Training Course Professional

PQC Migration for Cloud Key Management Services and HSM Infrastructure

Planning and executing PQC migration for cloud KMS, HSM integrations, and key lifecycle management.

Full day (6 hours)
Certificate on completion
Enquire About This Course View Curriculum

Proud to recommend our expert members

Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence
Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence

Course Overview

Technical workshop for cloud security architects and key management engineers. Covers PQC migration for AWS KMS, Azure Key Vault, GCP Cloud KMS, and on-premises HSMs (Thales Luna, Utimaco, Entrust nShield). Addresses PKCS#11 v3.1 PQC extensions, KMIP interoperability, key hierarchy migration sequencing, FIPS 140-3 revalidation, and hybrid key encapsulation during transition.

Curriculum

Course content is structured into sessions below. Each session is configurable to your organisation's environment, threat model, and objectives.

# Session Topics
1 The Quantum Threat to Key Management Why KMS and HSM infrastructure is the highest-priority PQC migration target
2 Cloud KMS PQC Readiness Assessment Current PQC support across major cloud providers
  • AWS KMS: ML-KEM key agreement support, hybrid key policies, and CloudHSM firmware roadmap
  • Azure Key Vault: PQC algorithm availability, Managed HSM migration constraints, and Azure Confidential Ledger implications
  • GCP Cloud KMS: Software and HSM-backed key PQC support, External Key Manager (EKM) compatibility
Break
3 On-Premises HSM Migration PKCS#11 PQC extensions, KMIP protocol support, and firmware upgrade paths
  • PKCS#11 v3.1 PQC mechanism identifiers: CKM_ML_KEM and CKM_ML_DSA key generation and operations
  • KMIP v2.1 PQC object types and key wrapping interoperability
  • HSM vendor PQC readiness: Thales Luna 7 firmware, Utimaco SecurityServer, Entrust nShield, Marvell LiquidSecurity
  • FIPS 140-3 revalidation implications for PQC firmware updates
4 Key Hierarchy Migration Sequencing Migrating root keys, key-encrypting keys, and data-encrypting keys without service disruption
  • Three-tier key hierarchy: which layer to migrate first and why root key migration is the constraint
  • Hybrid key encapsulation: running ML-KEM alongside ECDH during transition periods
  • Key rotation strategies: in-place rotation versus re-encryption with new key material
  • Cross-region and multi-cloud key synchronisation during migration
Break
5 Compliance and Standards Framework Regulatory requirements driving KMS/HSM PQC migration timelines
  • NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA): standard finalisation and implementation timelines
  • NIST SP 800-57 key management recommendations and PQC alignment
  • FIPS 140-3 validation process for PQC-capable HSM firmware
  • CNSA 2.0 (NSA), ANSSI, BSI, and UK NCSC guidance on KMS migration deadlines
6 Migration Planning Workshop Building your KMS/HSM PQC migration roadmap
  • Cryptographic inventory: cataloguing key types, algorithms, and dependencies across cloud and on-premises KMS
  • Risk-based prioritisation: which key hierarchies face harvest-now-decrypt-later exposure
  • Vendor engagement checklist: questions to ask cloud providers and HSM vendors about PQC readiness
7 Q&A and Action Planning

Designed and Delivered By

Training courses are designed and delivered by QSECDEF in collaboration with subject specialists. All instructors have direct experience in quantum technologies and security.

QD

Quantum Security Defence

Course design and delivery

QSECDEF brings expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our membership spans 900+ organisations and 1,500+ professionals working at the intersection of quantum technologies and critical infrastructure security.

Enquire About This Course

Get in touch to discuss scheduling, group pricing, and how this course can be configured to your organisation's needs.

Contact Us
Training Courses Consulting Services Training