TL;DR: NIST has advanced another round of review for post-quantum digital signature algorithms, reinforcing that PQC migration is an operational problem as much as a cryptographic one, according to DigiCert. Enterprises will need crypto-agility, not just algorithm selection, to manage hybrid environments, certificate lifecycles, and changing standards over time.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on DigiCert's blog post: NIST's latest post-quantum signature review concludes that PQC readiness depends on crypto-agility across certificate and policy lifecycles.
Why it matters: It matters because IAM, PKI, and NHI teams will have to manage overlapping classical and post-quantum trust paths without relying on manual certificate processes that cannot keep pace.
Context
Post-quantum cryptography readiness is becoming a certificate lifecycle problem, not just a standards problem. As NIST advances additional digital signature candidates, organisations need to plan for crypto changes that affect issuance, renewal, revocation, and policy enforcement across distributed environments.
The practical issue is crypto-agility, meaning the ability to update cryptographic systems and certificates without redesigning the entire trust fabric. That requirement touches machine identities, hybrid infrastructure, and the governance processes that keep cryptographic change operationally safe.
Key questions
A: Security teams should start with discovery and inventory, because you cannot govern what you cannot see. Track every certificate that uses post-quantum or test algorithms, including non-standardized ones, and record the object identifier in certificate details. That gives administrators a reliable way to identify, classify, and plan for migration while standards and tooling continue to evolve.
Q: Why does post-quantum readiness depend on more than choosing a new algorithm?
A: Because the hard part is operational change at scale. Organisations must support overlapping algorithms, update certificates and protocols over time, and do so across environments that still depend on manual approvals or fragmented tooling. A strong algorithm does not help if the surrounding lifecycle cannot change safely.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up. Services fail when a certificate expires, teams lose visibility when ownership is fragmented, and outage response becomes reactive instead of governed. The result is avoidable downtime, repeated exceptions, and an estate that grows faster than the people managing it.
Q: Should organisations prioritise crypto-agility before final PQC standards are settled?
A: Yes. Waiting for complete standard stability delays the work that makes migration possible. Organisations can already improve inventory quality, centralise certificate control, and remove manual dependencies. That preparation reduces the risk that future algorithm changes will disrupt authentication, trust chains, or service availability.
Technical breakdown
Why PQC migration becomes a lifecycle problem
Post-quantum cryptography is not a one-time cutover. Organisations will likely run classical and post-quantum algorithms in parallel for years while standards, vendors, and implementation guidance continue to evolve. That creates a lifecycle burden across certificates, devices, authentication systems, and policy enforcement. The issue is not whether a strong algorithm exists in isolation, but whether the environment can absorb change repeatedly without service disruption. In practice, the weakest point is often the surrounding operational model, not the cryptographic primitive itself.
Practical implication: Treat PQC as a lifecycle transition exercise, not a single cryptographic replacement project.
What crypto-agility actually changes in PKI
Crypto-agility is the ability to adapt cryptographic systems, certificates, protocols, and policies inside an established management framework. That means the organisation can change algorithms, update trust chains, and adjust certificate policy without rebuilding every dependent process. It also means inventory, automation, and policy orchestration matter as much as the cryptographic standard itself. If certificate issuance or renewal depends on manual approval chains and fragmented tooling, the environment may be technically compliant but operationally brittle.
Practical implication: Map where certificate policy, issuance, renewal, and revocation still depend on manual intervention or disconnected tools.
Why certificate automation is a PQC readiness control
Certificate lifecycle automation is important because PQC increases operational churn, not just cryptographic complexity. Centralised management improves visibility across certificate inventories and supports issuance, renewal, revocation, and policy enforcement at scale. That matters when certificate volumes rise, renewal windows tighten, and infrastructure spans cloud, hybrid, and connected environments. The governance lesson is that automation is not a convenience layer. It is the control surface that determines whether cryptographic change can be executed consistently across the estate.
Practical implication: Use lifecycle automation to reduce certificate drift before post-quantum changes amplify it.
NHI Mgmt Group analysis
Crypto-agility is the governing assumption PQC exposes. Most certificate programmes were built on the idea that algorithm change is rare enough to manage as an exception. That assumption no longer holds when standards continue to move and hybrid cryptographic environments persist for years. The implication is that cryptographic governance must be designed for repeated adaptation, not one-time migration.
