News · 24 August 2026
Mapping the PQC Maturity Model onto the eIDAS/ETSI normative base
Tyche Institute is preparing a crosswalk between the Post-Quantum Cryptography Maturity Model (PQCMM) of the PKI Consortium and the normative base that European Union trust service providers are actually audited against. The working draft (v0.4, August 2026) maps each PQCMM maturity level onto the clauses of ETSI EN 319 401, EN 319 411-1, and the EN 319 403-1 conformity-assessment cycle, together with the ETSI algorithm catalogue TS 119 312, the preservation and hybrid key-establishment specifications TS 119 511 and TS 103 744, the CEN EN 419 221-5 protection profile, and the seam between eIDAS and NIS2 obligations.
The motivation is a translation gap. Maturity models speak the language of organisational readiness; qualified trust services answer to auditors in clause numbers. A crosswalk lets a trust service provider read its post-quantum readiness in the vocabulary its conformity assessment body already uses — and lets an auditor see where a maturity claim does, or does not, have a normative anchor.
The timing is not speculative. As late as version 1.5.1 of TS 119 312 (December 2024), the ETSI algorithm catalogue contained no post-quantum algorithms; version 2.1.1 (June 2026) introduces ML-DSA and SLH-DSA and completes the move to the ECCG agreed mechanisms, while EN 319 401 version 3.2.1 (January 2026) carries forward the supply-chain clause introduced in version 3.1.1. The normative ground under EU trust services shifted to post-quantum in the first half of 2026, and the crosswalk records where each maturity level now lands on it.
The draft went to the PKI Consortium's Post-Quantum Cryptography Working Group on 24 August 2026, taking up a follow-on thread that the working group has had open for the maturity model since May. That group's list is members-only, so there is no public thread to point to here; the crosswalk itself will be published on this page in the revision that follows the group's response.
The PQC Maturity Model is the work of the PKI Consortium. Nothing on this page is a PKI Consortium publication or position, and the crosswalk is an independent Tyche Institute working document until and unless the working group takes it up.