Migration Planning / Cloud Responsibility Matrix
§6.4What this is for: Architect + compliance-lead matrix from CSWP.39 §6.4 - per-asset-class shared-responsibility model across IaaS / PaaS / SaaS / FaaS, with PQC availability per cloud and watch-outs for multi-cloud, BYOK, FedRAMP, and sovereign-cloud overlays.
What a good answer looks like: No cell reads "shared" without saying who acts first. Shared responsibility is where migrations stall.
Worked example: Keep the defaults — AWS, IaaS + PaaS, TLS termination and KMS-backed keys in scope: the matrix has four rows, each naming Customer, Provider or Shared as owner with both sides' actions and a PQC availability read from the product catalog.
Runtime and privacy: This planning tool runs in your browser. Use synthetic or approved organizational data and review the site privacy terms before entering sensitive material.
For your role
- Security Architect
- Select the cloud providers and service-model mix, the key-management posture and data lifetime, then edit the responsibility plan: the matrix says per asset class who acts first, with the PQC availability per cloud and the BYOK, FedRAMP and sovereign-cloud watch-outs.
Cloud Shared-Responsibility Crypto Matrix
Architect + compliance-lead tool from NIST CSWP 39 Section 6.4 - Crypto Agility in the Cloud. Builds a per-asset-class shared-responsibility matrix across IaaS / PaaS / SaaS / FaaS, with PQC availability per provider and watch-outs for multi-cloud, BYOK, and FedRAMP overlays.
Shared responsibility is per cell
Each (asset class, service model) pair has its own owner. The PQC timeline is also per-cell, not per-cloud.
FedRAMP follows the module, not the algo
FIPS 140-3 re-validation follows algorithm GA by no fixed interval. Procurement deadlines should reference the validated-module list.
Customer keys are the customer lever
CSWP-39 Section 6.4: even when the provider runs the hardware, customers retain custody of their keys. That custody is the PQC opt-in.
Step 1 - Cloud posture
Tell the engine which clouds you operate in, which service models you consume, and the regulatory overlay you must honour.
Step 2 - Crypto inventory in cloud
Pick the asset classes in scope, the key-control posture, residency, and your harvest-now-decrypt-later horizon.
Step 3 - Responsibility plan (editable)
Edit the narrative carried into the exported matrix. The matrix, watch-outs, and recommendations are generated automatically.
- /assess — compliance frameworks step— Step 5 captures policy + framework registry
- /compliance — framework explorer
- /leaders — stakeholder ecosystem
- /library — policy & governance docs
- NIST CSWP.39-upd1 — Considerations for Achieving Crypto Agility (Dec 2025, upd. Jun 2026)
- NIST IR 8547 — Transition to PQC Standards
- ENISA — Post-Quantum Cryptography Integration Study
- NIST Computer Security Resource Center (Americas)
- NIST News & Events (Americas)
- NSA Media Defense Portal (Americas)
- CISA Quantum Page (Americas)
- BSI Post-Quantum Cryptography (EMEA)
- ANSSI Cryptography Guidelines (EMEA)
Try it
What may no cell of the matrix say without more?
Next step
Next in Migration Planning: Crypto Architecture DiagramCrypto Architecture Diagram is the next Migration Planning tool in the Command Center.