Telecom operators do not set every date in a post-quantum cryptography (PQC) migration. Some changes are yours to make now. Others depend on equipment vendors, 3GPP, roaming partners, or a regulator. In this workshop, you build a migration program around both.

An integrated program plan the course author built for a telecom operator ran to more than 120,000 tasks. In a published illustrative model of a program that size, about 30,000 tasks are changes to cryptography. The other 90,000 are the inventory, governance, vendor management, testing, and training around those changes. The breakdown is set out in The Real Size of a Post-Quantum Migration. The Cryptography Inside a 5G Roaming Call traces one call from the SIM to billing.

We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own network, vendor contracts, and refresh cycles. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.

Who this intensive is for

Program managers and PMO leads, network security architects, core and RAN engineering leads, and standards and regulatory affairs staff. Vendor management, procurement, and the CISO or CTO who will sponsor the program belong in the room too. We recommend sending a mixed group from one operator, ideally the people who would be members of its quantum readiness steering committee. Tracking 3GPP, running the SIM estate, and managing vendor contracts are usually three different jobs.

Bring at least one person from procurement. Many of the sequencing decisions in this workshop are contract decisions.

The intensive is for mobile, fixed-line, and converged operators. Fixed-line teams map access networks, customer equipment, and backbone transport with the same templates as mobile teams. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.

What you’ll be able to do afterward

• Make the case that a telecom PQC migration is a multi-year program, and explain what most of its work involves
• Draft a program charter and business case, and define the steering committee that will govern the program
• Plan a cryptographic inventory in risk order, starting from records you already hold
• Score and tier your estate, recording unknowns instead of guessing them
• Classify vendors by their effect on your timeline, question them in the right order, and grade every date they give you
• Map the dates that 3GPP, roaming partners, and regulators set, and plan what to do while you wait
• Structure the program into workstreams and a year-one plan, with KPIs your board can read

What you leave with

Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:

• An estate map of your own teams’ areas and your external dependencies
• A program charter and steering committee structure
• An inventory plan, with its tracks, starting records, and order
• An initial priority list, with evidence gaps recorded
• A vendor dependency register that separates evidenced dates from assumptions
• An external dependency map for standards bodies, roaming partners, and regulators
• A workstream structure with role and resource assumptions
• A year-one plan by quarter, with board KPIs and the decisions you need from others

The working documents are editable and yours to keep.

Preparing for the day

You can work through the day with data from your own organization or with a sample operator we provide. If you bring approximate figures from your own estate, you apply each module directly to your network, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample operator’s illustrative figures. You then apply the same templates to your own network when you return to work.

Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:

• Your network’s main domains and the equipment vendors in each
• Contract renewal and equipment refresh dates for those vendors
• The records an inventory would start from, such as the site database, the network function catalog, and the roaming agreement register
• Your SIM and eSIM counts by type
• Any regulatory or customer deadlines your organization already tracks

You decide what you share with the room. If you cannot take architecture documents off site, bring a simplified version.

The day

The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its Telecommunications Extension. The instructor starts each module with a short briefing. You then work on your own network with the module’s template.

In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:

• 09:00–09:50 · Module 1. The scale of the program
• 09:50–10:40 · Module 2. Mandate, governance, and the business case
• 10:40–11:00 · Break
• 11:00–11:45 · Module 3. Inventory planning
• 11:45–12:30 · Module 4. Risk scoring and priorities
• 12:30–13:30 · Lunch
• 13:30–14:20 · Module 5. Vendor management
• 14:20–15:10 · Module 6. Standards bodies, partners, and regulators
• 15:10–15:30 · Break
• 15:30–16:15 · Module 7. Program structure and staffing
• 16:15–17:00 · Module 8. Year-one plan, KPIs, and the asks

Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.

Module 1. The scale of the program

The instructor walks through one 5G voice call with roaming and the 120,000-task plan, to show what most of the work in a telecom migration involves. You then map your own network by domain and mark whether your teams, a vendor, a standards body, or a roaming partner controls each one.

Module 2. Mandate, governance, and the business case

You draft a charter that commits to two outcomes, meeting your dated obligations and being able to change cryptography on the layers you control. You define the steering committee, with network engineering and security as equal partners, and build the business case with planned refresh shown separately from new money.

Module 3. Inventory planning

You plan the inventory across six telecom tracks, covering the RAN, core, transport, interconnect, SIM and devices, and OSS/BSS, alongside the shared IT and PKI estate. You start each track from a record you already hold, put international interconnect first, and tag every entry by who controls its change.

Module 4. Risk scoring and priorities

You score the estate on exposure, trust-infrastructure criticality, migration feasibility, and regulatory pressure, and you record unknowns instead of guessing them. You then tier each fully scored entry and give every blocked high-priority entry an owner and an interim treatment.

Module 5. Vendor management

You classify suppliers by how much of your timeline they control, and open every vendor conversation with the same two questions about crypto-agility. You grade every date a vendor gives you as committed, forecast, announced, or unknown, and draft the clauses for your next RFP.

Module 6. Standards bodies, partners, and regulators

You separate a finished 3GPP study from the specifications, vendor releases, and interoperability testing that must follow it, and record each as its own dependency. You treat a roaming partner’s date as unknown until the partner puts it in writing, and plan an early briefing with your regulator on lawful interception.

Module 7. Program structure and staffing

You organize the work into workstreams and break each one into repeatable work packages, such as one approved migration pattern applied to one service tier in one region. You set the gates and the staffing, and define the evidence you need before you start each migration wave, such as interoperability testing, rollback plans, and an operational owner. You also agree what the steering committee does when a vendor misses a committed date.

Module 8. Year-one plan, KPIs, and the asks

You assemble the day’s work into a year-one plan by quarter, with board KPIs for exposure, coverage, and vendor readiness. You list the decisions you need from executives, regulators, vendors, and roaming partners, and the instructor reviews each plan before the session ends.

Common questions

How technical is the day?

The day is about planning and program management. You need a working knowledge of your own network, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.

Do we need a cryptographic inventory before the day?

No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.

Can one person attend alone?

Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one operator can answer more of those questions in the room.

Is the intensive vendor-neutral?

Yes. We favor no equipment vendor or cloud provider, and we judge algorithms and products against published standards and public evidence.

Where this course fits

We recommend Quantum-Safe Telecommunications as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads vendor conversations can take PQC Vendor Governance and Supply Chain. Teams about to find the cryptography in their estate can take Cryptographic Discovery, Inventory, and CBOM.

Why we teach this

This intensive is built on the Telecommunications Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has led quantum readiness programs for telecom operators. The instructors run migration programs in this sector and teach the constraints they meet in that work.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.