1. Define migration scope
- List applications, services, certificates, gateways, and infrastructure sources in scope.
- Identify business-critical systems and externally exposed paths.
- Record owners for each system and policy area.
PQC migration plan template for software teams
Use this planning structure to turn PQC concern into a governed migration program with clear scope, owners, phases, remediation work, approved exception handling, and evidence milestones.
2. Choose policy phases
- Start with a report-only baseline where teams need visibility first.
- Decide which findings should warn, fail, or remain advisory.
- Define the stricter target state before enforcement begins.
3. Prioritize remediation
- Separate urgent legacy risk from staged PQC migration work.
- Assign remediation owners and target dates.
- Capture exception requests with rationale, affected scope, and expiry.
4. Track evidence milestones
- Retain policy versions, evaluation results, approved exception decisions, and evidence snapshots.
- Review progress with security, platform, risk, and leadership teams.
- Re-evaluate stored records when standards or accepted algorithms change.
Copy-ready planning worksheet
Use these prompts in a planning document or working session. The goal is to produce a first governed baseline, not a perfect enterprise-wide inventory.
Objective
What migration outcome are you trying to prove in the first 30-60 days?
Systems in scope
Which applications, services, certificates, gateways, and infrastructure sources will be baselined first?
Owners
Who owns policy, remediation, approved exceptions, and evidence for each scoped system?
Policy phase
Which controls start report-only, which warn, and which are allowed to fail delivery workflows?
Remediation decisions
Which findings must be fixed first, who owns them, and what dependency or target date controls the work?
Approved exception rules
What rationale, affected scope, approving policy context, expiry, and review cadence are required?
Evidence milestones
Which baseline snapshot, policy version, evaluation records, and review summary will prove progress?
Review cadence
When will security, platform, risk, and leadership review status and decide whether to expand scope?
Move from plan to baseline
Crypto Posture helps teams turn the plan into an operating workflow: select a policy template, enroll one application or service, baseline current compliance status, and produce the first evidence snapshot.