[Paper Review] PMMP -- PQC Migration Management Process

Nils von Nethen, Alexander Wiesmaier+2 more|arXiv (Cornell University)|Jan 11, 2023

Big Data and Business IntelligenceBusiness, Management and Accounting3 citations

TL;DR

PMMP is a risk-based, organization-integrated process for managing the migration from classical cryptography to post-quantum cryptography (PQC), emphasizing crypto-agility and alignment with enterprise governance. It provides a structured, scalable framework for identifying, assessing, and implementing PQC transitions across IT systems, with the key contribution being a standardized, actionable migration lifecycle for enterprise-wide quantum resilience.

ABSTRACT

Organizations have to plan on migrating to quantum-resilient cryptographic measures, also known as PQC. However, this is a difficult task, and to the best of our knowledge, there is no generalized approach to manage such a complex migration for cryptography used in IT systems that explicitly integrates into organizations' steering mechanisms and control systems. We present PMMP, a risk-based process for managing the migration of organizations from classic cryptography to PQC and establishing crypto-agility. Having completed the initial design phase, as well as a theoretical evaluation, we now intend to promote PMMP. Practitioners are encouraged to join the effort in order to enable a comprehensive practical evaluation and further development.

Motivation & Objective

• Address the lack of a generalized, organization-wide approach to manage migration from classical to post-quantum cryptography (PQC).
• Integrate PQC migration into existing enterprise steering mechanisms and control systems.
• Establish a standardized, repeatable process to support crypto-agility and long-term cryptographic resilience.
• Enable practical evaluation and iterative improvement through practitioner involvement.
• Provide a structured lifecycle for identifying, assessing, and deploying PQC across complex IT systems.

Proposed method

• Propose PMMP as a risk-based, phased migration process tailored for enterprise environments.
• Structure the process into defined stages: assessment, planning, implementation, validation, and monitoring.
• Integrate PQC migration into existing IT governance and risk management frameworks.
• Emphasize crypto-agility through modular cryptographic design and component decoupling.
• Use threat modeling and asset inventory to prioritize systems based on sensitivity and quantum risk exposure.
• Support interoperability and standardization by aligning with NIST PQC finalists and industry guidelines.

Experimental results

Research questions

• RQ1 How can organizations systematically manage the transition from classical to post-quantum cryptography at scale?
• RQ2 What process framework enables integration of PQC migration into existing enterprise governance and control systems?
• RQ3 How can crypto-agility be embedded into the migration lifecycle to ensure long-term resilience?
• RQ4 What role does risk-based prioritization play in optimizing migration efforts across heterogeneous IT systems?
• RQ5 How can practitioners collaboratively validate and refine a PQC migration process in real-world settings?

Key findings

• PMMP provides a comprehensive, risk-based framework that bridges the gap between theoretical PQC standards and enterprise deployment.
• The process is designed to be integrated into existing organizational control and steering mechanisms, enhancing adoption and compliance.
• PMMP emphasizes crypto-agility as a core principle, enabling systems to adapt to future cryptographic changes without major re-architecting.
• The framework supports prioritization of critical assets based on threat modeling and cryptographic risk exposure.
• The authors encourage practitioner involvement to enable practical validation and iterative refinement of the process.
• PMMP is positioned as a living standard, with ongoing development driven by real-world feedback and implementation experience.