The EU Just Released a New Post-Quantum Cryptography (PQC) Roadmap: Here’s What You Need to Know

The EU Just Released a New Post-Quantum Cryptography (PQC) Roadmap: Here’s What You Need to Know

On June 23, 2025, The EU released a new PQC implementation roadmap with clear steps and timelines for all Member States, laying the groundwork for a smooth and coordinated transition to post-quantum cryptography.

Imagine knowing a storm is coming but not precisely when, how strong, or where it will hit first. That’s where cybersecurity stands today with quantum computing. The threat is real, the timeline unclear, and organizations everywhere are looking for direction.

Now, the EU has stepped in with a first high-level implementation roadmap to guide the transition to post-quantum cryptography (PQC).

Developed by the NIS Cooperation Group’s PQC workstream, this roadmap provides long-awaited clarity on what Member States need to do and when to ensure PQC readiness. With clear timelines, actionable steps, and a push for coordinated progress, the EU aims to get all Member States to a minimum baseline readiness by the end of 2026.

You Must Prioritize Post-Quantum Cryptography (PQC) and Shorter TLS Validity Readiness

Here’s a closer look at what the roadmap includes and why it matters.

What the Roadmap Covers (In a Nutshell)

  1. A phased transition timeline for PQC with key milestones in 2026, 2030, and 2035
  2. A list of concrete measures divided into First Steps and Next Steps every Member State should take to achieve national readiness

The Phased PQC Transition Timeline – A Quick Breakdown

The EU roadmap breaks the massive PQC transition into three manageable phases with clear priorities:

  • By the end of 2026: Every Member State should have a national PQC strategy in place. First Steps should be initiated, and pilots launched for high- and medium-risk use cases.
  • By the end of 2030: High-risk use cases must be fully migrated to PQC. Quantum-safe software and firmware upgrades should be enabled by default.
  • By the end of 2035: The transition should be complete for as many medium- and low-risk systems as possible.

To ease the transition, the EU recommends starting with hybrid cryptographic solutions that combine classical and quantum-safe algorithms whenever feasible.

Importantly, this phased timeline is designed to align with guidance and timelines set by other International bodies, such as NIST (US) and NCSC (UK). This global alignment is crucial, especially for organizations with cross-border operations or customers.

First Steps and Next Steps: Turning Strategy into Action

The EU wisely divides action into First Steps and Next Steps. This makes real progress feel achievable.

First Steps (By 2026):

The roadmap doesn’t assume you’re ready. Instead, it recommends foundational first steps like:

  • Identify and involve stakeholders
  • Support mature cryptographic asset management
  • Create dependency maps
  • Perform quantum risk analysis
  • Include the supply chain
  • Create a national awareness and communication program
  • Share knowledge and get involved with the NIS CG workstream on PQC
  • Develop a timeline and an implementation plan

Next Steps (By 2030):

Once the groundwork is in place, the roadmap suggests moving with next steps to ensure the transition is not just planned but also actionable.

  • Support cryptographic agility and a quantum-safe upgrade path
  • Allocate resources for the transition
  • Adapt certification schemes
  • Evolve the rules
  • Look for opportunities within the ecosystem
  • Considering transversal activities throughout the creation and implementation of the roadmap
  • Implement pilot use cases and contribute to testing centers

Assessing Quantum Risk: High, Medium, and Low

The roadmap offers a simple framework to assess quantum risk by classifying use cases as high, medium, or low based on how vulnerable existing cryptography is, the consequences of a potential compromise, and how complex migration would be.

High-risk systems (like those safeguarding long-term sensitive data) must be migrated by 2030. Medium-risk systems get until 2035. After those dates, the roadmap mandates that quantum-vulnerable algorithms should no longer be used independently.

How AppViewX Supports Every Step of PQC Readiness and Transition

AppViewX fully supports the EU’s commitment to a structured PQC transition. PQC isn’t just another cryptographic update; it is the biggest cryptographic transition in decades, one that demands time, effort, and meticulous planning. AppViewX is ready to help organizations accelerate their PQC readiness journeys with the right solutions.

How AppViewX Solutions Support PQC Readiness

Start with Cryptographic Discovery, Inventory, and Visibility

One of the first calls to action in the roadmap is building a mature cryptographic asset inventory. In other words, a comprehensive inventory of all cryptographic assets in your environment—certificates, keys, algorithms, configuration files, and their dependencies across devices, applications, workloads, and pipelines. This forms the foundation for everything that follows: dependency mapping, quantum risk analysis, and migration planning (other key aspects explicitly called out in the first steps).

