In an operational technology (OT) estate, much of the cryptography is built into equipment that engineering bought, an integrator commissioned, and a vendor maintains. No team at the operator chose that cryptography, and the vendor or the integrator often controls how it can change. On safety-critical devices, each cryptographic change also requires a safety-impact assessment and, for most of those devices, a planned maintenance window. In this workshop, you plan a post-quantum cryptography (PQC) migration program around who owns that cryptography and when it can change.

A single plant may have equipment from 10 to 20 vendors, and maintenance windows may be 12 to 18 months apart. Many OT devices cannot handle post-quantum key and signature sizes, so you protect them with gateways, segmentation, or isolation, or plan their replacement. Post-Quantum Cryptography in OT: Sort the Fleet Before You Plan the Migration explains why you first ask whether each device’s signature check can ever be changed.

We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own asset records, vendor contracts, and maintenance calendar, or from a sample industrial operator we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.

Who this intensive is for

Program managers and PMO leads, OT security architects, control systems and automation leads, safety engineering, and plant and site operations. Procurement, vendor management, regulatory compliance, and the CISO and chief engineer who will jointly sponsor the program belong in the room too. We recommend sending a mixed group from one operator, ideally the people who would be members of its quantum readiness steering committee. Buying control equipment, running the IT/OT boundary, and assessing changes to safety systems are usually three different jobs.

Bring at least one person from safety engineering. Many of the sequencing decisions in this workshop are safety decisions.

The intensive is for manufacturers, process plants, pipeline and transport operators, and anyone else running industrial control systems. It also suits enterprises with no plant, for the OT in their own buildings. Regulated electric, gas, and water utilities can take the Quantum-Safe Energy and Utilities Intensive instead, and pharmaceutical manufacturers the Quantum-Safe Pharma Intensive. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.

What you’ll be able to do afterward

• Map your OT estate by Purdue level and by who can change each part
• Draft a program charter and business case, and define a steering committee with OT engineering, process safety, and IT security as equal partners
• Plan a cryptographic inventory across the OT tracks and your facilities estate, with an owner for every finding
• Score and tier your estate, then make a defensible decision to migrate, encapsulate, isolate, or retire each entry
• Classify OT vendors by their effect on your timeline, question them in the right order, and add tender requirements to every purchase and renewal
• Map the dates that regulators, standards bodies, and interconnected operators set, and plan what to do while you wait
• Align the program with safety approvals and maintenance windows, and build a year-one plan with KPIs your board can read

What you leave with

Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:

• An estate map by Purdue level, showing who can change each part
• A program charter and steering committee structure
• An inventory plan with its tracks and starting records, and a cryptographic ownership register
• An initial priority list and triage, with a rationale for each decision
• A vendor dependency register that separates evidenced dates from assumptions, and draft tender requirements
• An external dependency map for regulators, standards bodies, and interconnected operators
• A workstream structure mapped to your maintenance windows and safety approvals
• A year-one plan by quarter, with board KPIs and the decisions you need from others

The working documents are editable and yours to keep.

Preparing for the day

You can work through the day with data from your own organization or with a sample industrial operator we provide. If you bring approximate figures from your own estate, you apply each module directly to your sites, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample operator’s illustrative figures. You then apply the same templates to your own sites when you return to work.

Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:

• Your sites and zones, and the main control-system vendors at each
• Your asset register and the device lists in your SCADA and building management systems
• End-of-support and contract renewal dates for your main OT vendors
• Your planned maintenance windows and turnarounds for the next 24 months
• Any regulatory, insurance, or customer deadlines your organization already tracks

You decide what you share with the room. If you cannot take asset lists or network drawings off site, bring counts by device family and Purdue level instead.

The day

The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its OT & Critical Infrastructure Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate or to the sample operator.

In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:

• 09:00–09:50 · Module 1. The OT estate and who can change it
• 09:50–10:40 · Module 2. Mandate, governance, and the business case
• 10:40–11:00 · Break
• 11:00–11:45 · Module 3. Inventory planning and ownership
• 11:45–12:30 · Module 4. Risk scoring and triage
• 12:30–13:30 · Lunch
• 13:30–14:20 · Module 5. Vendor management and the tender template
• 14:20–15:10 · Module 6. Regulators, standards bodies, and interconnected operators
• 15:10–15:30 · Break
• 15:30–16:15 · Module 7. Safety cases, maintenance windows, and program structure
• 16:15–17:00 · Module 8. Year-one plan, KPIs, and the asks

Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.

