Post-Quantum Readiness Assessment: 75 Questions for PKI and Security Teams

Quick answer: A rigorous post-quantum readiness assessment covers eight categories: cryptographic inventory, PKI and certificate infrastructure, HSM and key management, TLS and network protocols, code signing and software supply chain, application and endpoint dependencies, vendor and third-party readiness, and governance, testing, budget, and timeline. This checklist runs 75 questions across those eight categories, built to surface the specific gaps that generic “are you PQC-ready” self-assessments miss.

Most PQC readiness self-assessments stay high-level enough that almost any organization can answer “somewhat ready” without the exercise actually surfacing a specific gap. This checklist is built the opposite way: specific enough that a “no” or “unsure” answer points directly at a concrete next action, not a vague area of concern.

Key Takeaways

• 75 specific questions across eight categories surface concrete gaps rather than producing a vague, unmeasurable readiness score.
• Inventory, PKI, and HSM categories carry the most questions, reflecting how much of a real PQC program’s early risk concentrates in those three areas.
• Governance, testing, budget, and timeline questions are included deliberately, since technical readiness without program discipline behind it rarely survives contact with a real multi-year migration.
• Use this as a working document revisited quarterly, not a one-time scorecard, since vendor readiness and validation status shift throughout a migration program.

Cryptographic Inventory (12 questions)

1. Do you have a documented, current cryptographic inventory covering algorithms, keys, and certificates?
2. Does that inventory use a standardized, machine-readable format (CycloneDX CBOM or equivalent)?
3. Does every inventory entry have a named owner, not just a technical finding?
4. Have you scored confidentiality lifetime for data protected by each cryptographic asset?
5. Have you classified external exposure for each finding?
6. Does your discovery cover network traffic, not just static configuration?
7. Does your discovery cover source code and hardcoded algorithm calls?
8. Does your discovery cover compiled binaries and third-party software you don’t have source access to?
9. Does your discovery cover cloud-managed keys and certificates via provider APIs?
10. Does your discovery cover endpoint-level cryptography (disk encryption, drivers, Secure Boot)?
11. Do you have a documented plan for air-gapped and legacy systems no automated tool can reach?
12. Is your inventory updated on a defined, recurring cadence, not a one-time snapshot?

PKI and Certificate Infrastructure (11 questions)

1. Do you know whether your CA platform supports ML-DSA, and under what version and update?
2. Do you understand whether your CA platform requires a parallel hierarchy rather than an in-place upgrade?
3. Have you selected target ML-DSA parameter sets by CA tier (root, intermediate, leaf)?
4. Have you assessed which relying parties can validate an ML-DSA or hybrid certificate today?
5. Do you have a trust anchor distribution plan for a new root CA?
6. Have you decided between pure PQC and composite/hybrid certificate formats by use case?
7. Do you have OCSP and CRL infrastructure tested against PQC-signed responses?
8. Have you evaluated short-lived certificate issuance as an alternative to scaling revocation infrastructure?
9. Do you have a defined retirement plan and date for your legacy CA hierarchy?
10. Have you inventoried certificate templates that still use legacy cryptographic providers?
11. Do you track certificates issued outside your central PKI process (via Certificate Transparency log monitoring)?

HSM and Key Management (10 questions)

1. Do you know your current HSM firmware’s PQC algorithm support status?
2. Do you know your HSM vendor’s actual FIPS 140-3/CMVP validation status for PQC algorithms, with certificate numbers?
3. Have you benchmarked PQC signing throughput under your real production volume?
4. Have you tested PQC key backup and restore on your specific HSM platform?
5. Have you confirmed HA and clustering features work with PQC key types on your firmware?
6. Do you know which of your compliance requirements mandate hardware key custody for PQC keys?
7. If considering an HSM vendor change, do you have a plan built around key reissuance rather than key portability?
8. Have you planned key ceremonies for any new PQC root or hierarchy under the same dual-control discipline as your existing ceremonies?
9. Do you have a documented HSM refresh budget tied to your PQC timeline?
10. Is your FIPS 140-2 to 140-3 transition tracked as a distinct deadline from your PQC migration?

TLS and Network Protocols (9 questions)

1. Have you enabled hybrid ML-KEM key exchange (X25519MLKEM768) on internet-facing TLS endpoints?
2. Have you tested hybrid TLS against your specific middlebox and TLS inspection appliances?
3. Do you have negotiated-algorithm telemetry to detect silent classical fallback in production?
4. Have you assessed post-quantum readiness for your VPN and IPsec infrastructure specifically?
5. Have you evaluated RFC 8784 pre-shared keys as a low-effort interim VPN protection?
6. Have you confirmed your SSH fleet is running a current OpenSSH version with hybrid key exchange as default?
7. Have you inventoried jump hosts and automation pipelines dependent on SSH host keys?
8. Have you assessed S/MIME certificate readiness, including the dual-certificate (ML-KEM plus ML-DSA) requirement?
9. Have you tested actual handshake performance under your real concurrency, not just published vendor benchmarks?

