Vista resources / Planning tool
How to prioritize a PQC migration
Prioritize post-quantum migration by identifying long-lived sensitive data, exposed connections and dependencies that take time to change. Use the worksheet to decide which service needs more evidence, a supplier review or a pilot first.
The working edition / Excel workbook
Turn assumptions into a planning view.
Compare confidentiality horizons and migration lead times, identify the next action, and keep review ownership visible.
Priority register · Worked example · Planning formulas · Dashboard · Official checks
Download Excel workbook ↓What’s inside & how to use it
Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.
On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.
Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.
How to interpret the note
This is a discussion aid with transparent rules, not a risk score or prediction of when a cryptographically relevant quantum computer will exist. The tool combines your confidentiality horizon and migration lead time as a planning window. That number is not a deadline or probability.
Missing evidence prompts an inventory action. Unconfirmed supplier capability prompts a supplier action. A documented scope and available implementation prompt an interoperability pilot. Long-lived information on exposed connections adds a confidentiality review. Multiple actions can apply at once.
Use it in a service-owner workshop
- Agree what information needs protection and how long it remains sensitive.
- Estimate delivery time, including procurement, testing, partner coordination, and rollback.
- Separate confidentiality concerns from signing and authenticity requirements; long-lived signatures need their own lifecycle analysis.
- Record the decision, accountable owner, dependencies, and next review date.
Compare services using documented assumptions. Business impact, applicable requirements, availability, and architectural constraints still need human judgment. Data entered here stays in your browser and is not saved automatically.
Sources and further reading
Continue in Vista
Connect workshop priorities to measured posture
Start with Dashboard → PQC to review assessed configurations, unknowns and the algorithm-family migration worklist. Use this worksheet to add business context. Create owned tickets and a plan under Remediation, then preserve a scoped CBOM at meaningful milestones.
The worksheet’s planning window is not Vista’s risk score or readiness percentage. Vista adds observed configurations and linked findings to the decision; people still set business priorities.