The Government of Canada has put post-quantum migration on a measurable operating cadence. The Canadian Centre for Cyber Security’s Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada (ITSM.40.001) called for initial departmental plans by April 2026, annual progress reporting beginning in April 2026, high-priority systems migrated by the end of 2031, and remaining systems migrated by the end of 2035.
A related Security Policy Implementation Notice, effective October 9, 2025, reinforces the policy requirements for Government of Canada systems using cryptography. For organizations outside Canadian government, these are not automatically binding deadlines, but the governance design is worth studying.
The milestones are outcomes, not compatibility claims
The Canadian roadmap makes an unusually useful distinction: completing migration means quantum-vulnerable algorithms are disabled, isolated, or tunnelled. Merely adding PQC support while continuing to rely on vulnerable cryptography does not necessarily mitigate the risk.
That matters in hybrid and backwards-compatible environments. A product may advertise PQC support, yet negotiate a classical mode in production, depend on a quantum-vulnerable certificate chain, or use vulnerable signatures for software updates. Migration evidence must describe the effective configuration and dependency chain.
What belongs in the departmental plan
Canada’s roadmap connects technical work to governance. It recommends an executive lead, a technical lead, and participation from finance, project management, procurement, and asset management. The plan should address execution, financial planning, workforce education, procurement policy, and methods for identifying vulnerable systems.
This is a reminder that PQC is not a cryptography-team side project. Hardware lifecycles, contracts, cloud services, certificates, identity systems, software signing, networks, and operational technology may all create dependencies. Budget decisions made today can determine whether a 2031 milestone is economical or rushed.
Annual reporting changes inventory design
A reportable inventory needs history. Teams must be able to show what was observed, when it was observed, how it was classified, what decision followed, who owns the work, and whether the risk is actually mitigated. A spreadsheet overwritten every quarter cannot provide that chain reliably.
- Measure discovery coverage and identify known gaps.
- Preserve evidence and observation timestamps.
- Connect findings to systems, services, data, and owners.
- Track vendor dependencies and procurement decisions.
- Distinguish planned, supported, enabled, and legacy-disabled states.
- Retain proof for completed or compensating controls.
A useful model for suppliers and multinational organizations
Suppliers serving Canadian departments should expect questions that map to these milestones: product support dates, standards, validation, configuration requirements, legacy-mode retirement, and evidence. Multinational organizations can also use the annual cycle to reconcile Canadian, U.S., UK, and EU timelines without maintaining disconnected compliance inventories.
Vista Platform’s discovery-to-proof operating loop is designed for this kind of durable program. It connects cryptographic state to accountable work and evidence while remaining self-hosted. Vista evaluates and governs migration; it does not generate PQC keys or perform every migration.
Explore the Vista post-quantum readiness model, learn why CBOM evidence needs traceability, or try Vista Platform Core.