Training Course Professional

PQC Migration for SCADA and OT Networks

Planning and executing PQC migration for energy sector SCADA, OT, and industrial control systems.

Full day (6 hours)
Certificate on completion
Enquire About This Course View Curriculum

Proud to recommend our expert members

Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence
Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence

Course Overview

For OT security engineers, SCADA architects, and energy infrastructure teams. Covers protocol-specific PQC migration for DNP3, IEC 61850 GOOSE/MMS, Modbus/TCP, and OPC UA. Addresses constrained device migration (RTUs, PLCs, IEDs), IEC 62351 and NERC CIP compliance, NIST FIPS 203/204/205/206 algorithm selection, and supply chain vendor readiness.

Curriculum

Course content is structured into sessions below. Each session is configurable to your organisation's environment, threat model, and objectives.

# Session Topics
1 OT Protocol Cryptographic Exposure Where quantum threats intersect SCADA, DCS, and ICS architectures
2 Protocol-Specific Vulnerability Analysis Cryptographic dependencies in energy OT communication stacks
  • DNP3 Secure Authentication (SA v5/v6): RSA and HMAC-SHA dependencies, quantum exposure timeline, and ML-DSA replacement path
  • IEC 61850 GOOSE/MMS: TLS 1.2/1.3 in MMS, multicast authentication gaps in GOOSE, and constrained latency budgets for PQC key exchange
  • Modbus/TCP and OPC UA: unencrypted legacy exposure, OPC UA certificate chain migration to ML-DSA/ML-KEM, and backward compatibility constraints
Break
3 Standards, Regulation, and Compliance Mapping IEC 62351, NERC CIP, and NIST PQC standards for energy OT
  • IEC 62351 Parts 3-6: TLS for MMS (Part 3), GOOSE/SV authentication (Part 6), and where PQC algorithms slot into the standard
  • NERC CIP-005/CIP-007/CIP-013: electronic security perimeter, system hardening, and supply chain risk management obligations for PQC migration
  • NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), draft FIPS 206 (FN-DSA): selection criteria for constrained OT devices
4 Interactive Demonstration: OT Cryptographic Inventory Full-day format only
  • Facilitator-led walkthrough: building a cryptographic inventory for a representative SCADA/DCS architecture (RTUs, PLCs, IEDs, engineering workstations, historian servers)
  • Mapping protocol-level cryptographic dependencies to NIST FIPS algorithm replacements: which OT endpoints can support ML-KEM/ML-DSA key sizes and which require hybrid or gateway-based migration
  • Delegates discuss: migration sequencing under operational constraints (planned outage windows, safety system isolation, vendor firmware dependencies)
Break
5 Constrained Device Migration Strategy PQC for RTUs, PLCs, and field devices with limited compute
  • ML-KEM key encapsulation on constrained hardware: memory footprint (1,568-byte ciphertext for ML-KEM-768) and CPU cycle requirements for ARM Cortex-M class processors
  • Hybrid classical-PQC schemes for transition periods: X25519+ML-KEM composite key exchange for OT gateways, phased rollout without full protocol stack replacement
  • Gateway-based migration architecture: PQC termination at substation gateways with classical protocol preservation for legacy field devices beyond firmware upgrade
6 Supply Chain and Vendor Readiness Assessing OT vendor PQC roadmaps and procurement strategy
  • Vendor readiness assessment framework: evaluating SCADA/DCS/EMS vendor PQC roadmaps (ABB, Siemens, GE Vernova, Schneider Electric, Honeywell)
  • NERC CIP-013 supply chain obligations: incorporating PQC requirements into vendor procurement specifications and firmware update contracts
  • CBOM (Cryptographic Bill of Materials): building and maintaining a machine-readable inventory of cryptographic dependencies across the OT estate
7 Q&A and Migration Roadmap Planning

Designed and Delivered By

Training courses are designed and delivered by QSECDEF in collaboration with subject specialists. All instructors have direct experience in quantum technologies and security.

QD

Quantum Security Defence

Course design and delivery

QSECDEF brings expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our membership spans 900+ organisations and 1,500+ professionals working at the intersection of quantum technologies and critical infrastructure security.

Enquire About This Course

Get in touch to discuss scheduling, group pricing, and how this course can be configured to your organisation's needs.

Contact Us
Training Courses Consulting Services Training