A vehicle built this year will still be accepting over-the-air (OTA) software updates well over a decade from now. The public keys that verify those updates are stored in hardware that nobody intends to replace, and tier-1 and tier-2 suppliers provide most of a vehicle’s cryptography. A post-quantum cryptography (PQC) migration in automotive therefore needs three plans: for the fleet on the road, the platform in development, and the suppliers who build both. In this workshop, you build a migration program that covers all three.
Quantum Computing in Aerospace and Automotive: What Executives Are Actually Deciding describes the migration at a large manufacturer as the work of several departments. Security architects redesign key hierarchies, and embedded engineers fit larger signatures into existing control units. Procurement writes cryptographic requirements into supplier contracts and assesses the answers. Program managers sequence the work against model-year gates.
We teach this intensive only as private team training, for one organization at a time, online or at your location. It is an eight-hour planning workshop. You work from your own platform architecture, supplier map, and fleet records, or from a sample vehicle manufacturer we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap for the fleet, the platform, and the suppliers, with the assumptions still to check written down.
Who this intensive is for
The intensive is for program managers, PMO leads, and the executive who will sponsor the migration. It is also for vehicle security architects, OTA and backend platform leads, vehicle-to-everything (V2X) and connectivity engineers, and product cybersecurity staff who own ISO/SAE 21434 work. Supplier quality, procurement, and compliance staff belong in the room too. We recommend sending a mixed group from one organization, ideally the people who would be members of its quantum readiness steering committee. The OTA platform, the ISO/SAE 21434 work, and the supplier requirements often have different owners.
Bring at least one person from procurement. Many of the sequencing decisions in this workshop concern supplier requirements.
It is for both vehicle manufacturers and tier-1 suppliers. Tier-1 teams apply the same templates to the components they supply and to their own suppliers. If your focus is the manufacturing plant rather than the vehicle, take the Quantum-Safe OT and Critical Infrastructure Intensive instead.
What you’ll be able to do afterward
- Explain why OTA signing needs an early start, and why you plan the fleet, the platform, and the suppliers separately
- Draft a program charter and business case, and define the steering committee that will govern the program
- Plan a cryptographic inventory from records you already keep, starting with the software update chain
- Score and tier your estate, and separate the fleet that can receive a cryptographic update from the fleet that cannot
- Question suppliers in the right order, grade every date they give you, and write requirements into the next platform’s component specifications
- Map the V2X participants, standards bodies, and other organizations whose dates you cannot set
- Structure the program into workstreams and a year-one plan, with KPIs your board can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map by domain, marked by who controls each part and sorted into the three plans
- A program charter and steering committee structure
- An inventory plan that starts with the software update chain
- An initial priority list, with evidence gaps recorded and the fleet separated by update capability
- A supplier dependency register that separates evidenced dates from assumptions, with draft requirements for the next platform
- An external dependency map for V2X participants, standards bodies, and API partners
- A workstream structure with the evidence each OTA wave needs, and role and resource assumptions
- A year-one plan by quarter, with board KPIs and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization or with a sample vehicle manufacturer we provide. If you bring approximate figures from your own fleet, you apply each module directly to your organization, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample manufacturer’s illustrative figures. You then apply the same templates to your own organization when you return to work.
Before the day, we send a list of what to gather if you want to use your own data. Approximate figures are enough:
- Your vehicle platforms in service and in development, with fleet counts by model year
- Which vehicles and control units can receive OTA updates, and which cannot
- Your supplier map for control units, telematics modules, and backend services
- The signing keys for your OTA updates and secure boot, and who controls each one
- The schedule for your next platform’s component specifications, and any deadlines your organization already tracks
If you cannot copy architecture documents out of your engineering systems, bring a simplified version.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework. The instructor starts each module with a short briefing. You then apply the module’s template to your own fleet, platforms, and suppliers, or to the sample vehicle manufacturer.
