up:: The Human & Organizational Side MOC
The Quantum Checklist for Small Businesses
The quantum checklist for small businesses is a short set of checks and questions for a company that has no security team, a stack of software it pays for, and no appetite for a migration program, and it comes down to three moves: (1) write down your vendors and mark which ones hold your sensitive data (that list is your whole inventory) · (2) decide which of your data would still hurt you if it leaked in 10 years (that is the data quantum actually threatens) · (3) ask those vendors what their post-quantum plan is (the work is theirs, the asking is yours).
Almost everything written about this transition assumes a security team, a vendor-management function, and a board. If you have 12 people and a bookkeeper, most of that advice was written for someone else. The structural good news is that your cryptography lives almost entirely inside software you bought, so the problem a large company finds hardest, chasing 200 vendors, is the one you find easiest, because your exposure is a list you could write on a single page.
This note is general education, not legal or security advice. What applies to a specific business, and how, is a determination made with the appropriate adviser.
The short version:
- You cannot fix this yourself, and you are not supposed to. Your vendors do the work, and your job is knowing which ones matter and asking them.
- Your inventory is your vendor list. The thing large companies spend months building, you already have in your billing records.
- Most of your data does not matter here. What matters is anything still sensitive in 10 years, which is what makes harvest now, decrypt later the one concept worth knowing.
- Your real deadline usually arrives in a customer’s security questionnaire, not from a regulator.
- The software fix costs nothing. The new encryption ships inside the normal updates you already pay for, so staying current is most of the job.
- Old hardware is the one place you might actually spend, and it is usually a payment terminal, a door-entry system, or a machine on a shop floor.
What are the three things to do first?
- Write down your vendors and mark which ones hold or move your sensitive data. This is the inventory that large firms pay consultants to build, and for you it is already in your billing records. A business that has this list can scope its entire exposure in an afternoon.
- Decide what data would still hurt you if it leaked in 10 years. Customer records, health or financial details, anything with a long secrecy life. That data is the reason to care, because under harvest now, decrypt later an adversary can copy it today and decrypt it once the capability arrives, so the clock is already running on it.
- Ask the vendors that hold that data what their post-quantum plan is. You are checking whether they have a plan, which takes no cryptographic knowledge. When a vendor answers with a certificate instead of a plan, the vendor-claims checklist is the three questions that turn that certificate into something you can verify.
What is the full small-business checklist?
| What to check | What good looks like | A warning sign | Why it matters |
|---|---|---|---|
| Vendor list. The software and services that hold or move your data | A one-page list you can produce today | ”We’ve never written it down” | It is your entire inventory, and you cannot ask the right questions without it |
| Long-lived data. What must stay private for 10 years or more | A clear sense of which records are long-lived | ”It’s all encrypted, I think” | That data carries the HNDL exposure, and it is the only data the quantum timeline actually threatens |
| The customer door. Whether you can answer a cryptography question when a customer asks | You can answer, or you know who to ask | A security questionnaire you cannot complete | This is how a small business usually first hears about this, and it decides whether you keep the contract |
| Vendor plans. Whether your key vendors have a post-quantum path | A short answer from each vendor that matters | Silence, or a certificate offered in place of a plan | The migration work is theirs, so their answer is most of your risk |
| Software currency. Whether you install updates promptly | Current, supported software across the board | End-of-life software that has stopped getting updates | The fix ships inside ordinary updates, and software past its support window never receives it |
| Old hardware. Devices too old to update | You know which devices are aging out | A decade-old payment terminal, lock system, or shop-floor machine | Hardware is the one line where this can actually cost money |
| An owner. Who checks this | One named person reviews it about once a year | Nobody owns it | A yearly review of an hour is the entire program for a business your size |
Why does this matter for a company with no security team?
Less than you would fear, and more than nothing. No law in the United States requires a private company to inventory or replace its encryption, so the pressure reaches a small business through its customers rather than a regulator: sell to a bank, a hospital, a government body, or a defense supplier, and their obligations flow into your contract at renewal, usually as a security questionnaire with a line about cryptography on it. A business that has done the three moves above can answer that line in a sentence, and a business that cannot answer it is the one that loses the renewal to a competitor who could.
The second reason is the data. A company holding customer records, health details, or financial information is holding material with a secrecy life measured in years, and harvest now, decrypt later means that exposure is already accruing rather than waiting for some future date. None of this calls for panic or a budget line, it calls for a short list, a few emails, and one person who owns the review.
Where does this checklist stop?
Writing the vendor list, knowing your long-lived data, and sending the vendor email is nearly the whole job for most small businesses. Where it ends: a customer questionnaire with a cryptography clause you cannot parse, a niche system with its own exposure (a payment terminal, a medical device, an industrial controller), or a contract that needs real cryptographic terms written into it. That is where an outside hand starts, and the three questions to put to any vendor’s answer are the vendor-claims checklist.
Questions people ask
Do we actually have to do anything? Less than you would fear, and it is not nothing. There is no law forcing a private company to act, so what reaches you comes through customers, insurers, and, eventually, your own long-lived data. The three moves at the top cover almost all of it.
We have no security team, so who does this? Your vendors, almost entirely. The replacement encryption, the standards NIST finalized in 2024, ships inside the software updates you already receive. Your part is knowing which vendors hold your sensitive data and asking them where they stand.
Will this cost money? For software, almost never, because the fix arrives in updates you already pay for. The one place it can cost is old hardware that is too old to update, typically a payment terminal, a door system, or a machine on a shop floor, and even then it is a replacement you were likely heading toward anyway.
Related
- Harvest Now, Decrypt Later (HNDL): why your long-lived data is exposed today rather than later
- The Vendor-Claims Checklist: the three questions to put to a vendor who answers with a certificate
- Cryptographic Discovery: the inventory concept, which for you is simply your vendor list
- What a PQC Migration Costs: what the work costs at the scale of a company with its own estate
- The Quantum Checklist for Investors: the companion checklist for anyone funding a company rather than running one
Everything here is the map, given freely. When a small business gets a customer questionnaire it cannot answer, or a contract that needs real cryptographic terms, that’s the work I do.
Last verified 2026-10-26 · Updated 2026-10-26 · Maintained by Addie LaMarr, LaMarr Labs.