Post-quantum cryptography · Template

PQC Migration RACI Template

Who is Responsible, Accountable, Consulted and Informed for the move to post-quantum cryptography, from naming a migration lead and building the CBOM to migrating key exchange, certificates and code signing. 10 roles, 36 activities with guidance, org-size presets, role workload and a check that every activity has exactly one Accountable role.

Template & sample only — a structured starting point with sample content for a fictional organisation, not legal, audit or compliance advice.

Preview · sample data

RACI preview: governance, discovery and planning

R = Responsible, A = Accountable, C = Consulted, I = Informed. The full template has 36 activities across 8 phases, with guidance, role holders, workload and checks.

Phase	Activity	Exec	CISO	Lead	EA	PKI	Apps	Net	Proc	Risk	Audit
Governance and strategy	Name the PQC migration lead and give them authority	A	R	I	-	-	-	-	-	C	I
Governance and strategy	Approve PQC migration scope and objectives	A	C	R	C	-	-	-	-	C	I
Governance and strategy	Decide which deadlines apply to the organisation	I	A	C	-	-	-	-	C	R	I
Governance and strategy	Set the cryptography policy and approved-algorithm standard	-	A	C	R	C	I	I	-	C	-
Governance and strategy	Fund the programme and approve the budget	A	C	R	-	-	-	-	C	I	-
Discovery and inventory	Run cryptographic discovery: SBOM analysis, code scanning and network scanning	-	I	A	R	-	C	C	-	-	-
Discovery and inventory	Maintain the central CBOM (CycloneDX 1.7)	-	I	A	R	C	C	C	-	-	I
Discovery and inventory	Record per-system inventory fields for each application	-	-	C	C	-	A/R	-	-	I	-
Discovery and inventory	Inventory certificates, keys, HSMs and code-signing keys	-	I	A	-	R	C	C	-	-	-
Discovery and inventory	Inventory network protocols: TLS versions, VPN, SSH	-	I	A	C	-	-	R	-	-	-
Discovery and inventory	Collect PQC roadmaps from critical vendors	-	I	A	C	-	C	-	R	I	-
Prioritise and plan	Rate data secrecy lifetime and harvest-now-decrypt-later exposure	-	I	C	C	-	R	-	-	A	-

24 more rows in the full template. Customise it with your organisation’s details and download it as Word, PDF, Markdown or CSV with Pro.

Template and sample only. A structured starting point with sample assignments, not legal, audit, certification or professional advice. Change every assignment to fit your organisation.You are looking at the sample. Edit anything: your copy is saved in this browser only.

A RACI matrix for migrating to post-quantum cryptography, organised along OMB M-26-15's phases: governance, discovery and CBOM, prioritisation and planning, pilots, key establishment migration, signature migration, full migration and assurance. Ten roles from the board to internal audit, org-size presets, role workload and automatic checks that each activity has exactly one Accountable role and someone Responsible. The sample is a fictional insurer.

More formats:

The document carries the full matrix, role holders, per-activity guidance, workload and open checks for the 10 roles currently in your matrix.

Organisation size

Smaller organisations do not have every role. A preset keeps the roles that exist at that size and merges each missing role into the nearest one, so its work lands on a real person.

Every role in the matrix is a distinct person or function.

Activities

8 phases, 10 roles

Exactly one Accountable

36 of 36

Every activity has one owner

Someone Responsible

36 of 36

Every activity has an R

Too many consulted

Activities with more than 5 C

Independence

Audit holding A or R outside assurance work

Search activities and guidancePhase or clauseRoleRole involvement

Only activities that fail a checkShowing 36 of 36

Click a cell to cycle R, A, A/R, C, I; or focus it and press a r b (both) c i -, arrows to move. Open the chevron on a row for what it means, evidence, frequency and pitfalls. R = Responsible (does the work). A = Accountable (owns the outcome and signs it off; exactly one per activity). A/R = accountable and does the work. C = Consulted before the decision (two-way). I = Informed after it (one-way). "-" = not involved.

