EN|FREN|FRStandards are recent, implementations uneven, performance and migration paths vary. Post-quantum efforts span infrastructure, applications, identity, governance, vendors. Precise figures are unreliable; use scenario-based estimates and focus on cost drivers, not totals. Early exact budgeting risks false confidence.
Drivers include cryptographic scope (number of systems, diversity of protocols), architectural complexity (legacy, crypto agility), performance (larger keys/signatures), operational constraints (availability, compatibility). They define effort and risk profile, not costs in isolation.
Non-technical costs: design and testing, training, project management, vendor and procurement impact, operational risk (migration errors, rollback). Indirect costs often exceed technical costs, are underestimated early, and determine project success.
Use ranges and scenarios, not fixed numbers: low/medium/high impact, phased distribution, separation of preparation vs migration costs. Scenario-based estimation supports comparison of options, prioritisation, and refinement as maturity increases.
Cost analysis has value when it drives when to act, where to invest first, and when postponement is justified. Defensible outcomes include active monitoring, limited pilots, or no immediate migration — if risks are understood and review points are defined. Readiness is about controlling future exposure, not minimising cost.