Migrate to post-quantum cryptography without breaking production

No. It is a multi-year programme. We find every use of quantum-vulnerable cryptography, sequence the move by data shelf life and policy deadline, and execute it, starting with the traffic already exposed to harvest now, decrypt later.

From a cryptographic inventory of every algorithm, key, certificate, and protocol, then a roadmap ordered by how long your data must stay secret and by the deadlines in CNSA 2.0 and the federal timeline.

No. Hybrid TLS key exchange (X25519MLKEM768) closes the harvest-now-decrypt-later window first while classical clients keep working.

The ability to change algorithms through configuration rather than another migration programme. We build it in so the next change is a config update, not a repeat of this project.

With inventory. You cannot migrate what you cannot see, so the first deliverable is a map of where cryptography lives across your estate.

The audit produces the inventory and roadmap; the migration executes them. They are two stages of the same programme.