Counting Down to Q-Day: A Systems-Engineering Review of Quantum-Safe Cryptography Readiness in Critical Infrastructure

Every piece of critical infrastructure that relies on public-key cryptography (the power grid’s control systems, the banking sector’s settlement networks, the certificate authorities underpinning the internet) shares a single point of mathematical failure: the assumption that factoring large integers and solving discrete logarithms remains computationally intractable. A sufficiently capable quantum computer would remove that assumption. This review examines the systems-engineering gap between the cryptographic community’s response to that threat and the operational reality of critical infrastructure. The U.S. National Institute of Standards and Technology finalized its first three post-quantum cryptography standards in August 2024, and a dense web of national mandates has since converted a theoretical migration into a scheduled one. Yet the infrastructure most exposed to long-term harm from “harvest now, decrypt later” data collection is also the infrastructure least equipped to migrate quickly: operational technology with fifteen-to-thirty-year hardware lifecycles, constrained embedded devices with single-digit kilobytes of spare memory, and layered public-key infrastructures that took decades to build and cannot be swapped overnight. This paper synthesizes the standardization timeline, the harvest-now-decrypt-later threat model, sector-specific bottlenecks in energy, finance, and telecommunications, and the emerging consensus that cryptographic agility, not any single algorithm choice, is the actual deliverable that determines whether critical infrastructure is “quantum-safe” in any meaningful sense. It closes by identifying where the literature is thin: independent verification of vendor readiness claims, quantitative models of migration cost across heterogeneous OT fleets, and the absence of binding, rather than advisory, quantum-safe mandates for the private operators who run most of the world’s critical infrastructure.