Implementing and Maintaining Post-Quantum Cryptography in an Organization

Previously published as Implementing and Maintaining Post-Quantum Cryptography in an Organization by Arthur Steel.

SECOND EDITION — UPDATED THROUGH OCTOBER 2026

Post-quantum cryptography is no longer just a standards problem. It is an enterprise migration problem.

Organizations must identify where vulnerable cryptography exists, determine what needs to move first, modernize protocols and trust systems, coordinate vendors, test interoperability, manage exceptions, and prove that the transition is actually reducing risk.

Implementing and Maintaining Post-Quantum Cryptography in an Organization is a practical, enterprise-focused playbook for turning PQC from an emerging security concern into a governed, testable, and operational program.

This substantially revised Second Edition incorporates major developments through October 2026, including:

• FIPS 203 — ML-KEM
• FIPS 204 — ML-DSA
• FIPS 205 — SLH-DSA
• NIST SP 800-227 guidance for Key-Encapsulation Mechanisms
• Updated NIST crypto-agility guidance
• Executive Order 14412 and OMB M-26-15
• October 2026 NSA, CNSS, and CNSA 2.0 developments for National Security Systems
• RFC 10024 for post-quantum/traditional hybrid TLS 1.3 key agreement
• RFC 10042 for hybrid SSH key exchange
• Updated treatment of HQC and emerging PQC standards
• Expanded coverage of both harvest-now-decrypt-later and long-lived trust and signature risk

Inside, you’ll learn how to:

• Discover and maintain an inventory of cryptographic dependencies
• Build CBOM-style visibility across applications, infrastructure, certificates, keys, and vendors
• Prioritize migration using data lifetime, exposure, complexity, and business impact
• Define approved cryptographic standards, profiles, and crypto-agility requirements
• Plan hybrid and PQC migrations without creating permanent legacy paths
• Modernize TLS, mTLS, PKI, HSM/KMS, SSH, signing, cloud, SaaS, endpoints, IoT, and OT environments
• Design pilots, interoperability tests, downgrade-resistance tests, monitoring, and rollback controls
• Manage third-party roadmaps, contracts, cryptographic dependencies, and vendor blockers
• Build audit-ready evidence, metrics, exception governance, and migration-wave reporting
• Correctly distinguish commercial, civilian Federal, and National Security System requirements

Built for practitioners

This book is written for security leaders, cybersecurity architects, security engineers, PKI and identity teams, platform and SRE teams, cloud engineers, DevSecOps, IT operations, risk and compliance professionals, and vendor-management teams.

If you need more than an explanation of why quantum computing threatens RSA and ECC—and need a practical framework for discovering, prioritizing, designing, testing, migrating, operating, and governing post-quantum cryptography—this book is designed for you.