In government and defense, the authorities that define the cryptographic standards also mandate a post-quantum cryptography (PQC) migration, with dated milestones. Your task is to turn that policy into a funded, staffed program with realistic timelines. Different mandates and accreditation authorities apply to different systems, and allied governments set requirements and guidance of their own. In this workshop, you plan that program, starting from which mandate applies to each system.
For US national security systems, CNSSP 15 requires new acquisitions to be CNSA 2.0 compliant from January 1, 2027. Equipment and services that cannot support CNSA 2.0 must be phased out by December 31, 2030, and CNSA 2.0 algorithms are mandated for use by December 31, 2031. Each date applies unless the applicable profile notes otherwise. Executive Order 14412 applies to federal civilian high value assets and high-impact systems instead, with PQC key establishment by December 31, 2030 and PQC signatures by December 31, 2031. What Actually Binds You in the US Post-Quantum Rulebook sets out the CNSSP 15 dates, and Which US Federal Post-Quantum Deadline Binds You sets out the civilian dates.
We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own system records, acquisitions, and contracts, or from a sample agency or defense supplier we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.
Who this intensive is for
Program managers, PMO and PQC migration leads, and the CIO or CISO who will act as executive sponsor. Security architects, system owners, and accreditation staff belong in the room too, with defense industrial base security leads, contracting officers, and compliance staff. We recommend sending a mixed group from one organization, ideally the people who would be members of its quantum readiness steering committee. Acquisition, accreditation, and the classified and unclassified estates are usually run by different offices.
Bring at least one person from contracting or acquisition. Many of the sequencing decisions in this workshop are acquisition decisions, and much of what you produce is procurement language.
The intensive is for civilian agencies, defense organizations, and their suppliers, in the United States and allied countries. Suppliers work from the contractor side, starting from the requirements their customers flow down. Participants outside the United States use the same templates with their own national requirements and dates. Cloud providers that sell to government can take the Quantum-Safe Cloud Service Providers Intensive instead. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.
What you’ll be able to do afterward
- Explain which mandates apply to each part of your estate, and why the program is planned system by system
- Draft the charter and business case, and define the program office and steering committee
- Plan a cryptographic inventory across classified and unclassified environments, starting from registers you already maintain
- Score and tier your systems, recording unknowns instead of guessing them
- Classify vendors and contractors, grade every date they give you, and draft PQC requirements for acquisitions and flow-down
- Map the dates that certifiers, accreditation authorities, and allies set, and plan what to do while you wait
- Structure the program into workstreams and a year-one plan aligned to the binding milestones, with KPIs your leadership can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map of your domains, the mandates that apply to each, and who controls each change
- A program charter that sets out the program office and steering committee structure
- An inventory plan, with its tracks, starting registers, and order
- An initial priority list, with evidence gaps recorded
- A vendor and contractor register that separates evidenced dates from assumptions, with draft acquisition and flow-down language
- An external dependency map for certifiers, accreditation authorities, and allies
- A workstream structure with role, resource, and accreditation assumptions
- A year-one plan by quarter, with leadership KPIs and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization, or with a sample agency or defense supplier we provide. If you bring approximate figures from your own estate, you apply each module directly to your systems, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample organization’s illustrative figures. You then apply the same templates to your own estate when you return to work.
Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:
- Your system counts by classification level and authorization boundary
- Authorization dates and the accreditation authority for your main systems
- Your active and planned acquisitions, with solicitation and award dates
- Your contract register, marking contracts that involve classified information or Controlled Unclassified Information (CUI)
- Your certificate authorities and credential card counts, such as PIV, CAC, or national equivalents
You decide what you share with the room. If you cannot take a record out of its system, bring an approximate count or use the sample organization.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its Government & Defense Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate or to the sample organization.
In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:
Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.
Module 1 The shape of the program
The instructor walks through the US mandates for national security, civilian, and defense systems, and what allied governments require or recommend. You then map your estate by domain, from classified networks and cross-domain solutions to weapons and space platforms in service for decades. For each domain, you mark whether your teams, a vendor, a program office, an approving authority, or an ally controls the change.