At your location, we teach the intensive in one day, with lunch and two breaks. We agree the timetable with you, and a day from 09:00 to 17:00 looks like this:
Online, we agree with you how to divide the eight modules into sessions.
Module 1 OTA signing and the three plans
The instructor walks through the software update chain of a sample vehicle to show why OTA signing needs an early start. Signature verification in the field is the hardest thing to change later. You then map your estate by domain, mark whether your teams, a supplier, or another party controls each part, and sort the work into the three plans.
Module 2 Mandate, governance, and the business case
You draft a charter that commits to two outcomes, meeting your dated obligations and being able to change cryptography on the systems you control. You define the steering committee, with product cybersecurity, vehicle engineering, the OTA and backend teams, procurement, and compliance as members. You build the business case with spending already planned for the next platform shown separately from new money.
Module 3 Inventory planning
You start with the software update chain: its control units and which of them can be updated in the field, and the algorithms and keys it uses. You then add in-vehicle networks, telematics, the backend, and V2X, starting each from a record you already keep, such as the supplier map. As Why Signature Migration Needs the Longer Runway notes, network scanning does not find signing keys that suppliers control, so you plan to ask them about those keys. You tag every entry by who controls its change.
Module 4 Risk scoring and priorities
You score the estate on the framework’s four dimensions, recording for each signing key how long its verifiers stay in service and whether they can be updated. Trust Now, Forge Later: The Signature Half of the Migration shows that those two facts set a signing key’s exposure window. You record unknowns instead of guessing them and tier each fully scored entry. You give every blocked high-priority entry an owner and an interim treatment. You then separate the fleet that can receive a cryptographic update from the fleet that cannot.
Module 5 Supplier requirements and contracts
You classify suppliers by how much of your timeline they control. You open every supplier conversation with the framework’s two agility questions. In the second, you ask whether a component’s verifiers can be updated in the field, and by what mechanism. You grade every date a supplier gives you as committed, forecast, announced, or unknown. You then draft requirements for the next platform’s component specifications, and contract clauses from the five minimum provisions in Third-Party Cryptographic Risk at Enterprise Scale.
Module 6 V2X and other external parties
You map the parties you cannot bind by contract, such as other V2X participants, V2X standards bodies, and the partners who use your connected-service APIs. For each V2X change, you record whether participants can accept old and new cryptography for a transition period, or must switch together. You treat each external date as unknown until the party responsible puts it in writing.
Module 7 Program structure and staffing
You organize the work into workstreams, such as OTA signing, the next platform, and supplier requirements, and break each into repeatable work packages. You set the gates against your model-year schedule, plan the staffing, and define the evidence you need before closing each OTA wave. That evidence includes vehicles accepting the post-quantum-signed update and a sampled vehicle rejecting a classical-only one, plus a count of vehicles still accepting classical signatures. You also agree what the steering committee does when a supplier misses a committed date.
Module 8 Year-one plan, KPIs, and the asks
You assemble the day’s work into a year-one plan by quarter. You set board KPIs for inventory, signing keys, and supplier commitments, including the framework’s first-year trust target: every root and signing anchor inventoried, with its verifier updatability recorded. You list the decisions you need from executives, platform programs, and suppliers, and note what to record in your ISO/SAE 21434 documentation. The instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own vehicles, platforms, and suppliers, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records you already keep. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.
How is a private intensive arranged?
Write to training@quantumacademy.com. We agree the dates, whether we teach online or at your location, and a quote for your organization. Only your own colleagues attend.
Is the intensive vendor-neutral?
Yes. We favor no tier-1 supplier, hardware security module vendor, or cloud provider, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Automotive as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever leads supplier programs can take PQC Vendor Governance and Supply Chain, and the architects designing the next platform can take Cryptographic Agility: Design and Implementation. Whoever will run the program can take PQC Migration Project Management.
Why we teach this
This intensive is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. No sector extension of the framework covers the automotive industry yet. The course author wrote the framework. The instructors run migration programs in this industry and teach the sector material from that field work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and PMP holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.