The conversation about OT quantum security migration tends to start in the same place: an asset with no upgrade path. You identify that a SCADA master or a PLC running a gateway protocol needs to move to quantum-safe cryptography, and the vendor confirms there is no migration path for that device. That is not a migration problem. it is a procurement problem. The OT Cryptographic Asset Prioritisation Matrix is built for this reality. It prioritises the assets that can migrate, flags the assets that cannot, and gives you the constraint data needed to plan replacement procurement for the rest. Score your OT cryptographic assets
What the OT Cryptographic Asset Prioritisation Matrix Does
The matrix is the vertical specialisation of the enterprise Cryptographic Asset Prioritisation Matrix for industrial environments. The asset types, scoring logic, and output format are built for the specific constraints of ICS, SCADA, and OT security. It does not assume IT migration patterns apply to OT.
The inputs are structured around OT-specific asset categories:
Asset type: PLC, RTU, SCADA master station, engineering workstation, historian, OT firewall and gateway, field device, and industrial protocol gateway. The taxonomy covers the full range of industrial control system components, not an adapted IT asset list.
Communication protocol: Modbus, DNP3, IEC 61850, PROFINET, EtherNet/IP, IEC 60870, and others. Protocol identification matters because the cryptographic protection applied in OT environments is typically at the gateway or network layer, not the device layer. A device running Modbus has no native cryptographic security at all. Modbus was not designed with authentication or encryption. DNP3 has an optional Secure Authentication mechanism (DNP3 SAv5), but deployment rates are low in practice. Where encryption exists in OT environments, it is usually applied by a gateway or boundary device, and that is where migration is feasible.
Asset criticality: safety-critical, operational-critical, operational, or monitoring. A safety-critical PLC in a water treatment plant has fundamentally different migration constraints from a monitoring sensor in a warehouse facility. Criticality affects both the priority score and the migration pathway recommendation.
Migration constraint: vendor-managed system, operator-maintainable, end-of-life, or no migration path. This is the input that differentiates the OT matrix from its enterprise counterpart. The constraint flag is what tells you whether migration is a migration project or a procurement project.
Data sensitivity profile: what category of operational data does this asset process or protect?
The scoring combines quantum exposure, operational criticality, and migration feasibility into a weighted priority score. The output is a ranked list of OT assets by migration priority, with constraint flags marking which assets face vendor dependencies, end-of-life barriers, or no available upgrade path.
Why OT Quantum Migration Prioritisation Is Different
A PLC installed in a manufacturing facility today may still be operating in 2040. The CRQC arrival window. where published estimates range from the early 2030s to the early 2040s. directly overlaps with the expected service life of industrial infrastructure being deployed now. This is a procurement consideration, not just a migration consideration. Systems being specified today should carry quantum security requirements; systems installed in the past may have no path to compliance except replacement.
The protocol layer compounds this. Legacy OT protocols were designed for reliability and real-time determinism, not cryptographic security. Modbus has no authentication mechanism. Most DNP3 deployments run without SAv5. IEC 61850 has defined security profiles but implementation varies significantly by vendor and site. Where cryptographic protection exists in OT environments, it is typically applied at the network boundary. an OT firewall or encrypted VPN tunnel. rather than on the field device itself. This means the migration strategy for most OT environments focuses on the gateway layer first and the field device layer later (or, for many legacy devices, never. via replacement).
Operational constraints are not comparable to IT migration constraints. An enterprise web server can be updated during a scheduled maintenance window with a few hours' notice. A major maintenance window for a power generation site or a chemical plant is planned months in advance, requires regulatory notification, and carries significant commercial cost. A migration programme that does not sequence around operational calendars will not complete. The matrix outputs a priority ranking; operational scheduling is the human layer that sits on top of it.
The regulatory frameworks that govern OT operators are specific and active:
NIS2 applies to operators of essential services across the EU in energy, transport, water, health, digital infrastructure, and other critical sectors. It entered enforcement in October 2024. Cryptographic resilience requirements under NIS2 are not quantum-specific yet, but the framework's risk management requirements encompass encryption and key management practices.