Module 1. The OT estate and who can change it

The instructor walks through what an OT migration covers, from remote access at the IT/OT boundary to safety systems, historians, and building systems. You then map your own estate by Purdue level and mark who can change each part: your engineers, IT, a vendor, an integrator, or facilities management.

Module 2. Mandate, governance, and the business case

You draft a charter that commits to two outcomes: meeting your dated obligations, and being able to change cryptography on the layers you control, on a planned date. You define the steering committee, with OT engineering, process safety, and IT security as equal partners. You build the business case around the integrity of firmware and control commands, the risk described in Trust Now, Forge Later: The Signature Half of the Migration.

Module 3. Inventory planning and ownership

You plan the inventory across the extension’s six OT tracks and the facilities estate, starting from records you already hold. You open a cryptographic ownership register that names who can change each embedded credential, key, and signing dependency, and who approves. Finding the Assets Before You Find the Cryptography sets out a discovery sequence for sites where unrestricted scanning is forbidden.

Module 4. Risk scoring and triage

You score the estate on the framework’s four dimensions, with factors for physical consequence, verifier updatability, and change path, and record unknowns instead of guessing them. You tier each fully scored entry, then decide whether to migrate, encapsulate, isolate, or retire it, with a rationale you can defend to an auditor or a regulator. You record each encapsulation as permanent or as an interim bridge to a dated vendor release or refresh.

Module 5. Vendor management and the tender template

You classify OT vendors by their effect on your timeline, from the control-system and safety-system vendors that can block it to the boundary equipment you manage. You open every questionnaire with the two agility questions, including whether deployed devices accept new trust anchors in the field. You grade every vendor date as committed, forecast, announced, or unknown. You adapt the extension’s OT tender template, for use in every RFI, RFP, and contract renewal from the day the program is chartered.

Module 6. Regulators, standards bodies, and interconnected operators

You tag each instrument that applies to your sites with its enforcement tier. At EU sites, you plan the migration of high-risk and critical use cases by the end of 2030, the date in the EU coordinated roadmap. You record unpublished standards work as a dependency, such as the DNP3 Security Layer and the post-quantum revision of the IEC 62351 profiles. For grid interties, rail interchanges, and shared pipelines, you plan dual-stack windows and a deprecation schedule with operators you cannot compel.

Module 7. Safety cases, maintenance windows, and program structure

You map each planned change to a maintenance window. With your safety authority, you decide for each change whether to reopen the safety case. You organize the work into workstreams and waves, set the staffing, and plan the first pilots on non-safety systems and on gateways in front of safety systems. You also define the evidence each wave needs, and what the steering committee does when a vendor misses a committed release or a maintenance window is lost.

Module 8. Year-one plan, KPIs, and the asks

You assemble the day’s work into a year-one plan by quarter, from opening the ownership register to a first board report. You choose board KPIs from the extension’s supplement, such as boundary protection coverage, safety systems with quantum-vulnerable firmware signing, vendor readiness, and encapsulation coverage. You list the decisions you need from executives, your safety authority, regulators, and vendors, and the instructor reviews each plan before the session ends.

Common questions

How technical is the day?

The day is about planning and program management. You need a working knowledge of your own sites and control systems, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.

Do we need a cryptographic inventory before the day?

No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) use it in Module 4.

Can one person attend alone?

Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one operator can answer more of those questions in the room.

Is the intensive vendor-neutral?

Yes. We favor no control-system or gateway vendor, and we judge algorithms and products against published standards and public evidence.

Where this course fits

We recommend Quantum-Safe OT and Critical Infrastructure as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads supplier and integrator conversations can take PQC Vendor Governance and Supply Chain. Engineers planning discovery across plants and building systems can take Cryptographic Discovery, Inventory, and CBOM.

Why we teach this

This intensive is built on the OT & Critical Infrastructure Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has led quantum readiness programs for critical infrastructure operators. The instructors run migration programs in this sector and teach the constraints they meet in that work.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.