Ensuring the secure provision of data and services using critical information infrastructures amidst the evolving technology landscape is a crucial yet recurrent task. However, these infrastructures can become vulnerable due to developments in quantum computing and modifying the infrastructures with quantum-safe (QS) technology is unlike regular control and maintenance. Organizations need to modify their cryptographic layers, which act as the fundamental building blocks of infrastructures. For organizations, many uncertainties pose challenges across technological, organizational and ecosystem areas. While QS technology is new and not yet available for implementation and adoption, changes in critical information infrastructures require collaboration among multiple public and private organizations spanning industries and borders. By understanding the roles, organizations may better understand what should be done for QS transitions. Until now, there has been no academic research examining the roles that government could or should play in QS transitions. This paper reveals 12 different roles, showing the diversity and breadth of actions needed. While there are many possible roles that still need to be allocated for coordinated efforts, there is a high reliance on the government, and organizations are waiting for and expecting governments to take more active roles in QS transitions. The results also signals that QS transition research is at its early stage with a clear governance void and lack of collective urgency in the ecosystem.

By utilizing the properties of quantum mechanics, quantum computers have the potential to factor a key pair of a large prime number and break some of the core cryptographic primitives that most information infrastructures depend on. This means that today's widely used cryptographic algorithms can soon become unsafe and need to be modified with quantum-safe (QS) cryptography. While much work is still needed in developing QS cryptographic algorithms, the institutional, organizational, and policy aspects of transitioning the current infrastructures have received less attention. This paper provides an empirical analysis of QS transition challenges and policy recommendations for moving to a QS situation. We analyzed the data collected through interviews with experts and practitioners from the Dutch government. The results reveal that institutional, organizational and policy aspects of QS transitions are interconnected, and solutions for QS transitions are scattered. Consequently, organizations may face a Catch-22 loop without further actionable approaches and planning for QS transitions.

The computation power of quantum computers introduces new security threats in Public Key Infrastructure (PKI), a system used by many governments to secure their digital public services and communication. This calls for an inevitable need for governments to be quantum-safe (QS) by modifying their PKI systems to be resistant to the attacks of quantum computers. However, there is limited academic literature on a QS PKI system, and in this limited literature, the transition challenges are perceived as exclusively technological. This paper aims to create a structured overview of challenges when transitioning to a QS PKI system. We do this by reviewing literature and classifying the challenges using Technology-Organization-Environment (TOE) framework and using an expert workshop to explore the challenges in the context of the PKI system in the Dutch government. The main challenges in the technological context include no universal QS solution, legacy system, complex PKI interoperability, and vulnerable Root CA. The main challenges in the organizational context include knowledge gap, unclear governance, lack of urgency, and in-house management support. Furthermore, the main challenges in the environmental context include institutional void, stakeholder collaboration, lack of awareness, and policy guidance. The results indicate that the QS transition from the current PKI system is complex, and the challenges are socio-Technical. For policy-makers, this implies that they should start early to prepare, whereas organizations are hardly aware of the process of QS transition and the topic of quantum computing is yet to develop the urgency in organizations.