NCSC Annual Review 2025
Looking back at the National Cyber Security Centre's ninth year and its key developments and highlights, between 1 September 2024 and 31 August 2025.
Page 27 of 32
Migrating to post-quantum cryptography
Migration to post-quantum cryptography (PQC) to protect against the threat from a future large-scale quantum computer, is an international, multi-year technology change programme.
In March 2025, the NCSC published new guidance setting timelines for key activities in the migration, which comprise:
-
2028
The target date for completing an initial migration plan that covers the entirety of your estate, and identifies services dependent on cryptography that will need to be upgraded to PQC
-
2031
The target date for migrating the highest priority services, and for refining your initial migration plan
-
2035
The target date for completing migration to PQC for all your systems, services and products
These timelines are now included in many organisations’ plans, and will underpin the work within government and regulated sectors to enable a smooth migration. But to ease this migration, we also need to grow the number of UK consultancies that have the right expertise.
In 2025, the NCSC launched a pilot PQC consultancy scheme, which assures providers offering independent consultancy services to organisations with complex or high-risk cyber security requirements. We have successfully onboarded the first 8 companies, whose services government and industry will be able to use with confidence.
Growing skills by certifying consultancies is just one way of supporting the PQC ecosystem. Another is by contributing to global standards. The NCSC has authored a global standard defining precise terminology for PQC*, which is already being widely used as a foundational reference in other standards. This enables accurate descriptions and comparisons of the security of PQC schemes, which is essential for understanding their cyber security benefit.
*RFC 9794: Terminology for Post-Quantum Traditional Hybrid Schemes.
Crypt-Key
The NCSC collaborates with UK and international partners to protect our most sensitive information using our cryptographic expertise, known as ‘Crypt-Key’.
Crypt-Key enables our most important capabilities, and ensures the UK has high confidence in critical systems against the most advanced cyber threats. The NCSC’s National Crypt-Key Centre (NCKC) remains central to developing and maintaining secure communications for government, military, industry and national security partners within the UK, and to ensure interoperability with key allies as technology and threats evolve.
Throughout 2024, the NCSC produced and distributed thousands of highly secure cryptographic keys to protect the UK’s most sensitive data whilst continuing to build capabilities to support and key the next generation of cryptographic devices. This is only achieved in concert with the UK’s sovereign Crypt-Key industry, a national asset that has collaborated with us throughout 2024 to deliver world-leading encryption products.
Working with the MOD, the NCSC is also leading a major transformation in Crypt-Key that will benefit the UK’s defence capabilities for many years to come. The Joint Crypt Key Programme (JCKP) is a £2.6 billion initiative that protects the MOD's people, platforms, networks and information and provides high-grade cryptography for mission-critical services, enhancing cyber security and trust among allies. 2024 has seen JCKP gain ministerial approval of the next major phase of Crypt-Key transformation. This phase will deliver an adaptable and innovative architecture, ready to face the threats to defence over the coming decades, through collaboration between government and the UK sovereign Crypt-Key industry.