Migration playbook

The PQC migration lifecycle: discover, assess, prioritize, plan, execute, validate

Post-quantum migration is a repeatable lifecycle, not a one-off project. This is the end-to-end shape of the work: the six phases, what each produces, and why the order matters.

From inventory to roadmap: turning findings into a sequenced plan

A cryptographic inventory is a map, not a plan. This is how to convert discovered assets into a sequenced, owned, dated migration roadmap that leadership can fund and engineering can execute.

What belongs in a cryptographic inventory, and how to discover it

A cryptographic inventory maps every algorithm, key, certificate, protocol, and library you run, plus where each is used and what it protects. This is what to capture and the discovery methods that find it all.

CBOM: expressing your cryptographic inventory in CycloneDX

A Cryptography Bill of Materials makes your inventory diffable, queryable, and CI-native. What CBOM is, how CycloneDX models cryptographic assets, and how to keep it alive.

Prioritizing migration by data lifetime and HNDL exposure

Not all quantum-vulnerable systems are equally urgent. Mosca's inequality and harvest-now-decrypt-later exposure tell you what to fix first, and what can safely wait.

Crypto-agility: designing so the next algorithm change isn't a rewrite

The real cost of PQC migration is finding and changing hard-coded cryptography. Crypto-agility is the architecture that makes algorithm changes configuration, not surgery, and it pays off again with every future transition.

Migrating TLS and network encryption to post-quantum

TLS is where most estates start, because externally facing key exchange is the harvest-now-decrypt-later front line. How hybrid TLS works, how to deploy it, and what to watch for.

Migrating PKI and certificates to PQC signatures

Certificate authorities, chains, and the signatures that anchor trust all have to move to post-quantum algorithms. Why PKI is a dependency for everything else, and how to sequence it.

Data-at-rest, code signing, secrets and identity: the other migration domains

Beyond TLS and PKI, four domains each have their own migration shape: encrypted storage, code and firmware signing, secrets/KMS, and identity tokens. What changes in each and the traps particular to it.

Hybrid deployment: running classical and PQC side by side

Hybrid combines a classical algorithm with a PQC one so security holds if either survives. Why it's the default transition state for key exchange, when it applies to signatures, and the risks to manage.

Testing PQC: interoperability and performance before you commit

PQC changes fail in the field over larger messages, mismatched algorithm support, and middlebox quirks. Build an interoperability matrix and a performance baseline before any production cut-over.

Rollout and supply-chain readiness: the crypto you don't control

Much of your quantum-vulnerable cryptography lives in vendor products and services you cannot patch yourself. How to assess supplier readiness, ask the right questions, and manage the rollout.

The PQC migration master checklist

A reusable, phase-by-phase checklist you can copy into your program tracker, covering discovery through validation, plus per-domain and per-wave gates. Adapt it; don't treat it as gospel.