Maturity Levels
The PQCMM defines six maturity levels (0–5) for post-quantum cryptography adoption in products and services. Each level builds on the previous one, defining what PQC readiness means in practice — from the complete absence of any quantum-safe activity, all the way to a fully optimised, PQC-by-default product or service.
| Level | Name | Summary |
|---|---|---|
| 0 — None | No PQC implemented | PQC might be in the preparation phase, but no quantum-safe algorithms have matured into the product. |
| 1 — Initial | Available for testing | PQC algorithms are available but for testing and evaluation only; not production-ready. |
| 2 — Foundational | Production-ready | At least one quantum-safe algorithm is available in production and meets relevant standards. |
| 3 — Advanced | Inventory & Agility | Cryptographic inventory (SBOM/CBOM) is in place, and the product supports crypto agility. |
| 4 — Managed | Zero-Legacy | Legacy algorithms are eliminated or isolated; hybrid support is available. |
| 5 — Optimized | PQC-by-default | Quantum-safe is the default; performance is benchmarked and the implementation independently verified. |
Select a level to view its detailed criteria, assessment questions, and evidence requirements.
Cumulative Requirements
Levels are cumulative — a product at Level 3 must satisfy every requirement from Levels 1 and 2 as well. Only Level 0 has no positive requirements; it simply describes a state where no post-quantum capabilities are available in the product.
Assessment & Certification
The PQCMM supports three assurance routes. Buyers can start with self-assessment for visibility, require third-party assessment for higher confidence, or require PKI Consortium certification where authoritative assurance is needed.
Self-Assessment — Vendors evaluate their own product against each level's criteria and provide supporting evidence (release notes, software bills of materials, cryptographic bills of materials, test results) alongside the declared level.
Third-party Assessment — An independent assessor reviews the vendor's evidence, reproduces key claims, and issues a validation report. This stage raises confidence for high-assurance procurement.
Certification — A formal recognition issued by the PKI Consortium based on a qualifying third-party assessment report. The PKI Consortium reviews the report for completeness, methodology adherence, evidence sufficiency, and assessor independence. Certification confirms that a qualifying assessment was reviewed and accepted; it is not a re-assessment of the product and is not a guarantee of security.
