Utilities schedule control-system changes in a post-quantum cryptography (PQC) migration around planned outages and maintenance windows, which can be 12 to 18 months apart. The relays, remote terminal units, and meters you buy this year may still be in service after 2035. Vendors built much of the cryptography in that equipment, and often only the vendor or an integrator can change it. In this workshop, you build a migration program around your outage calendar, your installed base, and your next purchases.
In a utility, corporate IT is the easier part of the inventory, as Quantum Computing in Energy and Utilities: A Field Guide for Executives explains. Substation automation, SCADA, distribution management systems, metering head-ends, and other vendor-supplied equipment are harder to inventory. A worked example in When a Full Cryptographic Inventory Isn’t Possible has a regional electricity distributor migrate its certificate authority first, then its internet-facing services. Its substations get compensating controls now, and a cryptographic requirement in the next procurement cycle.
We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own asset register, outage calendar, and vendor contracts, or from a sample utility we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap mapped to your maintenance windows, with the assumptions you still need to check written down.
Who this intensive is for
The intensive is for program managers and PMO leads, and for the CISO and chief engineer who will sponsor the program. It is also for utility security architects and OT and control systems engineering leads. Protection engineers, smart grid and AMI owners, procurement, process safety, and NERC CIP compliance staff belong in the room too. We recommend sending a mixed group from one utility, ideally the people who would be members of its quantum readiness steering committee. Control engineers and security staff rarely share a team, and the inventory needs both.
Bring at least one person from the team that owns the outage calendar. Many of the sequencing decisions in this workshop are outage planning decisions.
Electric, gas, and water utilities can attend together, even where their regulators differ. If you run industrial systems outside regulated utilities, in manufacturing, process industries, or transport, take the Quantum-Safe OT and Critical Infrastructure Intensive instead. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.
What you’ll be able to do afterward
- Make the case for a multi-year utility PQC program, and show who can change each part of your estate
- Draft a charter and business case, and define a steering committee that gives engineering and safety equal standing with IT security
- Plan a cryptographic inventory from records you already hold, and give every embedded credential a named owner
- Score and tier your estate without guessing at unknowns, and choose a treatment for equipment that cannot change in time
- Classify vendors by their effect on your timeline, grade every date they give you, and write agility requirements into your next tender
- Map what regulators, standards bodies, and interconnected operators require of you, and plan what to do while you wait
- Structure the program into waves around your maintenance windows, with a year-one plan and KPIs your board can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map from corporate IT to the meter, showing who can change each part
- A program charter and steering committee structure
- An inventory plan and a cryptographic ownership register
- An initial priority list and asset triage, with evidence gaps recorded
- A vendor dependency register that separates evidenced dates from assumptions, and draft tender requirements
- An external dependency map for regulators, standards bodies, and interconnected operators
- A workstream and wave structure mapped to your outage calendar, with role and resource assumptions
- A year-one plan by quarter, with board KPIs and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization or with a sample utility we provide. If you bring approximate figures from your own estate, you apply each module directly to your utility, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample utility’s illustrative figures. You then apply the same templates to your own estate when you return to work.
Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:
- Your main asset classes, from corporate IT to the meter, and the vendors in each
- Contract renewal and planned replacement dates for that equipment
- The records an inventory would start from, such as the asset register, SCADA project files, and management of change records
- Smart meter and field device counts by type, from procurement or fleet records
- Your planned outages and maintenance windows for the next 24 months
You decide what you share with the room. If your handling rules for critical infrastructure information do not allow asset lists or network diagrams off site, bring a simplified version.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its OT & Critical Infrastructure Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate or to the sample utility.
In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:
Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.
Module 1 From corporate IT to the meter
The instructor walks through the distributor’s worked example to show which parts of a utility migration take longest. You then map your own estate by domain and mark whether your IT team, your engineers, a vendor, or an integrator can change each part.
Module 2 Mandate, governance, and the business case
You draft a charter that commits to two outcomes: meeting your dated obligations, and being able to change cryptography on the layers you control, on a planned date. You define a steering committee in which OT engineering and process safety have equal standing with IT security. You base the business case on safety consequence, regulation, and insurers’ questions, with planned refresh shown separately from new money.
Module 3 Inventory planning and ownership
You open a cryptographic ownership register first, so that every embedded credential and certificate store gets a named owner. You then plan the inventory across the extension’s six tracks, from control systems and protection relays to vendor firmware and certificates, tagging each entry by Purdue level. As Building a Crypto Inventory That Covers the Whole Estate describes, you count meters and remote sites from procurement and fleet records.
Module 4 Risk scoring and asset triage
You score the estate with factors for physical consequence and for whether each device’s signature check can be updated in the field. Post-Quantum Cryptography in OT: Sort the Fleet Before You Plan the Migration explains why that second factor decides each device’s treatment. You record unknowns instead of guessing them, and tier each fully scored entry. For equipment that cannot change in time, you keep its tier and choose enclosure behind a gateway, isolation, or a dated replacement.
Module 5 Vendor management and the tender template
You classify suppliers by how much of your timeline they control. Your relay, RTU, and control-system vendors count as timeline-blocking. You open every vendor conversation with the two agility questions, including whether deployed devices accept new trust anchors in the field. You grade every date a vendor gives you as committed, forecast, announced, or unknown, and draft agility-first tender requirements.
Module 6 Regulators, standards bodies, and interconnected operators
You tag each regime that applies to you with its enforcement tier. NERC CIP sets no post-quantum requirement yet, while the EU’s coordinated roadmap sets the end of 2030 for high-risk and critical use cases. You record the unpublished post-quantum revision of the IEC 62351 profiles as a substation dependency. For grid interties and shared pipelines, you plan dual-stack windows and a deprecation schedule with operators you cannot compel.
Module 7 Outages, waves, and staffing
You map your planned outages and maintenance windows for the next 24 months. You then assign each change to the outage or maintenance window in which you will make it. You set the workstreams and staffing, and break the work into repeatable packages, such as one approved pattern applied to one zone. You define the evidence each wave needs, such as a safety-impact assessment and a tested rollback. You also agree what the steering committee does when a vendor misses a committed date or you lose an outage to an operational event.
Module 8 Year-one plan, KPIs, and the asks
You assemble the day’s work into a year-one plan by quarter, from joint sponsorship and a first pilot at the IT/OT boundary to the first board report. You choose board KPIs from the extension’s set, such as boundary protection coverage, vendor readiness, and the share of non-migratable devices enclosed. You list the decisions you need from executives, regulators, and vendors, and the instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own estate, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.
Can one person attend alone?
Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one utility can answer more of those questions in the room.
Is the intensive vendor-neutral?
Yes. We favor no control-system, protection relay, metering, or security vendor, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Energy and Utilities as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads vendor conversations and tenders can take PQC Vendor Governance and Supply Chain. Teams about to find the cryptography in their control systems can take Cryptographic Discovery, Inventory, and CBOM.
Why we teach this
This intensive is built on the OT & Critical Infrastructure Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has led quantum readiness programs for critical infrastructure operators. The instructors run migration programs in this sector and teach the constraints they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and GARP ERP holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
