PQEaaS Service

Consultant Delivery Playbook

Reference workflow for GCTI staff delivering PQC assessments, evidence packages, client objections handling, and enterprise escalation.

PQE Operations

Compliance Audits

Audit Logs

Run a client PQC assessment

1. Use PQEOperation to document handshake, key exchange, or signature workflows that must migrate.

2. Record risk and readiness findings in ComplianceAudit with audit_type set to full_compliance or transparency_check.

3. Capture security level selection, workload criticality, and hybrid-mode rationale in the audit findings array.

4. Translate the audit into a Tier 1 or Tier 2 scope recommendation for the client.

Generate audit evidence package

1. Confirm PQEAuditLog contains the onboarding, connection, and monitoring trail.

2. Pull supporting PQEOperation records for handshake success, security level, and algorithm mapping.

3. Create the final ComplianceAudit record with FIPS 203/204/205 and CNSA 2.0 findings.

4. Deliver the package summary with migration status, hybrid deployment note, and open remediation items.

Common client objections

Cost

Position hybrid deployment as a phased control that reduces rework later. Start with high-value systems and show the gap report as the decision anchor.

Timeline

Use the assessment to separate quick wins from deep modernization. Lead with Tier 1 evidence, then sequence implementation by client risk and certificate renewal windows.

Vendor readiness

Document where the client can move now with hybrid mode and where vendors remain on the roadmap. Emphasize interoperability planning instead of all-at-once replacement.

Recent compliance activity

No compliance audits recorded yet.

Escalation path

Escalate enterprise and government PQEaaS opportunities to Todd Price when the client requires sovereign hosting, agency-specific procurement alignment, classified workload planning, or executive sponsorship for hybrid migration decisions.

Consultant note

Lead every discussion with the cryptographic posture gap, then translate that into a service tier recommendation and delivery evidence package. This keeps the conversation grounded in measurable readiness rather than abstract quantum risk.