The PKI Consortium’s PKI maturity model adds cryptographic governance and PQC readiness

The PKI Consortium, the association of organisations from the public key infrastructure (PKI) sector, published version 2.0.0 of its PKI maturity model (PKIMM) on 29 September. It is the first new version since 1.0.0, released in August 2023. The model is open and vendor-neutral, and it helps any organisation that operates a PKI see where it stands and what it should improve.

The structure stays the same: five maturity levels applied to 16 categories, grouped into four modules, with 77 requirements in total. What changes matters to anyone preparing the migration to post-quantum cryptography (PQC).

Cryptography gets its own category

In version 1.0.0, the requirements on algorithms were spread across key management and certificate management, as cipher suite requirements. Version 2.0.0 replaces them with a new category, Cryptography, within the governance module, with six requirements:

• a common cryptographic vocabulary, used consistently in policies, standards and procedures;
• approved, restricted and prohibited algorithms and parameters;
• approved, deprecated and prohibited protocols and versions, with formally approved exceptions;
• visibility of where algorithms, keys, certificates and protocols are used, starting with critical systems;
• rules for approving, retiring and replacing cryptography before it becomes a risk;
• crypto-agility: governance and planning to respond in a controlled way to a compromised algorithm, a deprecation or a regulatory change.

The category separates the what from the how: it defines which cryptography is allowed and why, not how keys or certificates are managed technically. At the lowest level, each team or product chooses its own algorithms without central guidance; at the intermediate level, the organisation documents its approved algorithms, parameters and protocols and knows where they are used in its critical systems. According to the consortium, these requirements lay the groundwork for the move to PQC.

Inventory, validation and a post-quantum extension

• Certificate validation. A new requirement asks for the rules that systems use to check certificates to be documented, implemented and verified, including what happens when a certificate’s revocation status cannot be determined.
• Inventory. It now includes the trust anchors the organisation has approved, not just the certificates it issues, and certificate discovery covers the trust stores of systems and devices. This makes the requirement relevant to organisations that use certificates without issuing them.
• Extensions. These are optional layers that add criteria or change weightings for a particular risk profile or sector, without touching the base model or its scoring. The first is the PQC readiness extension, by Kennedy Nwup (Afield AB), vice-chair of the working group.

The PQC extension has a complete governance module, with criteria for all five levels, guidance for assessors, examples of evidence and 25 regulatory and standards references. The management module is under review, and the operations and resources modules are only outlined. Its current version is 0.6.0; it will move to 1.0.0 once all modules are complete and the working group has approved them.