up:: What To Do
What should my doctor and my bank be doing?
Five things, and most organizations can’t yet do the first one.
That’s the honest state of it. What’s happening inside most of these institutions is a discovery that they can’t answer a basic question about their own systems, and answering it turns out to be the hardest part of the whole exercise.
Knowing the standard lets you read their answer properly when you ask.
The short version:
- Step one is an inventory of everywhere they use cryptography, and most large organizations can’t produce one.
- Then they should sort your data by how long it stays sensitive, and fix the long-lived categories first.
- Deleting records past their usefulness is the cheapest thing they can do, and it’s usually underused.
- They should be moving to the new encryption on anything carrying long-lived records.
- And they need dated commitments from their vendors, because much of it sits inside purchased products.
- The one question that reveals everything: can you produce an inventory of where your cryptography lives?
The five things
1. Know where their cryptography actually is
Before anything else can happen, an organization has to produce a list of every place it uses cryptography across its systems. That list has a name in the industry, a cryptographic bill of materials, and producing one is genuinely difficult.
They have to find decades of accumulated software, systems inherited through acquisitions, equipment from dozens of vendors, and undocumented integrations. Most large organizations start this and discover the estate is bigger and stranger than anybody thought.
This is the step that gates everything else, and it’s where most are.
2. Sort the data by how long it stays sensitive
Not everything needs fixing at once, and pretending otherwise guarantees nothing gets done.
An organization should be able to say which categories of the information it holds about you stay sensitive for years or decades, and treat those as the priority. Your medical history, your genetic data, and your long financial records sit at the top. Your session logins don’t.
3. Delete more
The cheapest available protection, and the one most organizations underuse.
Data they’ve deleted can’t be collected from them later. Retention that exists because nobody ever decided to stop is exposure they chose to carry, and shortening it is free security.
4. Move to the new encryption where it counts
For anything carrying long-lived records, they should be deploying the replacement encryption, usually alongside the existing method rather than instead of it.
This is the same fix Signal and Apple already shipped to consumer products. The standards were published in August 2024, so “we’ll act when the standards are ready” stopped being accurate some time ago.
Source: NIST, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024.
5. Get dated commitments from their vendors
A large share of what they’d need to change sits inside products they bought and can’t modify. Their timeline genuinely depends on manufacturers, which is a real constraint rather than an excuse.
What separates a serious organization from a passive one is whether they’ve asked their vendors for dated commitments and written them into contracts, rather than waiting to be told.
What’s the one question worth asking?
“Can you produce an inventory of everywhere your organization uses cryptography?”
It works because it can’t be answered with reassurance. Either the inventory exists or it doesn’t, and the answer tells you where they are on all five steps at once. An organization that has one has almost certainly done the thinking behind steps 2 through 5. One that doesn’t hasn’t started, whatever else they say.
There’s a full template at How do I ask a company what their quantum plan is?
How do I read the answer I get?
| What they say | What it means |
|---|---|
| They mention an inventory, a CBOM, or a discovery exercise | They’ve genuinely started |
| They give a date or a phase, even roughly | Real program, real planning |
| They name the standards, or say ML-KEM, or mention hybrid | Someone technical is actually involved |
| They distinguish what they control from what’s in vendor products | Sophisticated and honest |
| ”We take the security of your data very seriously” | Every reply opens this way. Look at what follows. |
| ”We use industry-standard encryption” | That describes the encryption being replaced |
| ”We use bank-level or military-grade encryption” | Marketing language that doesn’t address this |
| ”We’ll adopt new standards when they’re finalized” | Checkably wrong. They were finalized in August 2024. |
| No answer at all | Also information |
Why is this taking them so long?
Worth understanding, because it makes you a better judge of who’s being honest.
The estate is bigger than anyone thinks. The inventory problem is real, and organizations that have been running for decades genuinely don’t know what they’re running.
Much of it isn’t theirs to fix. Purchased products, embedded equipment, and vendor-managed services all put the fix outside their control.
There’s no incident forcing it. Security work gets funded after something breaks. Nothing here breaks, so this competes for budget against problems that have already hurt someone.
And the people who understand it are scarce. There aren’t many people who can lead this work, and every organization needs one at the same time.
None of that excuses inaction, and all of it explains the pace better than assuming nobody cares.
Questions people ask
Is my bank likely further ahead than my hospital? Financial institutions generally have more mature security programs and more regulatory pressure. Health systems carry more legacy equipment and thinner budgets. That’s a tendency rather than a rule.
Should small businesses be doing this too? The same five steps apply at a much smaller scale, and for a small business the inventory is usually tractable in a way it isn’t for a hospital network.
What if they just don’t answer? That’s an answer. Ask again publicly, since companies respond faster to public questions.
Can I do anything if they’re behind? Ask, ask again, and tell them it affects where you take your business. For health and genetic data, a state attorney general’s office may take consumer inquiries, as several did over 23andMe.
Are regulators making them do this? In some sectors and jurisdictions, increasingly. See What do regulators expect of us?
Where to go next
- The question template puts this into a message you can send.
- What should I actually do? is your side of it.
- Are my medical records safe? covers what’s at stake with health systems specifically.
Go deeper into the technical detail
The technical version is Start a Migration and Cryptographic Bill of Materials (CBOM).
These open the Post-Quantum Field Guide, a separate site written for security professionals.
Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.