On September 3, the G7 Cybersecurity Working Group published “Preparing for the Post-Quantum Era: A Call to Action” under France’s G7 presidency. The document asks public- and private-sector decision-makers to treat post-quantum cryptography as a near-term business and security issue, not a distant technical concern.
Its most important point is organizational: migration is collective. Cryptographic dependencies cross suppliers, customers, cloud services, certificate authorities, hardware platforms, software ecosystems, and national boundaries. An organization can improve its own systems and still remain exposed through a partner that cannot authenticate, negotiate, update, or prove compatible cryptography.
Shared risk requires shared evidence
The G7 document highlights both harvest-now-decrypt-later exposure and future attacks on authentication. Those risks propagate differently. Long-lived confidential data can be exposed by traffic collected today. Authentication failures can enable impersonation, forged software or data, compromised equipment, and lateral movement through connected organizations.
Managing either risk begins with knowing which cryptographic functions exist and how they connect. A useful inventory must include algorithms, protocols, certificates, keys, libraries, modules, applications, devices, protected data, owners, suppliers, and trust relationships. It also needs evidence source, timestamp, confidence, and coverage boundaries. A supplier assertion, an observed configuration, and a tested negotiation are different kinds of evidence.
When organizations exchange migration information, those distinctions matter. A product may “support PQC” without having it enabled. A service may use post-quantum key establishment while retaining classical authentication. A component may implement an approved algorithm but depend on a verifier, HSM, or firmware update that is not ready. Shared resilience requires claims precise enough for another party to evaluate.
National timelines meet global supply chains
The G7 calls for organizations to follow timelines established by their national cybersecurity authorities. That is sensible, but multinational organizations and suppliers will encounter different dates, approved algorithms, parameter choices, hybrid policies, assurance requirements, and reporting expectations.
A single global status such as “PQC compliant” will not survive that complexity. Teams need policy profiles tied to jurisdiction, data classification, customer, contract, and use case. The same cryptographic asset may be acceptable for one environment, transitional in another, and prohibited for a third.
The canonical inventory should remain stable while evaluations vary. That separation lets an organization apply new guidance without rediscovering the estate or duplicating records for every framework. It also makes exceptions visible: who approved them, which systems they cover, when they expire, and what evidence supports the decision.
Procurement is becoming a migration control
The call to action recommends purchasing products that integrate PQC and using normal renewal cycles to reduce transition cost. It also identifies public procurement requirements as a way to accelerate adoption. This moves cryptographic capability into product selection, contract language, acceptance testing, and lifecycle management.
Buyers should require exact answers: supported algorithms and parameter sets; cryptographic functions and protocols; hybrid or pure-PQC behavior; module and implementation details; enabled defaults; interoperability evidence; key-management boundaries; upgrade paths; and end-of-support dates. Contracts should address cryptographic change notification, vulnerability response, inventory exports, evidence updates, and responsibility for remediation.
Renewal planning must be connected to the inventory. If an appliance, embedded device, or SaaS dependency cannot meet the target state, its replacement date becomes a migration milestone. Starting early creates options to align security work with planned refreshes instead of forcing emergency replacements later.
Five priority areas need one operating loop
The G7 identifies awareness, national strategies, research and development, public-private partnerships, and integration into cybersecurity requirements. Organizations can translate those broad priorities into an operating loop.
- Discover: collect evidence from systems, software, certificates, suppliers, architecture, and documentation.
- Build a canonical inventory: reconcile observations into durable assets and dependencies.
- Evaluate: apply risk, data-lifetime, jurisdiction, procurement, and algorithm policies.
- Act: assign owners, target states, tests, supplier requests, exceptions, and replacement milestones.
- Prove: retain what changed, how it was validated, and which gaps remain.
Program metrics should reflect this loop. Counts of “PQC-ready products” are weaker than coverage, verified use, unresolved dependencies, overdue actions, expiring exceptions, and evidence freshness.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop is discovery, canonical inventory, evaluation, action, and proof. Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps.
Vista helps teams reconcile cryptographic evidence, evaluate it against applicable policy, govern remediation, and preserve proof across organizational boundaries. It tracks and governs migration; it does not generate PQC keys or perform every migration step. Vista is not a vulnerability scanner, selected-asset Active Scan is not indiscriminate network scanning, and discovery gaps are not proof of absence. See Vista’s post-quantum overview.
Where uncertainty remains
The G7 publication is a strategic call, not a single binding technical standard. National authorities will continue to differ in timelines and implementation guidance, and product maturity will vary. Organizations should not wait for perfect convergence. They should build the shared inventory, policy mapping, supplier evidence, and governance mechanisms needed to absorb new requirements without starting over.
Sources
- Preparing for the Post-Quantum Era: A Call to Action, G7 Cybersecurity Working Group via ANSSI, September 3, 2026.
- G7 Cybersecurity Working Group Statement on Preparing for a Post-Quantum Cryptography Migration, Canadian Centre for Cyber Security, 2025.