Post-Quantum Requirements in the United Kingdom
The NCSC set the UK timeline in March 2025. By 2028, organizations should define migration goals, finish discovery and build an initial plan. By 2031, they should complete their highest-priority migrations. By 2035, they should complete migration across all systems, services and products.
The NCSC timeline is guidance. UK organizations use it as the reference point for audits, contracts and conversations with regulators. In January 2026, HM Treasury published the G7 Cyber Expert Group’s roadmap for the financial sector. In this course, we cover the NCSC timeline and technical guidance, sector requirements, the Cyber Security and Resilience Bill, and the evidence that shows your organization is on track.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare the UK dates with those in the EU, the United States and Australia.
Module 2. UK Requirements in Detail (60 minutes)
We work through the NCSC’s three milestones. That covers what discovery and planning by 2028 involve, what counts as highest priority for 2031, and the technologies the NCSC expects to be hardest to migrate by 2035. We cover the NCSC’s positions on algorithms and hybrid schemes, and its pilot for assuring post-quantum consultancies. We explain the Cyber Security and Resilience Bill, which amends the NIS Regulations 2018. For financial firms, we cover the G7 roadmap and how PRA- and FCA-supervised firms fold post-quantum work into operational resilience. We also cover telecoms operators under the Telecommunications (Security) Act 2021, and government departments.
Module 3. Demonstrating Compliance in the UK (30 minutes)
We cover what auditors, regulators and customers will ask to see at each NCSC milestone. That includes the discovery results, migration goals, initial plan, supplier communications and progress against priorities. You map the work to the NCSC Cyber Assessment Framework, ISO/IEC 27001 and operational resilience rules, and learn to report progress to your board.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
CISOs, compliance and risk leads, operational resilience teams, legal counsel and migration program managers. They work at UK banks, insurers, market infrastructure, telecoms operators, public sector bodies, critical national infrastructure operators and their suppliers.
What you’ll be able to do afterward
- Explain the NCSC’s 2028, 2031 and 2035 milestones and what each requires of your organization
- Run discovery and planning that an auditor will accept in 2028
- Apply the G7 financial-sector roadmap and operational resilience rules if you work in financial services
- Assess what the Cyber Security and Resilience Bill changes for your organization and suppliers
- Choose and brief an NCSC-assured consultancy if you need outside help
- Report progress to your board against the NCSC milestones
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the UK instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you also operate in the EU, add PQC Compliance: European Union, or take PQC Compliance: Global Overview for every jurisdiction in one session. Banks and insurers should continue with Quantum-Safe Financial Services. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each UK instrument as the NCSC and regulators issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
