Two Metrics That Matter: Measuring PQC Readiness
This is the fifth and final post in a series based on my PA TechCon 2026 talk. The previous posts covered the threat model, procurement, and the local government gap. This one is about how you know whether any of it is working. The Dashboard Problem Every PQC migration plan I have reviewed includes a reporting section. Most of them propose a dashboard with fifteen to thirty metrics: certificate inventory completion percentage, vendor compliance attestation counts, HSM firmware versions, policy document status, training completion rates, risk assessment coverage, and a constellation of RAG indicators that someone updates monthly in a spreadsheet they email to a distribution list nobody reads. ...