Activity	Exec	CISO	Lead	EA	PKI	Apps	Net	Proc	Risk	Audit	Owner (A)
Governance and strategy5 activities Name the owners, set scope and decide which deadlines apply.
Name the PQC migration lead and give them authority											Exec
Approve PQC migration scope and objectives											Exec
Decide which deadlines apply to the organisation											CISO
Set the cryptography policy and approved-algorithm standard											CISO
Fund the programme and approve the budget											Exec
Discovery and inventory6 activities Find every use of cryptography and record it in one CBOM (M-26-15 phase 1).
Run cryptographic discovery: SBOM analysis, code scanning and network scanning											Lead
Maintain the central CBOM (CycloneDX 1.7)											Lead
Record per-system inventory fields for each application											Apps
Inventory certificates, keys, HSMs and code-signing keys											Lead
Inventory network protocols: TLS versions, VPN, SSH											Lead
Collect PQC roadmaps from critical vendors											Lead
Prioritise and plan5 activities Rank systems by exposure and write the migration plan (M-26-15 phase 1).
Rate data secrecy lifetime and harvest-now-decrypt-later exposure											Risk
Prioritise systems for migration											Lead
Identify systems that cannot support PQC and decide replace or decommission											Exec
Write and approve the PQC migration plan											Exec
Add PQC requirements to procurement and contracts											CISO
Pilots and early migration5 activities Test PQC and hybrid options before rolling them out (M-26-15 phase 2).
Pilot hybrid TLS key exchange (X25519MLKEM768, RFC 10024)											EA
Decide where hybrid mode is used and for how long											CISO
Build and test a PQC test PKI (ML-DSA)											EA
Set the crypto-agility design standard											CISO
Plan TLS 1.3 support across the estate											Lead
Key establishment migration5 activities Move key exchange to ML-KEM or hybrid on priority systems first (M-26-15 phase 3).
Migrate key establishment on priority applications to ML-KEM or hybrid											Apps
Migrate TLS termination, VPN and SSH key exchange											Lead
Re-wrap stored data keys protected by RSA or ECDH key transport											Apps
Replace or decommission systems that cannot support PQC											Exec
Track exceptions and residual quantum risk											CISO
Signature migration4 activities Move certificates, code signing and token signing to PQC (M-26-15 phase 4).
Build the PQC certificate hierarchy											CISO
Migrate code and firmware signing											CISO
Migrate token and document signing											Apps
Plan verification of legacy classical signatures											Lead
Full migration and legacy3 activities Finish the remaining systems before the IR 8547 "disallowed after 2035" line (M-26-15 phase 5).
Migrate the remaining lower-risk systems											Lead
Move hybrid configurations to PQC only where planned											CISO
Retire classical-only configurations											Lead
Assurance and review3 activities Independent checks, management review and keeping this RACI current.
Independently check that the CBOM matches what runs in production											Audit
Report migration progress to the board											Exec
Review this RACI and the role holders											CISO

Add your own phase

Loading…

TL;DR

What this template gives you

5 points

A RACI answers one question per activity: who does it, who owns the outcome, who is asked first and who is told after.
10 roles: board / executive sponsor, CISO, PQC migration lead, enterprise architecture, PKI / certificate owner, application owners, network / infrastructure, procurement / vendor management, risk / compliance and internal audit.
36 activities across 8 phases that follow OMB M-26-15: discovery and CBOM, prioritisation, pilots, key establishment, signatures and full migration, with governance first and assurance last.
Every activity carries what it means, the evidence to keep, how often it recurs and the pitfall that usually breaks it.
Exactly one Accountable per row. The checks flag rows with no A or more than one, rows with no R, too many Consulted roles and internal audit owning work it should audit.

Frequently asked questions

Do we have to name a PQC migration lead?

US federal agencies do: EO 14412 (June 2026) requires a PQC migration lead within 30 days, and OMB M-23-02 already asked for a cryptographic inventory and migration lead. Nobody else is required to, but a migration with no single owner tends to stall between the security, architecture and application teams.

Why exactly one Accountable per activity?

If two roles are accountable, neither is. One Accountable role owns the outcome and signs it off; any number of roles can be Responsible for doing the work. Use A/R where the accountable role also does the work, as application owners do for migrating their own systems.

Who should be accountable for the PQC migration overall?

In the sample the executive sponsor is accountable for scope, budget, the plan and replace-or-decommission decisions; the CISO for policy, the PKI and signatures; the migration lead for discovery, the CBOM and network migration; and application owners for their own systems. Change it to match how your organisation decides.

Where does procurement fit?

Procurement is Responsible for collecting vendor PQC roadmaps and for the contract clause. CISA's product categories list (January 2026) says that where PQC-capable products are widely available in a category, organisations should plan to buy only PQC-capable products from it.

Why is internal audit almost never Responsible?

Internal audit has to stay independent of the work it checks. In the sample it owns only the independent check that the CBOM matches what runs in production; everywhere else it is Consulted or Informed, and the checks flag any other A or R.

Is this a finished document I can rely on?

No. It is a template with sample content for a fictional organisation. It gives you a structured, editable starting point, but it is not legal, audit, compliance or professional advice. Check every date and requirement against the primary source for your sector before you rely on it.

Who can use it?

The page and sample are public. Customising the template is Pro; a free account gets 3 runs in total, shared across every Pro tool, and the generated document is free to view on the page. Download is Pro: downloading or copying the document (Word, PDF, Markdown, CSV) is never part of the free runs. Pro is $5/month or $40/year. Your work is saved in your own browser.

PQC toolkit

The other tools in the post-quantum cryptography program.

More security tools

The tools people use most on PlayCISO.

All tools

Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.