Post-quantum migration is often described as a technical replacement program. Australia’s latest national cyber threat report instead presents it as a continuing management discipline. Published October 26, the Australian Signals Directorate’s Australian Cyber Security Centre chapter on preparing for post-quantum cryptography recommends the LATICE framework: locate, assess, triage, implement, communicate, and educate.
The agency also recommends ceasing traditional asymmetric cryptography and transitioning to PQC by the end of 2030 or sooner. That date is important, but LATICE is the more transferable lesson. A deadline tells an organization when it must arrive. An operating cycle tells it how to keep making defensible decisions while standards, products, dependencies, and business priorities change.
Locate means connecting cryptography to infrastructure
A list of algorithms is not enough to plan a migration. Organizations need to know which system uses the algorithm, for what purpose, on which host or device, in which location, under whose ownership, and with which upstream and downstream dependencies.
Useful records connect certificates, keys, protocols, libraries, and cryptographic functions to applications, APIs, data stores, network paths, identity systems, suppliers, hardware, firmware, and accountable teams. They also retain discovery source, time, confidence, and coverage gaps. A missing finding must remain an unknown, not become proof that cryptography is absent.
Assess requires business and data context
The ACSC tells organizations to assess the value and sensitivity of protected systems and data. This moves the program beyond technical severity. Two services using the same algorithm can have very different urgency if one protects short-lived public transactions while another protects regulated records that must remain confidential for decades.
An assessment should capture data lifetime, exposure, authenticity and integrity requirements, internet reachability, privilege, safety impact, recovery needs, and the consequence of failure. It should also distinguish confidentiality risks from signature and identity risks. “Harvest now, decrypt later” is not the only concern; long-lived signatures, firmware trust, certificates, and authentication can also outlast their safe cryptographic assumptions.
Triage turns the inventory into a work queue
Prioritization should combine risk with feasibility. Important fields include criticality, data lifetime, supplier readiness, interoperability constraints, validation status, change windows, replacement lead time, and end-of-life date. A low-volume appliance with immutable cryptography and a ten-year service life may require action before a large population of easily updated clients.
Each decision needs an owner and rationale. Teams should record whether the disposition is upgrade, reconfigure, replace, isolate, compensate, accept temporarily, or retire. They should also define the evidence required to close the work item. A roadmap built from unsupported percentages is not a migration plan.
Implement must include verification and rollback
Implementation is not complete when a package is installed or a vendor marks a feature supported. Organizations need evidence that the intended cryptographic path is active in the real application, that peers interoperate, that fallback and downgrade behavior match policy, and that performance remains acceptable.
Tests should cover key generation and custody, negotiation, certificate or credential validation, rotation, backup and recovery, failure handling, logging, monitoring, rollback, and representative load. Where hybrid modes are used, evidence should confirm both components are present and bound as intended.
Communication and education are control activities
LATICE explicitly includes vendors, stakeholders, communication, and training. That matters because cryptography crosses procurement, architecture, engineering, operations, risk, legal, data governance, and supplier management. A cryptography team cannot migrate a dependency that a product owner does not recognize or a vendor cannot update.
Supplier questions should name the exact protocol, algorithm, parameter set, validation target, product version, delivery path, and support date. Internal training should be role-specific: procurement needs capability language, engineers need implementation and test guidance, and executives need risk, dependencies, funding, and evidence.
What organizations should do next
First, define LATICE as a repeatable workflow rather than a one-time assessment. Give every stage an owner, entry criteria, output, evidence requirement, and review cadence.
Second, connect cryptographic records to the canonical infrastructure inventory. Preserve host, location, application, data, supplier, lifecycle, and dependency identifiers.
Third, create a prioritized work queue that combines exposure and data lifetime with feasibility and replacement lead time. Require evidence before marking an item complete.
Finally, report coverage and uncertainty alongside progress. Leadership should see which environments have been assessed, which remain unknown, which depend on suppliers, and which exceptions are approaching expiration.
How Vista Platform helps
Vista Platform is a self-hosted infrastructure inventory and DCIM platform with cryptographic posture built in. It serves as a cryptographic system of record through discovery, canonical inventory, evaluation, action, and proof. Teams can connect cryptographic findings to applications, devices, hosts, locations, data, owners, suppliers, evidence, exceptions, and migration work.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted rather than indiscriminate network scanning. Vista is not a vulnerability scanner, and discovery gaps are not proof of absence.
Explore Vista’s cryptographic inventory, post-quantum migration, and CBOM and compliance resources.
Where uncertainty remains
The 2030 recommendation is Australian government guidance, and applicability will differ by sector, jurisdiction, and system. Product availability and interoperability will evolve. The framework does not eliminate the need for system-specific engineering, validation, and risk decisions; it gives those decisions a disciplined operating structure.
Source
- Preparing for post-quantum cryptography, Annual Cyber Threat Report 2025–26, ASD’s Australian Cyber Security Centre, October 26, 2026.