Module 2 Mandate, governance, and the business case
You draft a charter that commits to two outcomes, meeting the mandate that applies to each part of your estate and being able to change cryptography again. You record which mandate and authority apply to each system, because classification alone does not decide whether it is a national security system. You define a program office with authority across classified and unclassified domains, with acquisition, accreditation, and operational commands represented. You build the business case on the long-term exposure of classified data, accreditation capacity, and existing modernization and sustainment budgets.
Module 3 Inventory planning across classification levels
The instructor walks through a federal audit of agency inventories, reported in US Agencies Had Until May 2023 to Inventory Quantum-Vulnerable Cryptography. Auditors Found One of 24 Inventories Complete. You then plan six inventory tracks: classified systems, unclassified and CUI systems, cross-domain solutions, weapons platforms, PKI and identity, and contractors. You count each track’s systems from an existing register before discovery starts, and grade the evidence for every finding. You also plan with your security officer how the assembled inventory is classified and who may see it.
Module 4 Risk scoring and priorities
You score each system on future decryption, signature forgery, migration feasibility, and compliance pressure, with classification level and accreditation complexity as added factors. You record unknowns instead of guessing them, and tier each fully scored entry without lowering the tier of a device that depends on a certified PQC release. You give every blocked high-priority entry an owner and an interim treatment, such as an outer PQC layer or a recorded risk acceptance.
Module 5 Vendors, acquisition, and flow-down
You classify suppliers as mission-critical cryptographic vendors, infrastructure providers, or defense contractors. You open every conversation with the two crypto-agility questions. You grade every date they give you as committed, forecast, announced, or unknown. You draft PQC requirements for RFPs, statements of work, evaluation criteria, and contract modifications. You also draft flow-down clauses for contracts that involve classified information or CUI, ahead of the contractor rule directed by Executive Order 14412.
Module 6 Certifiers, accreditation authorities, and allies
You list the dates your program does not set, from NSA device certifications and module certificates to allies’ milestones. You treat a certification date as forecast until the certificate is issued, and plan early talks with your accreditation authority on pre-approved algorithm changes. For coalition links, you plan dual-stack periods, because NATO’s public roadmap contains no date for its own migration. You record which national regime applies to each system, because of the differences set out in The Four Axes Where National PQC Requirements Diverge.
Module 7 Roadmap, waves, and staffing
You organize the work into workstreams, set the staffing, and model each system’s authorization path and the time it takes. For national security systems, you plan to the CNSSP 15 dates and record the CNSA 2.0 advisory’s 2030 and 2033 category dates as guidance. You sequence pilots from unclassified TLS and VPNs to a classified test segment, with an algorithm-change rehearsal and accreditation evidence from every wave. You also agree what the steering committee does when a vendor, a certifier, or an ally misses a committed date.
Module 8 Year-one plan, KPIs, and the asks
You assemble the day’s work into a year-one plan by quarter, with leadership KPIs for milestone compliance, the accreditation queue, contractor readiness, and coalition testing. You list the decisions you need from executives, accreditation authorities, contracting officers, vendors, and allies, and the instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own systems and contracts, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from registers you already maintain. Agencies that already have the inventory NSM-10 and OMB M-23-02 required, or a cryptographic bill of materials (CBOM), use what they have in Module 4.
Can one person attend alone?
Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one organization can answer more of those questions in the room.
Is the intensive vendor-neutral?
Yes. We favor no cryptographic device maker or cloud provider, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Government and Defense as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management. Whoever manages suppliers and flow-down can take PQC Vendor Governance and Supply Chain. Teams that will run the inventory the mandates require can take Cryptographic Discovery, Inventory, and CBOM.
Why we teach this
This intensive is built on the Government & Defense Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has advised governments on the quantum threat since the early 2000s. The instructors run migration programs in this sector and teach the constraints they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and PMP holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
