PQC transition coordination for shared services
Post-quantum migration of a shared service needs every party in the chain: your own organisation, suppliers, counterparties, certificate authorities and network providers. Pick a reference service and, if you wish, the product release of each component to see what the reviewed evidence says, what blocks what, who must act and a shared action plan you can print or export.
A product that supports a post-quantum algorithm does not mean the service can migrate: every party must configure, test and agree it, and the fallback must be retired. The reference services are illustrative templates, not real estates, not an agreed plan and not a coordination body. Not compliance advice.
Choose a reference service
SSH administration of servers, partly by an outsourced operator
Illustrative template Administrators of the organisation and of an outsourced operator reach managed servers through a bastion host run by the operator. Each SSH hop negotiates its own key exchange.
Parties involved: Own organisation, Supplier or vendor, All parties of the service jointly
Limitations: A generic template. Only key exchange is covered; no requirement source for post-quantum SSH host or user keys is recorded in this pilot.
0 of 4 components have approved evidence that the chosen release is generally available.
The service is not shown as migrated or ready: even with every component available, the parties still have to agree the configuration, test the whole chain together, pilot, roll out, validate and retire the fallback.
Product releases, optional
Choose the release you run for each component, from the products of the PQC navigator. Readiness is read from the assertions an editor approved for that release; leave a component on Not chosen if you do not know.
Component chain and readiness
Components are listed with the ones they depend on first. A component is blocked while anything it depends on, directly or further up the chain, is not available. Components without dependencies can start in parallel.
| Component | Controlled by | Chosen release | Readiness | Depends on | Blocked by | Evidence and note |
|---|---|---|---|---|---|---|
| Administrators' SSH clients | Own organisation | Not chosen | No product release chosen | Nothing | Nothing | Workstations of the organisation's own administrators. |
| Bastion host run by the outsourced operator | Supplier or vendor | Not chosen | No product release chosen | Nothing | Nothing | Every administrator connection passes through it. |
| SSH servers on the managed hosts | Own organisation | Not chosen | No product release chosen | Nothing | Nothing | The operating system release usually decides the OpenSSH version. |
| Agreed key exchange methods on each hop | All parties of the service jointly | Not chosen | No agreement recorded between the parties | Administrators' SSH clients; Bastion host run by the outsourced operator; SSH servers on the managed hosts | Administrators' SSH clients; Bastion host run by the outsourced operator; SSH servers on the managed hosts | The organisation and the operator agree which methods are offered and whether classical-only fallback stays. |
Bottlenecks (not available, and other components wait for them)
- Administrators' SSH clients: blocks 1 other components
- Bastion host run by the outsourced operator: blocks 1 other components
- SSH servers on the managed hosts: blocks 1 other components
Can start in parallel (no dependencies)
Administrators' SSH clients; Bastion host run by the outsourced operator; SSH servers on the managed hosts
Readiness, in words
- Available in the chosen release (approved evidence)
- Preview only in the chosen release
- Announced roadmap only, no release
- Explicitly unsupported for this function
- No verified information for the chosen release
- No product release chosen
- Not covered by the product navigator
- No agreement recorded between the parties
Protocol and standard requirements
The specifications each component has to follow, with their status on the day they were read. An Internet-Draft is work in progress, not a standard.
- RFC 10042: Post-Quantum/Traditional Hybrid Key Exchange with ML-KEM for Use in SSH
Defines hybrid ML-KEM key exchange methods for SSH, including mlkem768x25519-sha256. Informational, not a standards-track specification.
Interoperability evidence
Published test results with their exact scope. A passed test applies only to what was tested; it is not a certification and does not show that a service or an organisation is ready.
No interoperability evidence recorded for this service.
EU coordinated roadmap milestones
Target dates as the PQC migration timeline records them from their sources. They are authority guidance targets: not legal deadlines and not dates agreed between the parties of this service.
- : EU roadmap milestone 1: first steps and national roadmaps
By the end of 2026 all Member States should have implemented at least the roadmap's first steps, established initial national transition roadmaps and started planning and pilots for high- and medium-risk use cases. - : EU roadmap milestone 2: high-risk use cases migrated
By the end of 2030 the roadmap's next steps should be implemented, high-risk use cases moved to post-quantum cryptography, planning and pilots for medium-risk use cases completed and quantum-safe software and firmware upgrades enabled by default.
What the PQC guide lists for this kind of service
Shared action plan
One action per component for the party that controls it, then the steps all parties take together. Dates are unknown unless a supplier published one; no date here is agreed. To print, use your browser’s print command: the page prints without menus.
Own organisation
| Checkpoint | Action | Component | State | Waits for | Date |
|---|---|---|---|---|---|
| Inventory and scope confirmed | Identify the product and release used for Administrators' SSH clients and record it. | Administrators' SSH clients | Can start now | Nothing | Unknown: no date published or agreed |
| Inventory and scope confirmed | Identify the product and release used for SSH servers on the managed hosts and record it. | SSH servers on the managed hosts | Can start now | Nothing | Unknown: no date published or agreed |
Supplier or vendor
| Checkpoint | Action | Component | State | Waits for | Date |
|---|---|---|---|---|---|
| Inventory and scope confirmed | Identify the product and release used for Bastion host run by the outsourced operator and record it. | Bastion host run by the outsourced operator | Can start now | Nothing | Unknown: no date published or agreed |
All parties of the service jointly
| Checkpoint | Action | Component | State | Waits for | Date |
|---|---|---|---|---|---|
| Compatible configuration agreed | Agree Agreed key exchange methods on each hop between the parties concerned and record who agreed and when. | Agreed key exchange methods on each hop | Waiting for the items listed | Administrators' SSH clients; Bastion host run by the outsourced operator; SSH servers on the managed hosts | Unknown: no date published or agreed |
| Interoperability test | Run a joint interoperability test of the whole chain in a test environment and record its scope and result. | Whole service | Waiting for the items listed | Administrators' SSH clients; Bastion host run by the outsourced operator; SSH servers on the managed hosts; Agreed key exchange methods on each hop | Unknown: no date published or agreed |
| Pilot | Pilot the service with a limited group, keeping the classical fallback. | Whole service | Waiting for the items listed | Interoperability test | Unknown: no date published or agreed |
| Staged rollout | Roll out in stages agreed by every party. | Whole service | Waiting for the items listed | Pilot | Unknown: no date published or agreed |
| Validation | Validate that the post-quantum mechanisms are actually negotiated or verified on every hop. | Whole service | Waiting for the items listed | Staged rollout | Unknown: no date published or agreed |
| Retirement of the legacy fallback, when authorised | Retire the classical-only fallback only when every party has authorised it. | Whole service | Waiting for the items listed | Validation | Unknown: no date published or agreed |
Download the action plan as CSV · Download the chain and the plan as JSON
PQC product navigator: readiness evidence by product release · PQC guide: what the rules say · PQC milestones and deadlines · EU legal acts on quantum · Document library
Illustrative reference services for coordinating a post-quantum migration across organisations (#471, first pilot). Each service is a generic chain of components with the role that controls each one; product readiness comes only from the editor-approved assertions of the PQC product navigator, never from this file. Requirement and interoperability sources were read on 23 October 2026 on the publishers' own pages; summaries are the portal's own words. Not a coordination body, not an agreed plan, not compliance advice. Reference services compiled 2026-10-23.