Implementing the PKI Consortium PQC Maturity Model at Siemens Trust Centre

As the transition to Post-Quantum Cryptography (PQC) accelerates, organizations face a challenge that extends far beyond algorithm replacement. Success depends on understanding cryptographic dependencies, coordinating multiple stakeholders, managing supplier readiness, and establishing a sustainable model for cryptographic agility. The PKI Consortium's Post-Quantum Cryptography Maturity Model (PQCMM) provides a structured framework for assessing the quantum readiness of products and services within the supply chain. At Siemens Trust Centre, we examine how this vendor-centric model can be expanded into an enterprise-wide governance and transformation framework.

This session presents Siemens' approach to adapting the PQCMM for one of the world's largest industrial and technology environments, spanning enterprise IT, public key infrastructure, product security, and operational technology. We describe how PQCMM was integrated into a broader cryptographic governance strategy, enabling consistent assessment of suppliers, internal platforms, PKI services, smart card technologies and virtual smart card solutions.

The presentation shares practical lessons learned while building a cryptographic inventory, establishing quantum-readiness assessment criteria, evaluating strategic vendors, and defining measurable maturity targets across diverse technology domains. Particular emphasis is placed on translating technical PQC requirements into actionable governance mechanisms, supplier management processes, and migration roadmaps. We will present findings and obstacles from the implementation from HSMs, CAs and RAs, as well as governance mechanisms we had to redesign. Attendees will learn why cryptographic visibility and dependency management often represent greater challenges than algorithm adoption itself, and why cryptographic agility must become a core enterprise capability rather than a one-time project outcome.

The session concludes with practical experiences to operationalize PQC readiness, establish common maturity metrics across technology ecosystems, and align supplier management, PKI modernization, and enterprise transformation activities under a single strategic framework.