Preparation for the Post-Quantum Certified Validator Exam
A PQC migration is complete only once it has been verified. Every algorithm swap, every hybrid implementation, every protocol upgrade must be tested, validated, and confirmed before it can be trusted in production. Migrations often fail silently between “deployed” and “verified”. Typical examples are a misconfigured fallback that allows classical-only connections, and a hybrid implementation that negotiates correctly in the lab but breaks under production load. Another is a certificate chain that validates in one client but not in another.
PQCV Validator Training develops the testing, verification, and validation competencies needed to ensure PQC implementations actually work as designed. PQC verification goes beyond conventional quality assurance. It requires understanding the cryptographic properties being tested, the adversarial conditions that reveal implementation flaws, and the compliance evidence that auditors, regulators, and insurers will demand.
Why This Certification Exists
PQC migration creates a verification challenge that most organizations are not equipped to handle. Traditional security testing validates whether systems are configured correctly. PQC verification must also confirm four things. Cryptographic transitions are complete, with no legacy algorithm fallbacks still active. Hybrid implementations behave correctly under adversarial conditions as well as normal traffic. Implementations from different vendors and platforms interoperate. The evidence trail meets audit and regulatory requirements.
Without dedicated verification competence, organizations face two risks: deploying PQC implementations that contain exploitable weaknesses, and being unable to demonstrate compliance to regulators, auditors, insurers, and clients. The PQCV certification addresses both.
Course Outline
Module 1 PQC Test Strategy Design
Designing a verification program that covers the full scope of PQC migration. Defining what “verified” means for different system types and risk levels. Test strategy frameworks that map verification activities to migration phases. Determining test scope, coverage criteria, and resource requirements. The relationship between verification and the governance requirements of the broader migration program. Building a test strategy that meets technical validation, compliance, and audit requirements at the same time.
Module 2 Functional and Correctness Testing
Verifying that PQC algorithm implementations produce correct results. Testing key generation, encapsulation/decapsulation (for ML-KEM), and signing/verification (for ML-DSA, SLH-DSA, FN-DSA). Validating parameter selection and security level configuration. Testing cryptographic operations under boundary conditions, high load, and resource constraints. Verifying that implementations conform to NIST standards, for example ML-KEM-768 with the exact parameters specified in FIPS 203.
Module 3 Downgrade Attack Testing and Negative Testing
The most critical verification activity in PQC migration. Downgrade testing: can an attacker force a connection to fall back to a classical-only algorithm? Rollback testing: if a hybrid implementation is deployed, can it be made to negotiate without the post-quantum component? Negative testing: once a system is designated as “post-quantum only,” does it actually refuse connections using legacy algorithms? The test scenarios, tools, and methodology for adversarial verification: man-in-the-middle simulation, algorithm stripping attacks, and protocol confusion testing.
Module 4 Interoperability Testing
PQC migration involves components from multiple vendors. Interoperability is not guaranteed, even when every vendor claims PQC support. Cross-vendor testing: do implementations from different libraries produce compatible outputs? Cross-platform validation: does a certificate chain created with one implementation validate on another? Certificate chain verification with post-quantum certificates: handling the larger signature sizes and their impact on chain validation. Testing with different TLS libraries, HSM firmware versions, and client implementations. Structured approaches to interoperability regression testing during the transition period.
Module 5 Performance Validation
PQC algorithms have different performance characteristics from their classical predecessors. Key generation, encapsulation/decapsulation, and signing/verification are generally slower. Key and signature sizes are larger, affecting bandwidth and storage. Benchmarking methodology: establishing baseline performance, measuring PQC overhead, testing under production-representative load, and defining acceptable performance thresholds. Handshake latency measurements for PQC-enabled TLS. The difference between lab benchmarks and production performance. Identifying performance bottlenecks that require architectural changes versus those that are within acceptable overhead.
Module 6 Security Validation
Beyond functional correctness and performance: testing implementation security. Verifying that deprecated algorithms are properly rejected. Testing key management procedures for PQC keys. Validating random number generation quality (PQC algorithms depend on high-quality randomness). Assessing implementation resistance to known side-channel attack patterns. Verifying that cryptographic libraries are up to date and patched. Security validation checklists for each NIST standardized algorithm.
Module 7 Evidence, Compliance, and Sign-Off
Producing verification evidence that auditors will accept. Structuring test results as evidence dossiers that map to specific compliance requirements (ISO 27001, SOC 2, PCI DSS, CMMC, FedRAMP, DORA, NIS2). The difference between testing documentation (what you did) and evidence documentation (what it proves). Migration sign-off processes: who has authority to accept migration results, what evidence they need to make that decision, and how to handle conditional acceptance. Ongoing validation requirements, and why migration verification is a continuing assurance function.
Format and Delivery
This program is available online on-demand, live online, in person, and as private team training. Current prices for each format are in the booking section below. Live online and in-person sessions include 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is. However you train, every exam is a proctored assessment. We confirm the arrangements when you book.
Live online and in-person training runs over four days, with 24 hours of instruction in total. Each day has six hours of teaching within a seven-and-a-half-hour schedule that includes lunch and breaks. The online on-demand course covers the same material and takes roughly 40 hours at your own pace.
Prerequisites
- Active PQCS – Post-Quantum Certified Specialist certification
What Comes Next
After completing this course, you are eligible to sit for the PQCV certification exam. Earn PQCM + PQCA and PQCV, and you are automatically awarded PQCX – Post-Quantum Certified Expert.
Pricing
| Option | Price |
|---|---|
| Online (self-paced) | US$2,499 |
| Live online (instructor-led) | US$2,999 |
| In-person (instructor-led) | US$3,499 |
| On-demand training + PQCV exam bundle | US$2,999 |
| Live online training + PQCV exam bundle | US$3,499 |
| In-person training + PQCV exam bundle | US$3,999 |
All prices are in US dollars.
Who this course is for
Security testers, penetration testers, QA engineers, compliance auditors, security consultants, and technical assessors who will be responsible for verifying PQC implementations. This course is also appropriate for security architects and engineers who need to define validation criteria and acceptance tests for PQC migration programs.
What you’ll be able to do afterward
- Design test strategies for PQC implementations covering functional correctness, security properties, performance, and interoperability
- Test hybrid key exchange and hybrid signature implementations for correct behavior under normal and adversarial conditions
- Conduct downgrade attack testing to verify that fallback to classical-only algorithms is prevented where policy requires it
- Validate PQC certificate chains across multiple client implementations and platforms
- Perform interoperability testing between PQC implementations from different vendors and libraries
- Benchmark PQC implementation performance against defined thresholds and service-level requirements
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
An active PQCS certification is required before this training. We recommend taking Post-Quantum Foundation first, then PQCS, then this course. PQC Vendor Governance applies validation to your suppliers. PQC for GRC covers the assurance and audit side.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISA and CISM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
