Back to DashboardExecutivePhase 4 · Roadmap & Governanceintermediate30 min

Migration Program Management

Plan, execute, and track enterprise-wide PQC migration programs with structured frameworks and stakeholder alignment.

Why this matters: Discovery, prioritization, rollout, validation: this is the operating model that turns a PQC mandate into shipped systems.

Start here: Build the roadmap in step 1: your milestones on the two technical tracks and the governance spine, overlaid on the regulatory deadlines you do not control.

For your role

Executive / Business Leader: Build the roadmap with milestones on the regulatory deadlines for your countries, the stakeholder communication plan and the KPI tracker: the operating model that turns a mandate into shipped systems.
GRC / Risk & Compliance: The roadmap overlays framework deadlines on your milestones and the KPI tracker pulls live data; the execution checklist covers pre-migration, migration and validation, which is the evidence trail.
Researcher / Academic: The roadmap's deadlines come from the live compliance data and the KPI tracker scores from the migrate catalogue, so both are checkable against their sources.
IT Ops / DevOps: The step-by-step execution checklist from pre-migration through validation is the runbook; the roadmap and KPI tracker are what the programme office reports from.
Curious Explorer: A migration is a project with dates, people to tell and numbers to watch; the module builds each of the three in turn.

Practice in the Simulation

PQC Migration: A Program Management Challenge

Migrating an enterprise to is not a single project — it is a multi-year, cross-functional program that spans every system, vendor, and team that touches cryptography. Success requires structured planning, executive sponsorship, and continuous stakeholder alignment.

Migrating to post-quantum cryptography is as much an organizational challenge as it is a technical one. Agencies and enterprises should establish a dedicated migration program with clear governance, milestones, and reporting structures.

Aligned with CISA Post-Quantum Cryptography Initiative guidance (cisa.gov/pqc)

Program vs Project

A project delivers a specific output; a program coordinates multiple interdependent projects toward a strategic goal — full PQC readiness.

Critical Path

The longest sequence of dependent tasks determines your minimum migration timeline. Vendor PQC readiness is often the binding constraint.

Executive Sponsorship

Without C-suite commitment, PQC migration stalls. Budget, priority, and cross-department coordination require top-down authority.

PQC Migration Framework (7 Phases)

Aligned with CISA and NIST migration guidance, this structured framework serves as the foundation for enterprise PQC migration programs. Each phase builds on the previous and has clear deliverables.

Phase 1: Discovery

Identify all cryptographic assets across the organization using automated scanning and manual inventory.

Phase 2: Inventory

Build a comprehensive Cryptographic Bill of Materials (CBOM) documenting algorithms, key sizes, and dependencies.

Phase 3: Prioritization

Rank systems by quantum vulnerability, data sensitivity, compliance requirements, and migration complexity.

Phase 4: Planning

Develop migration roadmaps, allocate resources, establish governance structures, and define success criteria.

Phase 5: Pilot

Deploy hybrid PQC configurations in controlled environments to validate interoperability and performance.

Phase 6: Migration

Execute phased rollout of PQC algorithms across production systems with rollback capability.

Phase 7: Validation

Verify PQC deployment correctness, monitor for regressions, and establish continuous compliance.

Sequence the Program as Two Tracks

A PQC migration is not one cutover. It is two parallel workstreams with different drivers, different clocks, and different standards readiness. Confusing them leads programs either to over-invest early in signatures (where the threat is gated on a CRQC that does not yet exist) or to under-prioritise confidentiality (where the Harvest-Now-Decrypt-Later clock is already running).

Track A — lead

Confidentiality (KEM)

Defends against Harvest-Now-Decrypt-Later.

Migrate key establishment first: TLS, VPN/IPsec, stored-data key wrapping.
Prioritise by data secrecy-lifetime — long-lived secrets are already exposed.
ML-KEM (FIPS 203) is standardised; hybrid (X25519+ML-KEM) is deployable now.

Track B — follow / parallel

Authenticity (Signatures)

Defends against Harvest-Now-Forge-Later.

Migrate signing & PKI: code-signing, firmware, document & certificate signing.
Urgency is gated on CRQC arrival, PKI/HSM readiness, and standards finalisation.
ML-DSA / SLH-DSA (FIPS 204/205) plus on-ramp candidates still maturing.

Track-A vs Track-B at a glance

	Track A — Confidentiality (KEM)	Track B — Authenticity (Signatures)
Threat driver	Harvest-Now-Decrypt-Later (HNDL) — ciphertext captured today is broken retroactively.	Harvest-Now-Forge-Later (HNFL) — a forged signature only has value at use-time.
Clock	Already running. Anything with a long secrecy lifetime is at risk now.	Starts at CRQC arrival. Short-lived signatures rotate out before then.
Primary target	Key establishment / encryption: TLS, VPN/IPsec, stored-data KEK wrapping.	Authentication / integrity: PKI, code-signing, firmware, document signing.
NIST standard	ML-KEM (FIPS 203) — stable since Aug 2024.	ML-DSA (FIPS 204) / SLH-DSA (FIPS 205); on-ramp signatures still maturing.
Sequencing rule	Lead. Prioritise by data secrecy-lifetime vs. Mosca window.	Follow / parallel. Gate on PKI readiness, HSM support, and standards finalisation.

Rule of thumb: lead with KEM ordered by data secrecy-lifetime, run signatures in parallel gated on PKI readiness, and never block the confidentiality track waiting on signature-standard finalisation.

Where this connects

Quantum Threats

The HNDL vs HNFL threat split in depth

Risk Assessment

Produces a sequenced Track-A / Track-B backlog

Source: Applied Quantum PQC Migration Framework §5 (Migration Execution).

Critical Success Factors

Enterprise PQC migration programs that succeed share common characteristics. These success factors are drawn from early adopters and regulatory guidance.

Executive Sponsorship

CISO or CTO-level ownership with regular board reporting. Migration budgets, cross-team authority, and organizational priority require executive mandate.

Cross-Functional Teams

Security, engineering, compliance, vendor management, and business stakeholders must all be represented. Crypto touches every layer of the stack.

Phased Approach

Start with hybrid deployments in low-risk systems, validate, then expand. Big-bang migrations are too risky for cryptographic infrastructure.

Measurable KPIs

Track operational progress: % systems inventoried, % algorithms migrated, vendor readiness score, compliance gaps closed, budget utilization, and phase completion dates. What gets measured gets managed. For governance-layer KPIs (policy coverage, exception rate, board reporting cadence), see PQC Governance & Policy.

Workshop: Build Your Program

This workshop provides three interactive tools that produce real, exportable artifacts for your PQC migration program:

Step 1: Roadmap Builder

Build a migration roadmap with your milestones overlaid on real country-specific regulatory deadlines from the Timeline dataset.

Step 2: Stakeholder Communications Planner

Map stakeholders, craft tailored messages for each audience (board, technical leads, developers, partners), and define reporting cadence.

Step 3: KPI Tracker Template

Design a scorecard with weighted dimensions (systems inventoried, algorithms migrated, vendor readiness, compliance, budget, risk trend) auto-scored from live data.