Facilities Brace for Quantum-Safe Retrofits as Security Guidance Sets 2028–2035 Deadlines

Facilities Management (FM) organisations are being pushed to plan concrete migrations to post-quantum cryptography (PQC) across building systems, with national cyber authorities setting explicit timelines and major vendors outlining roadmaps for quantum-safe capabilities. The emphasis: inventory cryptography, build crypto-agility, and prepare BMS, access control, and OT networks for phased cut-overs well before 2035 (NCSC 2025).

What’s driving the shift

Regulators and industry bodies warn that “store-now, decrypt-later” adversaries could harvest building data and long-lived credentials today, to decrypt once fault-tolerant quantum machines arrive. New guidance frames a three-stage plan—identify critical services by 2028, prioritise upgrades by 2031, and complete migration by 2035—urging operators to replace vulnerable public-key schemes with PQC while maintaining interoperability with existing protocols (NCSC 2025). Recent sector advisories reinforce urgency and the need for executive ownership (ISACA 2025; FS-ISAC 2025).

Facilities scope: beyond IT to the plant room

Unlike a pure IT estate, FM spans BMS, physical access control, visitor systems, CCTV backbones, lifts/elevators controllers, smart locks, and vendor-managed remote connections—often running on mixed vintages and constrained devices. Practical consequences include:

• Cryptographic inventory: Catalogue where RSA/ECDH/ECDSA appear in BACnet/SC gateways, TLS stacks in building apps, VPNs for remote maintenance, badge/credential systems, and device firmware (CISA 2025).
• Crypto-agility: Introduce abstraction layers so controllers and middleware can rotate algorithms (e.g., to ML-KEM key exchange and ML-DSA/SLH-DSA signatures) without rewriting every integration (Microsoft 2025).
• Interoperability and fallbacks: Plan hybrid periods during which PQC and classical algorithms co-exist, with policy engines enforcing preferred suites by site or device tier (NCSC 2025; Microsoft 2025).

What’s changed in the last six months

• Time-boxed national guidance: Authorities published explicit 2028/2031/2035 PQC milestones, turning “prepare” into dated programme plans for large operators, including transport and critical infrastructure landlords (NCSC 2025).
• Enterprise roadmaps: Major vendors detailed quantum-safe programme strategies and product timelines, giving FM leaders reference milestones for procurement and vendor due diligence (Microsoft 2025).
• Sector calls to action: Financial-sector and enterprise surveys underscore widespread under-preparedness, signalling that FM portfolios—often with thin cyber headcount—must assign budget and ownership now (FS-ISAC 2025; ISACA 2025).

Implementation playbook for FM leaders

1) Stand up a crypto inventory.

Create a register of cryptographic dependencies across BMS/OT and vendor links: algorithms, key lengths, libraries, certificates, and device constraints. Map which systems can accept PQC via firmware vs. which require gateway termination or device refresh (CISA 2025).

2) Design for crypto-agility.

Adopt central policy services to dictate “current best” signature and key-establishment algorithms, so future upgrades are configuration-driven rather than code-driven (Microsoft 2025).

3) Prioritise high-exposure paths.

Triage external remote-access tunnels, cloud-connected building apps, and access-control backends first; then address intra-building East-West traffic and legacy serial/IP translators (NCSC 2025).

4) Pilot, then scale.

Run two-site pilots covering: certificate lifecycle under PQC, protocol performance (handshake sizes/latency), logging, incident response updates, and vendor SLAs. Track KPIs: deployment success rate, connection stability, MTTR, and service uptime.

5) Procurement & contracts.

Bake PQC support and crypto-agility clauses into new FM and OEM contracts, including timelines for ML-KEM/ML-DSA availability, firmware signing, and support for mixed-suite operation (ISACA 2025).

Risks, mitigations, and what’s still unknown

• Device constraints: Legacy controllers may not handle larger keys or message sizes; gateway-based PQC termination can mitigate while planning refresh cycles (CISA 2025).
• Operational disruption: Certificate and key-management changes can cause outages; staged roll-outs with canary sites and rollback plans are essential (NCSC 2025).
• Ecosystem readiness: Vendor timelines vary; proactive roadmap interrogation and lab validation reduce surprises (Microsoft 2025).

Bottom line:

Quantum-safe migration has shifted from concept to calendar. For FM portfolios, the next two budget cycles should lock in cryptographic inventories, pilots on representative sites, and procurement commitments that deliver crypto-agility—so estates can meet the 2028–2035 milestones without jeopardising building operations (NCSC 2025; Microsoft 2025; FS-ISAC 2025; CISA 2025).