encapsulation, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. The theoretical framing that surrounded PQC for years no longer holds. There are approved algorithms to move to.

Why Crypto-Agility Matters More Than Any One Algorithm

The portfolio is still moving, which is the part that matters for OT procurement. NIST selected HQC as a second key encapsulation mechanism in March 2025, with a draft standard expected in 2026. FIPS 206 (FN-DSA) remains in development. In May 2026, a further nine signature candidates advanced to round three of the additional signatures process. An operator hard-coding a single algorithm into field equipment today is buying a second migration in the 2030s. Crypto-agility is the requirement, not any particular primitive.

Australia's PQC Deadlines Run Ahead of the Rest

ASD's Planning for Post-Quantum Cryptography guide sets three milestones: a refined transition plan by the end of 2026, transition commenced on critical systems and long-lived data by the end of 2028, and the transition complete by the end of 2030. The Information Security Manual does not approve RSA, Diffie-Hellman, ECDH or ECDSA beyond that date, putting Australia five years ahead of the equivalent United States and European Union deadlines. APRA has told regulated entities it expects boards to understand the risk and to be advancing plans against ASD's timeline.

Our breakdown of Australia's PQC guidance covers the ASD milestones, the vendor assurance questions and APRA's position in full.

What OT Operators Should Do Now

• ‍Build a cryptographic inventory across IT and OT. You cannot migrate what you have not found. The output is a cryptographic bill of materials (CBOM) covering algorithms, key lengths, certificate dependencies and the systems relying on them. OT is the harder half of this exercise, because much of the cryptography sits inside vendor firmware rather than in anything you configure.‍
• Audit your field-level protocols. Identify where public-key cryptography is doing real work in the control environment: remote access paths, engineering workstation connections, historian links and device authentication. Rank what you find by criticality and by how long each asset will remain in service.
• ‍Engage your vendors now. ASD has said vendor readiness may be the single biggest factor in whether an organisation meets the recommended timeframes. Ask for PQC roadmaps, ask whether current products will support ASD-approved algorithms within their service life, and write those answers into procurement and contract renewal.‍
• Apply compensating controls during the transition. Segmentation, access control and monitoring reduce exposure on systems that cannot be migrated quickly. The Essential Eight and IEC 62443 already ask for most of this, so it is rarely new work.‍
• Fold PQC readiness into the compliance program you already run. If you maintain a critical infrastructure risk management program under the SOCI Act, cryptographic obsolescence is a hazard that belongs inside it. The same applies to the AESCSF annual self-assessment.

Tracking PQC Readiness Across Your Compliance Program

PQC migration will not stay a standalone project for long. Discovery produces findings that need owners, remediation dates and evidence, and those obligations already have a home in the frameworks critical infrastructure operators report against.

Overcyte tracks control implementation and maturity across AESCSF, the Essential Eight, NIST CSF, IEC 62443 and SOCI CIRMP requirements in a single platform. As PQC-related controls enter your program, whether that is vendor assurance, segmentation of legacy systems or certificate lifecycle management, progress sits alongside everything else being assessed.

The cryptographic discovery itself comes from your own tooling and your vendors. What the platform holds is the record of what was decided, what has been done and what is still outstanding when the board or the regulator asks.

See how Overcyte helps critical infrastructure operators track compliance across every framework they report against.

‍Book a demo with our team.

‍