Code Signing and Software Supply Chain (9 questions)

1. Have you confirmed your timestamp authority’s PQC readiness, separately from your code-signing algorithm?
2. Have you assessed firmware artifacts that cannot be re-signed after deployment as a distinct risk category?
3. Have you mapped which verification systems consuming your signed artifacts can validate ML-DSA today?
4. Have you run a parallel classical-and-PQC signing pilot on production artifacts?
5. Have you assessed your Sigstore, SLSA, or attestation tooling’s PQC migration path?
6. Do you have a CBOM distinct from your existing SBOM, covering the cryptography protecting your build artifacts?
7. Have you confirmed your CI/CD signing pipeline’s HSM integration supports the ML-DSA key storage provider?
8. Have you evaluated FN-DSA for constrained signing scenarios, tracking its draft standardization status?
9. Do you have long-term validation (timestamping plus revocation evidence) configured for your signing workflow?

Application and Endpoint Dependencies (8 questions)

1. Have you inventoried applications that bundle their own TLS stack independent of the OS?
2. Have you confirmed applications using legacy CryptoAPI versus CNG providers?
3. Have you assessed disk encryption and driver-signing chains as a distinct endpoint category?
4. Have you confirmed your endpoint fleet’s OS patch levels against the specific PQC capability rollout dates?
5. Have you assessed constrained devices (IoT, embedded, OT) separately from general endpoint infrastructure?
6. Do you have a gateway-termination strategy for devices that cannot run PQC natively?
7. Have you assessed manufacturing-stage PKI decisions for any devices still in active production?
8. Have you assessed blockchain or digital asset custody infrastructure if applicable to your organization?

Vendor and Third-Party Readiness (8 questions)

1. Have you sent a structured PQC readiness questionnaire to your critical vendors, requesting evidence rather than accepting general claims?
2. Have you confirmed your cloud provider’s specific service-by-service PQC readiness, not a company-wide claim?
3. Have you confirmed which side of the shared responsibility line each cloud PQC capability actually falls on?
4. Have you assessed payment processor and financial counterparty PQC readiness if applicable?
5. Have you assessed correspondent bank or interbank API partner readiness if applicable?
6. Have you confirmed a rollback plan exists with each critical vendor for a compatibility issue post-deployment?
7. Have you documented each vendor’s classical-algorithm sunset policy and timeline?
8. Have you assessed whether a PQC-driven hardware refresh is also a reasonable moment to reconsider vendor selection?

Governance, Testing, Budget, and Timeline (8 questions)

1. Is there a named, accountable executive sponsor for your PQC program?
2. Do you have a documented RACI covering crypto, PKI, application, infrastructure, procurement, legal, risk, and audit roles?
3. Have you mapped your program against your applicable regulatory deadlines (CNSA 2.0, federal PQC mandates, DORA, eIDAS, or others)?
4. Do you have a risk-based scoring model driving migration sequencing, not a flat priority list?
5. Do you have a documented budget covering discovery tooling, HSM refresh, PKI infrastructure, and advisory support?
6. Have you built a multi-year timeline with defined phase gates, not a single target completion date?
7. Do you have a documented evidence and reporting cadence for compliance and executive stakeholders?
8. Do you revisit this assessment on a defined cadence as vendor readiness and standards evolve?

What We’d Actually Recommend

Score each category honestly rather than optimistically; a “no” or “unsure” answer is more valuable to a program than an aspirational “yes,” since it points directly at a concrete next action. Prioritize the inventory, PKI, and HSM categories first if your organization is early in its program, since gaps there tend to block progress across every other category. Revisit this checklist quarterly rather than treating it as a one-time scorecard, since vendor validation status and standards maturity are both actively moving targets through 2026 and beyond.

How Encryption Consulting Can Help

Our PQC Advisory Services run this assessment as a structured workshop against your actual environment, turning each “no” answer into a scoped, sequenced work item rather than leaving it as an open question. CBOM Secure directly answers the inventory-category questions with real discovery data rather than a self-reported estimate.

A Checklist Built to Be Uncomfortable

A good readiness assessment should produce some uncomfortable “no” answers; that’s the point. 75 specific questions across inventory, PKI, HSM, TLS, code signing, applications, vendors, and governance surface the real gaps a generic self-assessment lets an organization talk past. Working through every category honestly, and revisiting the results quarterly rather than once, is what actually converts a checklist into program progress.

Frequently Asked Questions

How should an organization use a 75-question checklist without getting overwhelmed?

Work through it by category rather than all at once, and treat each “no” as a work item to schedule rather than a score to feel bad about. Prioritizing the inventory, PKI, and HSM categories first typically surfaces the highest-leverage gaps.

How often should this assessment be repeated?

Quarterly is reasonable for most organizations during an active migration program, since vendor validation status, standards finalization, and platform capability all change meaningfully over that timeframe.

Which category tends to reveal the most gaps for organizations early in their PQC program?

Cryptographic inventory, consistently. Most organizations starting a PQC program discover their existing inventory, if one exists at all, does not cover the discovery layers, ownership data, or exposure classification this checklist requires.

Is this checklist relevant to organizations outside regulated industries?

Yes. While some questions reference specific regulatory frameworks, the underlying categories, inventory, PKI, HSM, TLS, code signing, applications, vendors, and governance, apply to any organization with meaningful cryptographic infrastructure, regardless of regulatory obligation.

Should every question receive equal weight when scoring readiness?

No. Weight questions by relevance to your specific environment and regulatory obligations; a question about payment rail readiness carries no weight for an organization without payment infrastructure, for instance, and should be scoped out rather than scored.