Certificate lifecycle maturity is now part of cryptographic resilience. Organisations that can inventory certificates, enforce policy centrally, and automate renewal are not just reducing toil. They are creating the operational preconditions for PQC migration to succeed without outages or inconsistent trust states. That makes lifecycle discipline a security control, not an administrative convenience.
Partial automation is not crypto-agility. Many environments automate issuance or renewal but still rely on manual approvals, disconnected tooling, or incomplete inventory visibility. That pattern breaks when algorithm transitions need to happen across many systems at once. The practitioner conclusion is that crypto-agility has to be measured at the control-plane level, not by whether one workflow is automated.
Machine identity growth is what makes PQC readiness an identity problem as well as a PKI problem. Certificates now extend across cloud, hybrid, and connected environments where machine identities outnumber human identities in operational volume. As those identities multiply, the ability to govern certificate change centrally becomes part of broader NHI lifecycle control. Teams should treat PQC readiness as an identity governance capability, not only a cryptography upgrade.
Cryptographic diversity is a risk-management choice, not just a standards preference. NIST’s continued evaluation of multiple signature families reflects a simple reality: no single algorithm family should be assumed to carry the whole future trust model. Diversity reduces systemic exposure if weaknesses emerge later. Practitioners should align their PKI roadmaps with that uncertainty instead of assuming a final standard ends the operational work.
What this signals
Crypto-agility is becoming a baseline control for certificate governance. Teams that still treat certificate renewal as an isolated administrative task will struggle when algorithm transitions arrive across cloud and hybrid estates. The practical shift is to govern cryptographic change as part of the identity lifecycle, not as an exception handled by specialists.
Hybrid cryptographic operation should be planned as the default transition state. Organisations will need to support classical and post-quantum algorithms in parallel while standards mature and vendors update products. That means readiness work should focus on visibility, policy orchestration, and lifecycle control rather than waiting for a final destination standard.
Certificate lifecycle automation is now an operational resilience issue. When renewal, revocation, and policy enforcement are spread across manual steps or disconnected tools, PQC change becomes fragile. A centralised control model gives practitioners the leverage needed to adapt without losing trust continuity.
For practitioners
- Inventory certificate dependencies across the estate Map where certificates, trust chains, and authentication systems depend on classical algorithms, including cloud, hybrid, and connected environments. Identify manual approval points and disconnected tooling that could slow algorithm change.
- Automate issuance, renewal, revocation, and policy enforcement Move lifecycle tasks into a centralised management model so cryptographic changes can be applied consistently across large certificate populations without brittle manual steps.
- Test hybrid cryptographic operation now Validate that applications and devices can support both classical and post-quantum cryptography during a prolonged transition period, not only at final cutover.
- Reduce approval and tooling fragmentation Remove workflow dependence on manual sign-off chains and scattered admin consoles where they block rapid policy updates across distributed environments.
Key takeaways
- Post-quantum readiness is not only a standards question. It depends on whether certificate and policy lifecycles can absorb repeated cryptographic change.
- Partial automation leaves the most important PQC work exposed to manual delay, inconsistent visibility, and fragmented enforcement.
- Organisations that centralise certificate governance now will be better positioned to migrate through hybrid cryptographic periods without destabilising trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-57 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Certificate and cryptographic lifecycles become the core risk during PQC transition. |
| NHI-06 — Insecure Cloud Deployment Configurations | Hybrid cloud environments complicate consistent certificate policy and lifecycle enforcement. | |
| Recommendation — Reduce long-lived certificate dependencies so cryptographic change can be executed without brittle renewal windows. Standardise certificate policy across cloud and hybrid environments to prevent drift during PQC migration. | ||
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | PQC readiness depends on lifecycle governance for cryptographic material and trust transitions. |
| Recommendation — Apply key management lifecycle controls to inventory, rotate, and retire cryptographic dependencies in a planned sequence. | ||
| NIST CSF 2.0 | PR.DS-10 — Cryptographic Protection | The article focuses on updating cryptographic protections as standards evolve. |
| Recommendation — Align cryptographic protection controls with migration planning so algorithms can change without service disruption. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | Certificate misuse and weak lifecycle control increase exposure to credential theft and downstream misuse. |
| Recommendation — Map exposed certificate paths to credential access and reduce opportunities for trust abuse. | ||
Key terms
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Hybrid cryptographic environment: A hybrid cryptographic environment is a trust model in which classical and post-quantum algorithms operate side by side during migration. That state is often unavoidable, so organisations need controls that keep both paths visible and governable at the same time.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org