SecureAzCloud SCADA/ICS PQC Readiness Checklist

This checklist supports safety-first planning for PQC readiness in SCADA, ICS, and broader operational technology environments. It emphasizes discovery, vendor coordination, lab validation, compensating controls, and lifecycle planning before production changes.

Safety-first rule: do not introduce new cryptographic settings, certificates, firmware, protocol changes, or active scans into production OT without approved management of change, vendor validation, rollback planning, and an operations-approved maintenance window.

OT/ICS PQC readiness checklist

Area	Checklist item	Safety / operational consideration	Evidence	Status
Governance	Create OT-specific PQC change governance.	No production change without safety impact assessment, vendor support, MOC approval, rollback plan, and maintenance window.	MOC procedure; safety approval; rollback checklist.	☐ Not started ☐ In progress ☐ Complete
Inventory	Discover OT cryptography safely.	Prefer passive discovery, configuration review, certificate export, vendor documentation, and engineering workstation review before any active scanning.	OT crypto inventory; discovery method log.	☐ Not started ☐ In progress ☐ Complete
Criticality	Classify assets by process and safety impact.	Prioritize by process function, downtime tolerance, safety consequence, vendor support, data sensitivity, and remote exposure.	Criticality and safety-impact matrix.	☐ Not started ☐ In progress ☐ Complete
Remote access	Map encrypted remote access paths.	Document VPN, jump hosts, privileged access, vendor access, cloud connectors, modems, bastions, and MFA dependencies.	Remote access architecture map.	☐ Not started ☐ In progress ☐ Complete
Industrial protocols	Review protocol security capabilities.	Identify where TLS, certificates, signed firmware, secure boot, or application-layer security are enabled, unsupported, or vendor-dependent.	Protocol and device security matrix.	☐ Not started ☐ In progress ☐ Complete
PKI	Map OT certificates and trust stores.	Include historians, HMIs, engineering workstations, OPC UA, gateways, web interfaces, remote access systems, and device certificates.	Certificate and trust-store inventory.	☐ Not started ☐ In progress ☐ Complete
Suppliers	Request OT supplier PQC roadmaps.	Confirm firmware/software upgrade paths, key/certificate size limits, protocol support, validation process, and support windows.	Supplier response tracker.	☐ Not started ☐ In progress ☐ Complete
Testing	Use lab or representative test environment.	Never test unvalidated cryptographic changes directly on production control systems.	Lab plan; test assets; acceptance criteria.	☐ Not started ☐ In progress ☐ Complete
Performance	Validate constrained-device impact.	Measure latency, CPU/memory, packet size, fragmentation, session recovery, and failure behavior.	Performance baseline and test results.	☐ Not started ☐ In progress ☐ Complete
Compensating controls	Plan for non-upgradeable assets.	Use segmentation, strict remote access, jump hosts, monitoring, controlled conduits, lifecycle replacement, and time-bound risk acceptance.	Compensating control plan.	☐ Not started ☐ In progress ☐ Complete
Operations	Update monitoring and incident response.	Ensure changed certificates/protocols are visible in OT monitoring and runbooks; conduct tabletop exercises.	Runbooks; alert rules; tabletop results.	☐ Not started ☐ In progress ☐ Complete
Lifecycle	Link PQC readiness to capital planning.	Replace non-agile devices and unsupported appliances during scheduled lifecycle refresh.	Lifecycle roadmap and capital plan.	☐ Not started ☐ In progress ☐ Complete

Required safety gates before production change

Process owner, asset owner, and safety owner approve the scope.
Vendor confirms supportability and known constraints.
Representative lab or non-production validation is complete.
Backup, rollback, and manual operations procedures are documented.
Maintenance window and operational communications are approved.
Monitoring and incident response runbooks are updated before deployment.

Common OT cryptographic dependencies to check

Remote access VPN, bastions, privileged access gateways, and vendor support channels.
OPC UA certificates, industrial gateway TLS, historian web interfaces, and HMI web management.
Engineering workstation software update/signing paths.
PLC/RTU firmware signing, secure boot, device certificates, and vendor update packages.
Wireless, cellular, satellite, or radio links that use certificates or public-key handshakes.
Cloud connectors, telemetry gateways, edge devices, and data diode management interfaces.

Compensating controls for non-agile or non-upgradeable assets

Constraint	Possible compensating controls
Fixed cryptographic algorithms	Segmentation, controlled conduits, jump hosts, restricted trust relationships, monitoring, and replacement roadmap.
Unsupported certificates or large key/signature sizes	Gateway mediation, vendor-approved upgrade path, certificate profile constraints, and compatibility testing.
Vendor support gap	Contractual roadmap request, accepted-risk expiration, isolation, enhanced monitoring, and lifecycle refresh.
Operational downtime constraint	Longer pilot period, maintenance-window sequencing, rollback rehearsal, and staged cutover.

Reference sources

Source	Public URL
NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)	https://csrc.nist.gov/pubs/fips/203/final
NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)	https://csrc.nist.gov/pubs/fips/204/final
NIST FIPS 205 — Stateless Hash-Based Digital Signature Standard (SLH-DSA)	https://csrc.nist.gov/pubs/fips/205/final
NIST PQC Standardization Project	https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization
NIST NCCoE Migration to Post-Quantum Cryptography	https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc
NIST CSWP 39 — Considerations for Achieving Crypto Agility	https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.39.pdf
NIST Cybersecurity Framework 2.0 announcement and resources	https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework
NIST SP 800-53 Rev. 5 — Security and Privacy Controls	https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST SP 800-82 Rev. 3 — Guide to Operational Technology Security	https://csrc.nist.gov/pubs/sp/800/82/r3/final
NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management	https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final
CISA — Quantum-Readiness: Migration to Post-Quantum Cryptography	https://www.cisa.gov/resources-tools/resources/quantum-readiness-migration-post-quantum-cryptography
CISA — Post-Quantum Considerations for Operational Technology	https://www.cisa.gov/resources-tools/resources/post-quantum-considerations-operational-technology
CISA — Product Categories for Technologies that Use PQC Standards	https://www.cisa.gov/resources-tools/resources/product-categories-technologies-use-post-quantum-cryptography-standards

This resource hub is an independent, vendor-neutral planning aid. It is not a NIST, CISA, or government publication and does not imply endorsement by any public agency.