Quantum computing, quantum communication and networking, quantum sensing, and post-quantum cryptography (PQC) each require distinct organizational readiness assessment. Existing maturity models address these domains in isolation, conflate PQC with quantum technologies, omit quantum networking, exhibit regional standards bias, or mandate specific vendor relationships. The Quantum Technology Readiness Adoption Model (QTRAM), grounded in the Technology-Organization-Environment (TOE) framework, structures assessment through five independent Technology sub-dimensions within shared Organization and Environment contexts, using six maturity levels (05) aligned with international standards from IEEE, NIST, ETSI, ITU, TNO, and regional bodies. QTRAM remains theoretical and requires empirical validation.
Quantum computing, quantum communication and networking, quantum sensing, and post-quantum cryptography (PQC) each require distinct organizational readiness assessment. Existing maturity models address these domains in isolation, conflate PQC with quantum technologies, omit quantum networking, exhibit regional standards bias, or mandate specific vendor relationships. The Quantum Technology Readiness Adoption Model (QTRAM), grounded in the Technology-Organization-Environment (TOE) framework, structures assessment through five independent Technology sub-dimensions within shared Organization and Environment contexts, using six maturity levels (05) aligned with international standards from IEEE, NIST, ETSI, ITU, TNO, and regional bodies. QTRAM remains theoretical and requires empirical validation.
This paper examines recurring technical and organizational bottlenecks in post-quantum cryptography (PQC) migration and develops an enterprise-oriented framework for managing them. A structured narrative review synthesizes NIST standards and guidance, CISA migration guidance, IETF specifications, and selected academic and research literature on enterprise migration, interoperability, software engineering, and PQC adoption. The paper organizes recurring migration concerns into five interacting layers and a six-stage migration lifecycle, and proposes candidate readiness metrics for future empirical testing. It connects technical migration concerns with organizational cybersecurity governance and presents a practical structure for treating PQC readiness as a continuous organizational capability. The framework is conceptual and is not presented as a validated maturity model.
The emergence of quantum computing technologies poses significant risks to conventional public-key cryptographic systems and creating an urgent need for organizational preparation toward Post-Quantum Cryptography (PQC) migration. Although various PQC migration frameworks and quantum-readiness initiatives have been proposed, existing approaches primarily focus on technical migration guidance and provide limited operational mechanisms for assessing organizational readiness, particularly within public-sector environments. This study develops and conducts a preliminary validation of a Post-Quantum Cryptography Organizational Readiness Instrument (PQC-ORI) for Indonesian public-sector organizations using a Design Science Research approach integrating Systematic Literature Review (SLR), Qualitative Content Analysis (QCA), and Framework Alignment Matrix (FAM) techniques to synthesize recurring organizational readiness constructs from PQC migration literature, governance frameworks, and cybersecurity readiness studies. The resulting framework comprises six organizational readiness dimensions: Cryptographic Awareness, Governance and Policy, Migration Management, Technical Capability, Cryptographic Agility, and Operational Resilience. The framework additionally operationalizes these dimensions into structured assessment indicators and a five-level maturity model intended to support organizational self-assessment and migration planning activities. Preliminary validation by three domain experts using structured expert judgment yielded an overall mean score of 3.69/4.00, indicating high relevance, conceptual consistency, and applicability for assessing organizational readiness for PQC migration in public-sector organizations.
This chapter presents a structured approach for preparing organizations for quantum-era cybersecurity. It introduces a domain-based quantum security maturity model aligned with guidance from NIST, ENISA, ETSI, and WEF. Key domains include cryptographic inventory, workforce readiness, crypto-agility, vendor compliance, and PQC migration. Maturity levels range from initial awareness to optimized quantum-safe operations. The chapter outlines a six-phase implementation roadmap: awareness, inventory, risk assessment, migration planning, implementation, and continuous monitoring. Radar charts and TRL-based models assess maturity across cryptographic and quantum capabilities. Mid- and long-term plans extend readiness through 2040, incorporating QML, QAOA, QKD, and emerging quantum applications. Security capabilities are mapped to quantum technologies, providing actionable links between investment and defense outcomes. The chapter emphasizes a phased, risk-prioritized transition and provides milestones and timelines for near- and mid-term actions. Organizations are encouraged to tailor their targets based on operational needs, with a focus on foundational resilience before broader quantum adoption.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
Chapter 19 of Quantum Ready focuses on the essential human and operational dimensions of post-quantum cryptographic resilience. As quantum computing threatens to destabilize today's cryptographic foundations, technology alone is insufficient. This chapter outlines the critical organizational capabilities required to sustain quantum-safe operations, including quantum literacy training, role-specific assessment frameworks, and the development of tested playbooks and tabletop exercises. It highlights the importance of building institutional capacity, aligning responsibilities, and ensuring preparedness across security, DevOps, incident response, and compliance functions. Key themes include the creation of a quantum-aware workforce, the integration of cryptographic failure scenarios into real-world preparedness simulations, and the designation of a quantum risk owner who oversees lifecycle management, incident coordination, and executive reporting. The chapter introduces resources such as hands-on labs, certification pathways, and internal enablement strategies to promote continuous education and operational readiness. It also examines how behavioral change management and gamification can drive cultural adoption, making cryptographic resilience a shared responsibility. In addition, this chapter emphasizes the importance of embedding post-quantum cryptography (PQC) into third-party risk management and procurement processes. It provides guidance on updating vendor questionnaires, contract terms, SLAs, and audit procedures to enforce PQC readiness across the supply chain. By operationalizing training, governance, and third-party accountability, organizations can move from ad hoc preparation to sustained cryptographic agility.
This chapter introduces the Q-Ready Framework, a structured and practical model for guiding organizations through their post-quantum cryptography (PQC) transition. Developed in alignment with National Security Memorandum-10 (NSM-10), NIST SP 1800-38, FIPS 203–206, and CISA guidance, the framework translates federal directives and industry best practices into an actionable strategy tailored for enterprise security leaders. The framework includes five key phases – Discovery, Planning, Implementation, Validation, and Maintenance – each with three steps designed to help organizations inventory cryptographic assets, prioritize risk, deploy quantum-safe algorithms, and sustain long-term readiness. The Q-Ready Framework addresses the real-world challenges of cryptographic migration, including fragmented inventories, legacy infrastructure, complex supply chains, and regulatory mandates. It integrates with established cybersecurity governance models such as the NIST Cybersecurity Framework (CSF) and Risk Management Framework (RMF), ensuring audit and compliance alignment. The chapter also outlines how the rest of the book is organized around this framework, allowing readers to access field-tested advice, tooling guidance, success metrics, and organizational strategies based on their current phase in the quantum readiness journey.