Define policy templates
Choose standards-aligned policy templates, add PQC-specific controls, and adapt requirements where your organization needs a stricter or staged migration path.
The governance platform for PQC migration compliance
Crypto Posture gives security and platform teams one governed workflow for policy templates, application and service baselines, remediation, approved exceptions, compliance status, and evidence.
Set migration scope
Bring applications, services, certificates, gateways, and infrastructure sources into scope so teams know what is covered by each policy.
See current compliance state
Baseline compliance status across scoped systems, including owners, active policies, issues, recent activity, exceptions, and retained evidence.
Govern remediation work
Track remediation work, ownership, approvals, expiry dates, and exception decisions so temporary risk does not disappear into spreadsheets.
Keep evidence ready
Retain policy versions, evaluation records, exception history, and evidence snapshots for audit, customer assurance, leadership, and risk reviews.
Stay current as standards change
Re-evaluate stored records when policy templates, accepted algorithms, or standards change so new impact is visible without starting again.
Policy Templates
Selected: 2 templates
Choose standards-aligned templates, add PQC-specific controls, and see the compliance impact across your migration scope.
Selected templates
Payments (PCI DSS v4.0.1, NIST SP 800-131A)
selectedPQC Ready - Foundation Level
selectedAvailable templates
| Policy | Derived from standards / intent | Rule families | Status | Action |
|---|---|---|---|---|
| EU Critical Infrastructure (NIS2, CRA, BSI, ANSSI) | European strict baseline with stronger classical thresholds | 6 | not selected | Select / view |
| US Regulated Cloud (FedRAMP, CMMC, NIST) | FIPS-oriented baseline for regulated cloud environments | 5 | not selected | Select / view |
| PQC Ready - Strict Level | Target-state migration policy for the later phase of the program | 7 | not selected | Select / view |
Compliance status dashboard
See current PQC migration status by application, service, owner, policy, and evidence state.
Failing apps / services
2Warning apps / services
1Passing apps / services
1| App / service | Owner | Status | Issues | Recent activity |
|---|---|---|---|---|
| Customer auth | Identity team | warning | 0 / 5 | PR #992 |
| Partner gateway | Platform edge | passing | 0 / 0 | Deploy 2h ago |
| Payments API | Payments team | failing | 5 / 6 | PR #481 |
| Shared ingress config | Platform networking | failing | 1 / 3 | PR #118 |
Active policies
Payments (PCI DSS v4.0.1, NIST SP 800-131A)
failingPQC Ready - Foundation
warningRecent Activity
View full activity log| 10m ago | PR #481 failed: DES introduced in Payments API |
| 32m ago | Customer auth warned under PQC Ready - Foundation: 5 non-PQ transport/signing uses remain |
| 1h ago | PR #118 failed: 1 disallowed algorithm use detected in Shared ingress config |
From standards to enforceable controls
Policy templates translate standards guidance into practical controls your teams can evaluate, track, and evidence.
PQC Ready - Foundation Level
Non-PQ transport algorithms
warnMeaning / setting: RSA, ECDH, or DH in scoped transport paths
Rationale: Surface migration debt without blocking phase-one delivery.
Non-PQ signing algorithms
warnMeaning / setting: RSA or ECDSA in scoped signing paths
Rationale: Keep signing migration visible while remaining achievable in the early program phase.
TLS below 1.2
failMeaning / setting: Current TLS posture is below acceptable minimum
Rationale: Clearly unsafe legacy posture should not be part of a credible intermediate green state.
TLS below 1.3
warnMeaning / setting: Modern target-state TLS not yet reached
Rationale: Push toward the stricter target without making early rollout unreachable.
Weak certificate signature algorithms
failMeaning / setting: MD5, SHA-1
Rationale: These are disallowed in any credible transition baseline.
Weak RSA key size
failMeaning / setting: RSA key size below 3072
Rationale: If RSA remains during transition, enforce a stronger intermediate minimum.
Continuous compliance checks in delivery workflows
Connected delivery workflows keep the governance platform current as teams keep shipping. cryptodiff evaluates code, configuration, certificates, and infrastructure changes against selected policy, then emits records the platform can retain, re-evaluate, and use as evidence.
- Start report-only to build trust before enforcement.
- Prevent high-confidence regressions before merge.
- Feed each evaluation back into posture and evidence history.
- Support time-bound exceptions with owner, rationale, and expiry.