This practical briefing draws on the dated sources below. It explains guidance and its application for businesses.
In this article
01What changed
The NCSC updated its TLS guidance on 15 October 2026 to include recommended post-quantum cryptography configurations. TLS protects connections used by websites, email and other services. The update covers hybrid and pure post-quantum key-exchange choices and explains how they fit into a planned migration.
The guidance says TLS 1.3 is needed for these post-quantum options. Correctly configured TLS 1.2 still protects against classical attacks, but organisations using it should plan a transition to TLS 1.3 so they can adopt the new capabilities.
02Why it matters
Our practical interpretation: the useful first step for a small business is to identify which supplier controls each connection. The NCSC says many SMEs using standard commercial technology can receive post-quantum changes through vendor updates. Bespoke software and specialised services may need a more deliberate upgrade plan.
03What to do
CyberScan practical checklist: apply these steps to your own services and responsibilities.
- List the hosting, CDN, email and other suppliers that protect important business communications.
- Ask which services support TLS 1.3 and which supported post-quantum configurations are available or planned.
- Identify business data that needs to remain confidential for a long time, and use that information to prioritise supplier discussions.
- Agree ownership, compatibility testing and a rollback route before changing production settings. Keep browsers, server software and managed services on supported updates.
- Retain the supplier’s response and the results of authorised connection checks as evidence of progress.
04Limits
TLS 1.3 support alone does not demonstrate that a connection negotiated post-quantum key exchange. The NCSC also distinguishes that migration from post-quantum authentication, where standards and deployment work continue. A check of a website’s public endpoint cannot establish the configuration of every internal service or supplier connection.
Sources & dates
Follow the original publications for the detailed scope and current advice. Checked .
- Post-quantum updates to our TLS guidance (opens in a new tab)
- Using TLS to protect data (opens in a new tab)
- Timelines for migration to post-quantum cryptography (opens in a new tab)
Background guidance from March 2025; the news event is the separate 15 October 2026 TLS update.
Prepared with AI-assisted drafting and source checking. Practical actions are CyberScan’s interpretation of the cited material; the sources and stated limits should guide any change to a live service. Read our editorial approach.