What Breaks Between Assessment and Implementation: Lessons from PQC Migration Programs Across Organizations

Most PQC migration advice stops at the roadmap. This session picks up where the roadmap meets production, drawing on assessment and migration work across many organizations in different sectors and at different levels of maturity. The recurring lesson is that the same failure points show up again and again, and that the gap is between a clean assessment, a practical roadmap, and successful implementation.

The talk follows the real arc of a program. It starts with discovery and assessment, including what cryptographic inventory consistently misses: statically linked libraries, keys embedded in firmware, proprietary protocols on operational networks, and cryptography buried inside third-party appliances. It then moves to the migration attempt and the things that broke in production. Hybrid and composite certificates issued into mutual TLS meshes triggered chain validation errors in older OpenSSL and JSSE clients. Handshake sizes grew large enough to fail through middleboxes and load balancers. Hardware security module gaps for composite key generation surfaced only under load. The session walks through the rollback decision and the redesign that held, which was a parallel PQC hierarchy rather than swapping roots in place.

The second half connects engineering reality to assurance reality, because the same programs hit a second wall: producing evidence auditors accept. It maps what examiners actually request against NIS2, DORA, and the CRA, including CBOMs as Article 21 documentation, certificate lifecycle reports for ICT risk testing, module attestations, and the supplier readiness evidence chain. The practical takeaway is to structure discovery and inventory output so it doubles as audit evidence from day one, rather than rebuilding it under deadline.

Attendees will leave with the failure modes that recur regardless of sector, a clear signal for when to abandon in-place hybrid roots, and a sequence that links assessment, migration, and assurance so the three are not rebuilt separately. The content is experience-led and vendor-neutral, framed entirely around what was observed in the field.