Cloud and SaaS providers run two post-quantum cryptography (PQC) migrations at once. You migrate your own platform, and you add the PQC support your customers need in the services they use. Customer questionnaires already ask whether your services support the NIST-standardized algorithms and whether you have a migration plan. In this workshop, you plan both programs, and the per-service disclosure that tells customers what each service negotiates today and its target dates for those algorithms.
Google Cloud published a PQC roadmap in August 2026 that sets target dates for named services and marks the milestones Google considers complete. The targets are the end of 2027 for confidentiality, and the end of 2028 for integrity and for key management. Google describes them as projections. The roadmap also assigns client software updates, asymmetric key lifecycle management, and quantum-safe service configuration to the customer. PostQuantum.com compares it with other providers’ disclosures in Google Cloud Put Dates on Its PQC Migration. Signatures Trail Confidentiality by a Year.
We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own services, supplier contracts, and customer commitments, or from a sample cloud provider we provide. No cryptography background is needed. You leave with a draft plan for both programs and a year-one roadmap, with the assumptions you still need to check written down.
Who this intensive is for
Program managers and PMO leads, platform security architects, KMS and cryptography service owners, TLS and edge infrastructure leads, and compliance staff who own FedRAMP or equivalent obligations. Procurement, vendor management, and the CISO or CTO who will sponsor the program belong in the room too. We recommend sending a mixed group from one provider, ideally the people who would be members of its quantum readiness steering committee. Running the key management service, operating the edge, and answering customer questionnaires are usually three different jobs.
Bring at least one person from product management. Many of the sequencing decisions in this workshop are product decisions.
The intensive is for providers of cloud platforms, SaaS applications, and managed services. Cloud customers should take their sector’s intensive, such as the Quantum-Safe Financial Services Intensive or the Quantum-Safe Government and Defense Intensive. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.
What you’ll be able to do afterward
- Explain the two PQC programs a provider runs, and draw the line between your work and your customers’ work
- Draft a program charter and business case, and define a steering committee with product management on it
- Plan a cryptographic inventory across your service domains, starting from records you already hold
- Score and tier your services, recording unknowns instead of guessing them
- Classify your own suppliers by their effect on your timeline, and grade every date they give you
- Draft a per-service customer disclosure, and map what FedRAMP and comparable authorization programs require of you
- Structure the program into workstreams and a year-one plan, with board KPIs and the commitments you will put in writing
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- A service map by domain, with the responsibility line marked
- A program charter and steering committee structure
- An inventory plan, with its domains, starting records, and order
- An initial priority list, with evidence gaps recorded
- A supplier dependency register that separates evidenced dates from assumptions
- A draft per-service customer disclosure, with exclusions stated and every date graded
- A workstream structure with role and resource assumptions
- A year-one plan by quarter, with board KPIs, the decisions you need from others, and your written commitments
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization or with a sample cloud provider we provide. If you bring approximate figures from your own estate, you apply each module directly to your platform, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample provider’s illustrative figures. You then apply the same templates to your own platform when you return to work.
Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:
- Your service catalog by domain, with the regions and tiers each service runs in
- Your main suppliers, such as HSM and CDN suppliers, with their contract renewal dates
- The records an inventory would start from, such as infrastructure-as-code repositories, certificate inventories, and HSM fleet records
- Recent customer questionnaires that ask about post-quantum readiness
- Any authorization, regulatory, or customer deadlines your organization already tracks
You decide what you share with the room. If you cannot take architecture documents outside your systems, bring a simplified service map.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its cloud and SaaS guidance, read from the provider’s side. The instructor starts each module with a short briefing. You then apply the module’s template to your own platform or to the sample provider.
In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:
Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.
Module 1 The two programs and the responsibility boundary
The instructor walks through a published provider roadmap and the framework’s boundary between provider and customer. You migrate what you alone control, such as TLS termination on managed front ends. On cloud platforms, customers keep application-layer cryptography and customer-managed keys, and need options from you, such as selectable key types. You map your services by domain and mark whether your teams, a supplier, or the customer controls each part.
Module 2 Mandate, governance, and the business case
You draft a charter with two outcomes: meeting your dated obligations, and being able to change cryptography on a planned date. A provider that sells into regulated buyers inherits their deadlines, as The Deadlines That Already Bind Your Cryptography explains. You define the steering committee with product management on it. You build the business case on the quantum readiness criteria in customers’ procurement, with planned refresh shown separately from new money.
Module 3 Inventory planning
You plan the inventory across compute, storage, network, identity, and managed services, starting with internet-facing endpoints and key management. You start each area from a record you already hold, such as infrastructure-as-code repositories. You tag every entry by service, region, tier, and side of the responsibility boundary.
Module 4 Risk scoring and priorities
You score each entry on exposure, trust-infrastructure criticality, migration feasibility, and regulatory and contractual pressure, and record unknowns instead of guessing them. Public endpoints score Hard on interoperability because their clients are outside your control, so they are sequenced earlier within their tier. You then tier each fully scored entry and give every blocked high-priority entry an owner and an interim treatment.
Module 5 Your own suppliers
You classify your suppliers, from HSM vendors and CDNs to the open-source libraries you build on, by how much of your timeline they control. You open each supplier questionnaire with the same two questions about crypto-agility, grade every date as committed, forecast, announced, or unknown, and draft your renewal clauses. Getting Vendors to Answer the Right Questions sets out how to tell a measured answer from an asserted one.
Module 6 Customers and authorization programs
Customers who follow the framework’s cloud and SaaS guidance ask you for two things per service: what it negotiates today, and dated targets graded for firmness. You draft that disclosure for your questionnaire answers and state its exclusions, such as regions, service tiers, legacy endpoints, and customer-managed key options. You also plan for OMB M-26-15, which directs federal agencies to set out PQC responsibilities with their FedRAMP-authorized providers. Where contracts or policies require FIPS 140-3 validated modules, you plan production dates from each module’s certificate date.
Module 7 Program structure and staffing
You organize the work into workstreams and repeatable work packages, such as one pattern for one service in one region. You schedule shared infrastructure, such as HSMs and TLS termination, early and separately, as Sequencing the Waves in a Post-Quantum Migration recommends. For public endpoints, you plan a signed-off capacity model and a published period in which both classical and hybrid negotiation are accepted. You set the gates, staffing, and wave evidence, and agree what the steering committee does when a supplier misses a committed date.
Module 8 Year-one plan, KPIs, and commitments
You assemble the day’s work into a year-one plan by quarter, with board KPIs for coverage, trust anchors, inventory, supplier commitments, and agility. You list the decisions you need from executives, suppliers, and customers, and the dates you will commit to in writing. The instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own platform, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.
Can one person attend alone?
Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one provider can answer more of those questions in the room.
Is the intensive vendor-neutral?
Yes. We favor no cloud provider, HSM vendor, or CDN, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Cloud Service Providers as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever owns your supplier contracts can take PQC Vendor Governance and Supply Chain. Engineers planning the hybrid rollout at your edge can take Hybrid Cryptographic Implementations.
Why we teach this
This intensive is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. No sector extension has been published for cloud and SaaS providers yet. We teach the framework’s cloud and SaaS guidance from the provider’s side instead. The course author wrote the framework. The instructors run migration programs in this industry and teach the sector material from that field work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CCSP, CISM and PMP holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
