NCSC Launches PQC Pilot to Certify UK Cyber‑Security Consultancies

The National Cyber Security Centre has announced a pilot scheme to accelerate the migration of the United Kingdom’s critical infrastructure to post‑quantum cryptography (PQC) until 31 March 2027. The scheme offers two service tracks: a Discovery & Migration Planning track that assesses a digital estate, identifies vulnerable components, prioritises upgrades and develops a roadmap aligned with NCSC timelines; and an Advice track that builds on the discovery work to guide the selection and deployment of PQC algorithms, requiring suppliers to meet the Discovery standard. It is open to established firms – Arqit, CGI IT UK Limited, Avella Security Limited, Cambridge Consultants Ltd., Capgemini, Frazer‑Nash Consultancy, IBM and PQShield – all vetted against the NCSC PQC Standard.

The application process consists of Part A (commercial questionnaire and background checks), Part B (technical assessment) and Part C (contract signing and onboarding); only those completing all stages are admitted. The next application window opens in late spring 2026, with firms required to email NCSCIndustryAssurance@ncsc.gov.uk. The pilot’s duration is intended to generate learning and refine criteria before a potential transition to a full‑time Assured Cyber Security Consultancy (ACSC) scheme, although participation does not guarantee continued membership in ACSC. The overarching goal is to reduce the risk posed by quantum computing through focused discovery, planning and advisory services.

Assured Cyber Security Consultancies Offer Discovery Planning and Expert Advice for PQC Migration

The ACSC scheme is a joint initiative between the UK national cyber‑security authority and selected specialists, designed to give government and critical industry access to vetted experts who can locate PQC specialists and build a national PQC capability. The authority has issued a Working Practices Document and a Buyer’s Guide, and it seeks to eliminate artificial obstacles through a feedback form on Microsoft Forms. Public‑sector buyers can utilise the Crown Commercial Services Dynamic Purchasing System, with guidance on its use, while customers in the critical national infrastructure sector are encouraged to contact their chosen consultancy directly. The aim is to build a resilient PQC ecosystem, providing organisations that engage with the scheme with expert support.

To force the required migration, the NCSC has set a hard stop of 31 March 2027. Organisations must conduct a discovery exercise in line with the NCSC Timelines for migration to PQC, cataloguing services and infrastructure that rely on classical cryptographic primitives, identifying vulnerable components and prioritising necessary upgrades. This discovery is followed by an initial migration plan that outlines the sequence of upgrades, testing regimes and risk mitigations. The PQC pilot is delivered through a curated cohort of ACSCs vetted against the NCSC PQC Standard, authorised to provide discovery & migration planning and, for a subset, direct advisory services. Guidance for the migration is further detailed in the technical recommendations paper “Next steps in preparing for migration to post‑quantum cryptography,” which offers algorithm‑level advice, key‑management considerations and testing frameworks. The deadline serves as a catalyst for urgent action.

The NCSC is lowering hurdles for PQC expertise to the critical sector by opening the ACSC scheme to a broader cohort and streamlining the application process. Firms with assurance for discovery and advisory can guide the full spectrum of PQC transition. The removal of barriers is expected to impact national security by expanding certified PQC specialists, reducing bottlenecks and mitigating concentration of knowledge. This proactive stance is aimed at strengthening the United Kingdom’s cyber resilience.