In part one, I explained why the quantum problem starts before a sufficiently powerful quantum computer arrives. Data lives for years, and large cryptographic changes take years too.
Now for the more practical question: what should a company actually do first?
The obvious answer is usually “deploy a post-quantum algorithm.” But that is a little like starting a move by ordering a new sofa. You may need one, but it helps to know where you are moving, what you already own, and whether it fits through the door.
PQC migration does not start by replacing an algorithm. It starts with an inventory.
An algorithm is only one part of the system
