REGULATORY REFERENCE · CANADA
ITSM.40.001 is the Canadian Centre for Cyber Security's Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada, published in June 2025. It sets the dates by which federal departments must plan, report on and complete their move off quantum-vulnerable cryptography, and it defines what counts as done. This page summarises the roadmap and explains what it means for organizations that sell to, connect to or are regulated by the federal government. Last reviewed September 25, 2026.
Every Government of Canada department and agency was to have an initial post-quantum migration plan in place by April 2026 and to report progress annually from then on. High priority systems, those protecting sensitive or long lived information, are to be migrated by the end of 2031. All remaining systems are to be migrated by the end of 2035. The roadmap is issued under the authority of the Cyber Centre, part of the Communications Security Establishment, and applies to departments directly and to their suppliers through procurement.
June 2025: roadmap published. April 2026: departmental migration plans due. Annually from 2026: progress reporting. End of 2031: high priority systems migrated. End of 2035: all remaining systems migrated. These align with the United States federal target of 2035 under NSM-10 and with the G7 Cyber Expert Group's call to action, which Canada co-signed, to begin migration now.
The roadmap expects quantum-vulnerable algorithms to be disabled, isolated or tunnelled, not left running alongside new ones. That is the line most people skip. A hybrid key exchange that silently falls back to classical when a peer does not support the post-quantum part is compliant on the data sheet and exposed on the wire. Meeting the standard therefore requires continuous observation of what is actually negotiated on the network, not a one time configuration change.
Not directly, but in practice yes. The 2031 and 2035 dates become a supplier's dates the day it sells to, connects to or is regulated by the federal government, because a department cannot report a system as migrated while a vendor tunnel into it still negotiates classical keys. Critical infrastructure operators designated under Bill C-8 should expect regulators to use the same dates as a reference point for what a reasonable cyber security program looks like. The companion publication ITSAP.00.017, Preparing your organization for the quantum threat to cryptography, is the Cyber Centre's guidance for organizations generally.
Build a cryptographic inventory of every cipher, protocol, key and certificate in use, observed on the wire rather than assumed from documentation. Rank systems by the sensitivity and lifetime of the data they protect, which is how the roadmap defines high priority. Produce a costed migration roadmap that a budget cycle can absorb. Move transport first, using quantum-safe keys delivered into existing firewalls and VPNs, then monitor continuously so fallback to classical is caught. Keep the evidence, because the annual reporting obligation flows down the supply chain.
Canadian Centre for Cyber Security, Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada (ITSM.40.001): https://www.cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001 . Canadian Centre for Cyber Security, Preparing your organization for the quantum threat to cryptography (ITSAP.00.017): https://www.cyber.gc.ca/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017 . G7 Cyber Expert Group, call to action on preparing for the post-quantum era: https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era . NIST FIPS 203, 204 and 205 (August 2024): https://csrc.nist.gov/projects/post-quantum-cryptography .
Plan to the roadmap's standard: the Discovery Program