Governance Before Discovery: A Systematic Comparative Review of Post-quantum Cryptography (PQC) Lifecycle Models

Aritrik Ghosh

Ahsan Siraj Khan

This paper examines recurring technical and organizational bottlenecks in post-quantum cryptography (PQC) migration and develops an enterprise-oriented framework for managing them. A structured narrative review synthesizes NIST standards and guidance, CISA migration guidance, IETF specifications, and selected academic and research literature on enterprise migration, interoperability, software engineering, and PQC adoption. The paper organizes recurring migration concerns into five interacting layers and a six-stage migration lifecycle, and proposes candidate readiness metrics for future empirical testing. It connects technical migration concerns with organizational cybersecurity governance and presents a practical structure for treating PQC readiness as a continuous organizational capability. The framework is conceptual and is not presented as a validated maturity model.

Laima Jančiūtė, Joris V. J. van Hoboken

Berat Birgin, Barış Çeliktaş

The pace of quantum computing development necessitates not only the adoption of post-quantum cryptographic algorithms, but also the establishment of an executable and auditable institutional transition process. Although guidance documents published by the National Institute of Standards and Technology (NIST) and roadmaps proposed by the Post-Quantum Cryptography Coalition (PQCC) articulate strategic objectives, they largely remain procedural constructs lacking a concrete operational execution model. This paper presents an industry-neutral operational framework that translates policy-level post-quantum cryptography (PQC) guidance into deterministic, proof-producing process flows encompassing cryptographic asset discovery, classification, risk modeling, algorithm selection, deployment, monitoring, and governance enforcement. Central to the framework is a deterministic Quantum Risk Scoring (QRS) function, calibrated using the Analytical Hierarchy Process (AHP), which enables reproducible asset prioritization and policy-driven enforcement decisions. Framework executability is further strengthened through cryptography-aware continuous integration/continuous deployment (CI/CD) validation gates and downgrade protection mechanisms, ensuring the generation of verifiable and immutable audit artifacts. A scenario-based operational validation, implemented using open-source toolchains, demonstrates the framework’s operability, auditability, and governance alignment without relying on empirical cryptographic performance benchmarks, confirming that PQC transition can be operationalized as a verifiable lifecycle process bridging policy guidance with enforceable technical actions.

Stanley Nwakamma, John Ojukwu, Serif Oyindamola Oyesiji

The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.

Francisco Javier de la Puente Secades, Gonzalo Esteban, Adrián Campazas +3 more