Preparation for the Post-Quantum Certified Architect Exam
Every PQC migration comes down to architecture decisions. Which algorithms for which systems. How to handle hybrid deployments during transition. Where to place cryptographic boundaries. How to design PKI hierarchies that support both classical and post-quantum certificates. How to build in agility so the next transition costs less than this one.
PQCA Architect Training develops the design competencies needed to make these decisions well. You work end to end, from assessing the current cryptographic estate through algorithm selection, hybrid implementation design, PKI migration, and cryptographic agility. Each module combines conceptual frameworks with applied design exercises using realistic enterprise scenarios.
Where PQCS Training builds the foundational competence to assess and plan, and PQCM Training develops program leadership, PQCA focuses on the technical design layer, the decisions that determine whether an implementation is correct, performant, and maintainable.
Course Outline
Module 1. Cryptographic Architecture Assessment
Analyzing the current state: mapping every place cryptography is used, how keys are generated and managed, where trust anchors live, and which dependencies cross system boundaries. Going beyond the CBOM produced in PQCS to build a full architectural view that captures trust relationships, data flows, and the interaction between different cryptographic layers. Identifying the architectural constraints that will shape the migration: legacy systems that cannot be upgraded, performance-critical paths, regulatory requirements, and vendor dependencies that limit options.
Module 2. Algorithm Selection for Specific Contexts
The PQCS course covers algorithm fundamentals. This module applies that knowledge to design decisions. When ML-KEM is the default and when it is not. When SLH-DSA’s conservative security assumptions justify the larger signatures. When FN-DSA’s compact signatures are worth the implementation complexity. How to assess the tradeoff between key/signature size and performance for each deployment scenario. Algorithm selection for constrained environments (IoT, embedded systems, smart cards). How to document algorithm selection decisions so they hold up in audit and in later review.
Module 3. Hybrid Implementation Design
Hybrid cryptography is the consensus transition approach, but there are multiple ways to implement it, each with different security properties, performance characteristics, and operational implications. The options are concatenated hybrid key exchange (the approach deployed in TLS 1.3 at scale), combiner-based approaches with formal security proofs, nested signature schemes, and dual-certificate strategies. You will assess the performance and bandwidth implications of each approach, design fallback and negotiation strategies, and plan for “hybrid exit”, the eventual removal of the classical algorithm once confidence in post-quantum algorithms is established.
Module 4. Migration Pattern Selection
Different systems require different migration approaches. In-place algorithm upgrade works for systems with clean cryptographic abstraction layers. Parallel deployment (running classical and post-quantum systems side by side) suits environments where availability is critical and rollback must be fast. Gateway-based approaches allow migration of internal systems while maintaining classical compatibility with external partners. You build a decision framework for selecting the right pattern for each system in the estate, weighing risk tolerance, testing requirements, performance constraints, and organizational readiness.
Module 5. PKI Migration Architecture
PKI is the infrastructure bottleneck for most enterprise PQC migrations. Post-quantum certificates are larger (ML-DSA signatures are approximately 2.4 KB versus 64 bytes for a raw P-256 ECDSA signature, about 71 bytes DER-encoded), which has cascade effects on certificate chain validation, OCSP response sizes, TLS handshake latency, and HSM storage. Dual-capability PKI design (supporting both classical and post-quantum certificates during transition), trust anchor migration strategies, HSM inventory and firmware upgrade paths, certificate lifecycle management during the transition period, and the architectural decisions that determine whether PKI migration is a smooth evolution or a disruptive flag day.
Module 6. Cryptographic Agility Architecture
The PQC migration will not be the last cryptographic transition. Cryptographic agility means designing systems that can change algorithms with bounded effort. This module distinguishes architecture patterns that genuinely achieve agility from those that only claim it. You will examine protocol-layer agility (algorithm negotiation in TLS, SSH, IPsec), application-layer agility (abstraction patterns, configuration-driven algorithm selection), and infrastructure-layer agility (key management systems, HSMs, certificate management). Testing agility in practice: verifying that a system designated as “agile” can actually switch algorithms under realistic conditions.
Module 7. Migration Design Documentation
Producing architecture artifacts that implementation teams can follow. Architecture decision records (ADRs) that capture the reasoning behind algorithm and pattern selections. Technical specifications with enough detail for implementation without over-constraining the approach. Design review processes: what to review, who should review it, and how to handle disagreements between security requirements and operational constraints. Communicating architectural trade-offs to non-architectural stakeholders.
Format and Delivery
This program is available online on-demand, live online, in person, and as private team training; current prices for each format are in the booking section below. Live online and in-person sessions include 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is. Training format and exam format are independent: however you train, the exam is delivered as a proctored assessment, under arrangements confirmed when you book.
Live online and in-person sessions run 24 hours of instruction across four days, six hours of teaching each day within a seven and a half hour schedule that includes lunch and breaks. The online on-demand course covers the same material at a self-paced pace of roughly 40 hours.
Prerequisites
- Active PQCS – Post-Quantum Certified Specialist certification
What Comes Next
After completing this course, you are eligible to sit for the PQCA certification exam. Earn PQCM + PQCA + PQCV and you are automatically awarded PQCX – Post-Quantum Certified Expert.
Pricing
| Option | Price |
|---|---|
| Online On-Demand | US$2,499 |
| Live online | US$2,999 |
| In-person | US$3,499 |
| Online training + PQCA exam bundle | US$2,999 |
| In-person training + PQCA exam bundle | US$3,999 |
All prices are in US dollars.
Who this course is for
Security architects, enterprise architects, senior security engineers, cryptography engineers, and technical leads who will be responsible for designing PQC migration solutions. You should already hold PQCS-level knowledge and be ready to apply it at the architectural level.
What you’ll be able to do afterward
- Assess an organization’s cryptographic architecture to identify every point requiring PQC migration, including embedded and non-obvious cryptographic dependencies
- Select appropriate PQC algorithms for specific deployment contexts, accounting for security requirements, performance constraints, key and signature sizes, bandwidth budgets, and interoperability needs
- Design hybrid implementation strategies (hybrid key exchange, hybrid signatures, composite certificates) appropriate to the transition period
- Architect PQC migration at the protocol level for TLS, SSH, IPsec/IKEv2, S/MIME, code signing, PKI, DNSSEC, and other standards
- Evaluate trade-offs between migration approaches (in-place upgrade, parallel infrastructure, phased rollover) for different system types
- Design cryptographic agility into new and existing architectures
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
An active PQCS certification is required before this training. The path runs Foundation, then PQCS, then here. Cryptographic Agility and Hybrid Cryptographic Implementations are the two design-level courses that extend this work. PQCV Validator Training suits architects who also assure other people’s designs.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. The people who teach this course are running migration programs inside organizations now, and the course covers what those programs hit.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. This is not a professional certification.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
