PQC Cloud & Workload Identity Migration Checklist

← Back to SecureAzCloud PQC Migration Resource Hub

This public version is intentionally redacted and uses examples/placeholders only. It does not include secrets, hostnames, IP addresses, customer data, internal diagrams, proprietary product configurations, or key material.

Downloads

XLSX Checklist

Workbook with cloud/IAM checklist, workload identity inventory, certificate/key map, CISA category mapping, pilot test plan, and sources.

Download

PDF Companion

Printable checklist companion with CISA 2026 product-category alignment and pilot acceptance criteria.

Download

CSV Checklist

Lightweight CSV checklist for importing into ticketing, GRC, or project management tools.

Download

What this artifact covers

Area	Coverage	Expected Evidence
Certificates and TLS	Managed certs, public/private CAs, mTLS, API gateways, service mesh, chain-size and relying-party constraints.	Certificate scan, CA export, TLS test result, gateway/service-mesh config.
Workload identities	Service principals, IAM roles, managed identities, Kubernetes service accounts, SPIFFE/SPIRE IDs, CI/CD identities.	IAM export, trust bundle map, workload identity inventory.
Identity signing	OIDC, OAuth, SAML, JWT, federation metadata, verifier libraries, and SaaS relying parties.	IdP signing-key inventory, relying-party test results.
SaaS/vendor readiness	Supplier roadmap, cryptographic disclosure, support windows, procurement language.	Vendor response, contract clause, support commitment.

Recommended use

Use the Checklist sheet to assign owners, priorities, due dates, and evidence links.
Populate the Workload_Identity_Inventory for P1 applications and shared platforms.
Populate the Certificate_and_Key_Map for TLS, mTLS, token signing, KMS/HSM, and CA dependencies.
Use the CISA_Category_Map to support vendor/procurement questions.
Run Pilot_Test_Plan in non-production before production change approval.

Standards and source alignment

Aligned to CISA's 2026 PQC product-category release for cloud services, web software, and endpoint security, and to NIST PQC migration guidance.

Core references include NIST FIPS 203, NIST FIPS 204, NIST FIPS 205, NIST NCCoE Migration to PQC, NIST CSWP 39 crypto-agility guidance, CISA quantum-readiness resources, and CISA's 2026 product-category announcement for PQC adoption.

Disclaimer

This artifact is an independent planning aid. It is not a government publication and does not imply endorsement by NIST, CISA, or any public agency. Organizations should adapt it to their own architecture, operating constraints, regulatory obligations, and vendor support status.