Jelizaveta Vakarjuk

— On the schedule —

Lessons Learned from Constructing Estonia’s PQC Migration Roadmap

National-scale PQC migration is not only a cryptographic challenge, but also an organisational and governance one. While technical guidance is essential, it is unrealistic to provide detailed, system-specific migration instructions to every public-sector organisation, critical infrastructure entity, and supplier-dependent environment. Estonia’s PQC migration roadmap addresses this by introducing a scalable approach: categorising organisations by risk and priority, defining actionable migration steps, and establishing mechanisms to track whether those steps are actually carried out. This session will share lessons learned from constructing Estonia’s PQC migration roadmap, including the practical constraints, trade-offs, and blind spots that shaped its design. We will discuss why risk-based categorisation is necessary, how were the broad PQC goals translated into concrete actions for the PQC migration team, and how reporting and monitoring can be used to encourage actual execution rather than one-time planning. Attendees will learn how to think about PQC migration at national or large-organisational scale, how to design roadmap actions that are usable across diverse environments, and how governance mechanisms can help turn recommendations into measurable progress, as well as what challenges to expect when writing a PQC migration roadmap.