NERC CIP applies to bulk electric system operators in North America (USA and Canada) and sets cybersecurity requirements enforced by NERC. It does not apply to European operators, who are covered by NIS2 and national sector regulations.
IEC 62443 is the international standard series for industrial automation and control system security. It is not regulation. it is the technical standard framework that operators and vendors use to demonstrate security compliance. PQC considerations are beginning to appear in IEC 62443 discussions.
Name the standard rather than referencing "regulatory pressure." The OT security professional does not need a general observation. they need to know which of the frameworks governing their operations is moving in which direction.
Our tools are designed as directional tools only. Advice and standards are changing rapidly and although we update tools as new information is periodically released they are not designed as a replacement for expert advice. If your organisation results show high-priority exposure the next step is to contact our team or speak to a qualified expert member.
How to Use the OT Cryptographic Asset Prioritisation Matrix
Step 1. Open the tool. No registration or account required.
Step 2. Enter your OT asset categories. Work at the asset class level rather than entering individual devices. For a large industrial site, "PLCs in Building Automation" is a practical category; individually entering each PLC is not.
Step 3. For each asset class, select the asset type. Choose from the OT taxonomy: PLC, RTU, SCADA master, engineering workstation, historian, OT firewall/gateway, field device, or protocol gateway.
Step 4. Identify the communication protocols in use. If an asset class uses multiple protocols, select all that apply. Protocol selection affects the constraint assessment. a class using only Modbus for field communication will score differently for migration feasibility than one running IEC 61850 with defined security profiles.
Step 5. Rate operational criticality. Select the criticality level that accurately reflects the operational consequence of this asset class: safety-critical, operational-critical, operational, or monitoring. Be accurate. over-rating everything as safety-critical produces a less useful output than genuine differentiation.
Step 6. Assess migration constraints. This is the most consequential input for OT environments. For each asset class: is it a vendor-managed system (vendor controls upgrade timing), operator-maintainable (your team can install updates), approaching or at end-of-life, or does it have no known migration path to quantum-safe cryptography?
Step 7. Review the prioritised output. The matrix generates a ranked asset list with priority tiers and constraint flags.
How to Interpret Your OT Migration Priority Results
The output contains two distinct categories of information: priority tiers for assets that can migrate, and constraint flags for assets that cannot.
Priority Tier 1: OT gateway and network-layer assets with available migration paths. These can often be migrated without touching the field devices they serve. updating the boundary security layer provides quantum-safe protection to the devices behind it, even if those devices themselves have no migration path. This is usually the first feasible migration action in an OT environment.
Priority Tier 2: SCADA master stations and historian systems. These are typically vendor-managed with defined upgrade roadmaps. Timeline is dependent on vendor release schedules. Engage vendors now to understand when quantum-safe releases are planned and what upgrade paths look like.
Priority Tier 3: field devices and legacy PLCs. The majority of these will be constrained by vendor roadmaps or will have no migration path. For assets in this tier with a migration path, schedule in the next planned maintenance window. For assets with no migration path, document them as planned replacements and tie the replacement timeline to the device's end-of-life schedule.
Constraint-flagged assets require a procurement plan, not a migration plan. Document them with an estimated replacement timeline, and where possible, ensure replacement procurement specifications include quantum-safe cryptography requirements. This is the conversation most OT quantum security discussions end with. "this device has no upgrade path, so we need to know when it reaches end-of-life and build a replacement programme around that." The matrix makes it explicit so the procurement timeline can be built deliberately rather than discovered urgently.
For deeper protocol-level vulnerability analysis, the OT Protocol Quantum Vulnerability Scanner provides the protocol-layer detail that complements the asset prioritisation output.
Discuss your results with a QSECDEF expert member. A directional assessment is the starting point, not the programme. If your results show high-priority exposure, the next step is a discussion about a structured migration programme with defined milestones. Request a consultation with our team or find a qualified expert member.
