About the PQC Migration Framework
The Applied Quantum PQC Migration Framework is an open-access, practitioner-grounded methodology for planning and executing enterprise-wide post-quantum cryptography migration. It was developed by Marin Ivezic and published by Applied Quantum. Version 3.0 published in September 2026. The framework is free and ungated under CC BY 4.0. There is no email wall.
It was built from direct experience leading real PQC migration programs, including programs exceeding 120,000 tasks in a single enterprise’s integrated master schedule. Roughly 30,000 of those were direct cryptographic upgrade tasks, each addressing buckets of cryptographic functions numbering in the millions. The rest was enterprise enablement work: governance, vendor engagement, training, policy, infrastructure modernization, testing, and operational integration. The ratio is three enablement tasks for every direct cryptographic upgrade.
The framework defines eight phases, from securing executive mandate through vendor and supply chain governance, and ends with a verification and closure protocol. Seven program foundations apply across every phase: the maturity model, metrics and reporting, crypto-agility, regulatory alignment, skills and team structure, SOC implementation, and GRC implementation. SOC implementation covers detection, incident response and quantum CTI. GRC implementation covers cascading KRIs, risk appetite, regulatory intelligence and audit.
Six sector extensions adapt the methodology for financial services, payments, telecommunications, OT and critical infrastructure, government & defense, and digital assets. Each one publishes at the same version as the Universal edition.
Marin Ivezic
Marin Ivezic is the founder and CEO of Applied Quantum, founder of Quantum Academy, and author of PostQuantum.com. He brings over thirty years of experience at the intersection of cybersecurity, cryptography, and enterprise risk, and over twenty-five years of involvement with quantum technologies.
A former Fortune Global 500 CISO and CTO, Marin has held regional and global leadership positions at IBM, Accenture, PwC, and KPMG. His classical cryptography career spans more than two decades of cryptographic upgrade programs across some of the world’s largest enterprises. His post-quantum work began over a decade ago, advising governments on quantum threats and leading PQC readiness programs with 120,000+ tasks for organizations across financial services, telecommunications, and critical infrastructure.
Marin is the author of Quantum Ready, the practitioner’s guide to PQC migration built on this framework; Quantum Sovereignty, on strategic leadership and geopolitics in the quantum era; and Quantum Systems Integration. He is completing a PhD in Quantum Computing.
Applied Quantum
A research-driven quantum systems integration and consulting firm, focused entirely on quantum technologies and post-quantum security. An EU firm operating globally, with a quantum lab in Delft. Clients are in financial services, payments, government & defense, telecommunications, critical infrastructure, healthcare and pharma, and digital assets.
Secure Quantum
Applied Quantum’s dedicated quantum security arm. It delivers PQC migration programs, quantum risk assessments, SOC and GRC integration for quantum threats, and crypto-agility implementation.
PostQuantum.com
Marin’s personal blog on quantum security, with over one million monthly readers. Practitioner-grounded analysis aimed at CISOs, CTOs, security architects, and technology leaders. Every aspect of this framework has been analyzed in depth there over the past decade.
Quantum Academy
Founded by Marin Ivezic. Live and online trainings and certifications on the topics this framework covers, for the roles and training levels described in its Skills & Team Structure section.
PQCFramework.org
This site, the dedicated companion for the framework, providing direct access to the framework documents, sector extensions, landscape research, and supporting materials.
CBOMProfile.org
The Applied Quantum CBOM Profile, a property taxonomy layered on CycloneDX. Phase 2 of this framework cites it by minimum version as optional machine-readable carriage. By Steve Vaile and Marin Ivezic, open under CC BY 4.0.
CCFramework.org
The Cryptographic Concentration Framework, a second-line risk instrument measuring cryptographic concentration beneath the vendor layer. Phases 3 and 7 of this framework cross-reference it; no document in the set recomputes a concentration figure. By Steve Vaile and Marin Ivezic, open under CC BY 4.0.
The PQC Migration Brief
A practitioner newsletter tracking regulatory developments, cryptographic research, and vendor readiness changes that affect PQC migration programs. Every issue applies one editorial filter: does this development change how organizations plan, execute, or govern their migration? Subscribing is optional; the framework asks for no email address.