Post-Quantum Cryptography (PQC) is cryptography built to stay secure even against an adversary holding a large, fault-tolerant quantum computer. It swaps algorithms like RSA and elliptic-curve, which such a machine could break, for math problems believed to resist quantum attack.
The urgency comes from a threat sometimes called harvest now, decrypt later: an attacker records encrypted traffic today and simply waits for quantum hardware to catch up. In 2024 NIST published its first PQC standards, FIPS 203, 204, and 205, giving organizations vetted algorithms to adopt. Migration is the hard part. Systems often hide cryptography deep inside libraries, hardware, and protocols, so many teams start with a crypto inventory and hybrid schemes that run a classical and a post-quantum algorithm side by side. Treating the switch as a one-line config change is where projects stall.
How is post-quantum cryptography tested on the CISSP?
PQC falls under Domain 3, Security Architecture and Engineering, which makes up 13 percent of the exam and includes cryptographic lifecycle and algorithm selection. Focus on why quantum computing threatens current public-key cryptography and on the idea of planning a managed migration, rather than on the internal math of any single algorithm.