PQC Consulting for Enterprises
ost-quantum cryptography (PQC) is changing the requirements for existing IT and security architectures. Organizations should determine early on which business-critical applications and data are affected and where quantum-vulnerable cryptography is currently in use. essendi it helps assess the need for action, build a crypto inventory, and develop a structured PQC roadmap. We combine extensive experience in cryptography, public key infrastructure (PKI), and Certificate Lifecycle Management with in-house research and development, as well as solutions from the essendi crypto solutions product family.
Powerful quantum computers could eventually compromise widely used asymmetric algorithms such as RSA and those based on elliptic curves. It is not yet possible to predict exactly when quantum computers capable of breaking today’s public-key cryptography will become available. Even though the timing of Q-Day remains uncertain, organizations should start preparing early.
Standardized post-quantum cryptographic algorithms are already available. At the same time, international and European institutions continue to define recommendations and timelines for the transition.
Organizations therefore need to identify affected areas, set priorities, and prepare for the transition to new cryptographic algorithms in a structured way.
Business-critical applications may also be at risk if the cryptographic algorithms they rely on no longer provide adequate protection or cannot be replaced.
Cryptography is deeply embedded in applications, devices, and IT environments and often goes largely unnoticed in day-to-day operations. Analysis, evaluation, testing, and implementation therefore take time, especially for legacy systems and long-lived devices.
Post-quantum readiness means being able to prepare for and execute the PQC transition. Crypto agility is an important part of that readiness: it enables cryptographic algorithms to be changed in a controlled manner as requirements evolve.
Applications, PKI components, and operational processes must be prepared accordingly.
NIST standards, the EU PQC roadmap, and national and industry-specific requirements increasingly provide a framework for migration. Organizations that start early gain more time for technical decisions and can plan investments and resources more effectively.
Do you know which systems are particularly important to core business processes and how long the data they process needs to remain protected?
Do you know where relevant cryptographic components are currently in use across your environment?
Do you know which applications, devices, or services depend on vendors, external platforms, or components that are difficult to update?
Can cryptographic algorithms be changed in a controlled manner when standards or security requirements evolve?
If you cannot yet answer these questions fully, that gap provides a clear starting point for PQC preparation.
A robust PQC migration starts by linking business criticality with technical visibility. From there, suitable algorithms can be evaluated and realistic migration priorities set.
The first step is to determine which applications, systems, and data are particularly important to core business processes.
Existing IT asset lists, protection requirements assessments, or comparable sources can be used as a starting point. Business criticality and protection requirements need to be understood before technical migration activities can be prioritized.
The next step is to determine which cryptography is used in the relevant applications and systems. A crypto inventory provides visibility into certificates, keys, algorithms, and other components relevant to the migration.
With essendi cd, certificates can be discovered and analyzed, particularly across network, cloud, and Windows environments. Information from additional sources and interfaces can be incorporated as needed to complete the picture.
New algorithms and certificate types need to fit the existing architecture and the specific use case.
As part of the evaluation, we consider factors such as performance, compatibility, and integration requirements. Hybrid transition scenarios and support in existing products, protocols, and platforms are also taken into account.
Together, business criticality, the crypto inventory, and the technical evaluation determine which areas should be prioritized.
In addition to protection requirements and data lifetime, the expected migration lead time plays an important role. Systems that require significant preparation need to be included early in the planning process.
The PQC roadmap structures short-, medium-, and long-term activities and provides a reliable framework for planning and implementation.
Post-quantum cryptography is not a one-time project. Algorithms, standards, products, and requirements will continue to evolve.
A continuous management cycle therefore connects inventory, assessment, planning, implementation, and reassessment. This supports long-term crypto agility.
Want to explore the technical aspects of the PQC transition in more depth? In our magazine article on the PQC transition, we examine the requirements for Crypto Asset Management, architecture, migration, and crypto agility.
With ML-KEM, ML-DSA, and SLH-DSA, standardized PQC algorithms are available for different cryptographic purposes. ML-KEM supports secure key establishment, while ML-DSA and SLH-DSA are designed for digital signatures.
In practice, organizations need to determine which algorithms are supported by the components involved and how they affect performance and integration.
New algorithms have a direct impact on public key infrastructure. Certificate profiles, trust chains, certificate authorities, hardware security modules, and connected applications must be able to handle new formats and parameters.
Asymmetric cryptography is used in a wide range of communication and authentication processes, including TLS, VPNs, APIs, cloud connections, signing processes, and identity systems.
A successful migration requires a clear understanding of where changes are needed and which components depend on vendors or external services.
IoT and OT environments require particular attention. Long lifecycles, limited hardware resources, and restricted update capabilities can make the transition more challenging.
An early inventory helps identify where alternative migration approaches may be required.
essendi crypto solutions is the essendi it product family for managing cryptographic infrastructures. The individual solutions support different tasks across the certificate lifecycle and cryptographic transformation.
Which solutions are appropriate for a PQC transition depends on the existing environment and the organization’s specific requirements.
International standards, European roadmaps, and industry-specific requirements increasingly provide a framework for PQC migration. These include the NIST standards for post-quantum cryptography, the EU PQC roadmap, recommendations from Germany’s BSI, and requirements relating to cryptography and digital resilience, including those under DORA.
Want to take a closer look at the relevant standards, roadmaps, and regulatory developments? In our magazine article PQC Timelines at a Glance, we put the key requirements and timelines for PQC migration into context.
essendi it has extensive hands-on experience with digital certificates, public key infrastructure, and Certificate Lifecycle Management.
This includes projects in regulated and security-critical sectors such as financial services and energy, providing the context needed to evaluate new cryptographic algorithms within real-world enterprise architectures.
Since 2023, essendi it has been collaborating with Lucerne University of Applied Sciences and Arts on research projects involving post-quantum cryptography and certificate management.
Following an initial project examining the impact of PQC on Certificate Lifecycle Management, the collaboration continues with Crypto-agile Certificate Management. The project focuses on how cryptographic algorithms can be changed in a controlled manner across large networks.
We assess the results of our collaboration with Lucerne University of Applied Sciences and Arts for real-world use. essendi it tests new algorithms and certificate types, conducts performance and compatibility testing, and assesses their suitability for different use cases.
Insights from these projects, our own development work, and ongoing market monitoring inform the continued development of essendi crypto solutions.
essendi it participates in the Crypto Agility working group at TeleTrusT. This exchange helps us assess technological developments early and apply relevant findings in practice.
Want to explore individual topics in more depth? Our magazine provides additional content for management and technical teams.
Post-Quantum Cryptography: What Executives Need to Know
A strategic overview of risks, timelines, and the need for action.
Crypto Inventory and Crypto Agility
Why visibility into cryptographic dependencies is an important foundation for future migrations.
Organizations should start preparing today. Harvest now, decrypt later already poses a risk to data that must remain protected over the long term, while complex IT and PKI environments require sufficient time for analysis, testing, and migration.
No. The transition will typically happen in phases. Business criticality, protection requirements, technical dependencies, and support for new algorithms determine which areas should be prioritized.
Crypto agility is an important part of post-quantum readiness. It enables cryptographic algorithms to be adapted in a controlled manner as requirements change, reducing the effort required for future transitions.
essendi it combines PQC consulting with experience in PKI, Certificate Lifecycle Management, discovery, automation, and software development. This enables us to support not only planning and evaluation but also technical implementation activities.