The AppViewX PQC Assessment is built for this. It:

  • Scans your hybrid and multi-cloud infrastructures and CI/CD pipelines to identify every instance of quantum-vulnerable algorithms within codebases, configurations, dependencies, and certificates.
  • Generates a Cryptographic Bill of Materials (CBOM)
  • Scores your PQC readiness
  • Recommends clear remediation steps

Learn more about the AppViewX AVX ONE PQC Assessment

“Member States should promote and support that useful cryptographic inventories are being created and maintained. Generating and maintaining cryptographic inventories can be aided by tools (discovery and asset management tools). Using a standardised format for a cryptographic inventory, like CBOM Cryptographic Bill of Materials, an extension of the SBOM standard), is recommended.”

Build Crypto-Agility Into Your CLM Strategy

Another standout recommendation from the EU is cryptographic agility, the ability to quickly and safely replace cryptographic algorithms across systems without disruption.

AVX ONE CLM, our advanced certificate lifecycle management (CLM) solution, enables crypto-agility with:

  • Complete Visibility: Automated discovery and inventory of your cryptographic ecosystem, helping you prioritize PQC migration efforts.
  • End-to-end Lifecycle Automation: Advanced automation workflows to streamline certificate lifecycle operations and even the most complex cryptographic transitions.
  • Continuous Policy Control: Zero-touch policies that ensure strict PKI compliance, automatically enforcing PQC (or strong) algorithms without deviations.

Learn more about how AVX ONE CLM enables Crypto-Agility

Get a PQC-Ready PKI

AVX ONE PKIaaS is a modern, agile, and secure PKI-as-a-Service with full support for NIST-standardized PQC algorithms—ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and Falcon. You can seamlessly issue PQC-enabled certificates for internal use cases. AVX ONE PKIaaS also integrates with AVX ONE CLM for discovery, issuance, and lifecycle automation of legacy, hybrid, and PQC-ready certificates—at scale and speed.

Learn more about AVX ONE PKIaaS

Test PQC Adoption in Real Environments

Want to test quantum-safe certificates before rolling them out? The AppViewX PQC Test Center is a dedicated free online resource to assess your organization’s PQC readiness by generating and testing quantum-safe private trust certificates before their integration into existing systems, workloads, and machines. Quickly set up your own quantum-safe PKI hierarchy and generate PQC-ready certificates and keys to test their compatibility in your environment.

Try AppViewX PQC Test Center

The Transition to PQC Doesn’t Start Later. It Starts Now.

The EU’s roadmap brings structure and momentum to a transition that has long felt like a moving target for many organizations. And that’s just the beginning.

Quantum threats are closing in. PQC algorithms are finalized, timelines are locked in, and the ecosystem is moving fast. If your organization operates in the EU or works with those who do, now is the time to act.

The next decade will define how resilient your cryptographic infrastructure really is. With the roadmap in hand and the right tools at your side, you can make that transition confidently.

To get started on your PQC readiness journey, talk to an expert at AppViewX today.

Automation at altitude: Orchestration becoming the runway for AI agility

Automation at altitude: Orchestration becoming the runway for AI agility

When operations stall at 30,000 feet, it’s rarely the plane’s fault. It’s the tower.

Earlier this year, radar failures at Newark Liberty International Airport grounded flights across the United States, not because the aircraft failed but because coordination broke down. A combination of aging systems, staff shortages and manual overrides created a chain reaction that left passengers stranded and schedules in chaos.

Enterprise IT isn’t so different. Cloud systems, data platforms, ERP modernizations and AI pilots are all taking off, but the control layer that’s supposed to orchestrate them is often still stuck on the ground.

When the automation “tower” fails, everything stops.

Who’s guiding your IT traffic?

CIOs and CTOs are moving fast. They’re focused on cloud-first, generative and agentic AI and workflow automation. Under all that progress is a quiet problem: The automation architecture powering it all hasn’t kept up.

Companies are building smarter systems but still relying on old job schedulers and hard-coded scripts to orchestrate between them. That creates delays, disconnects and blind spots. The sky might look clear now, but storms are coming.

The more systems you modernize, the more complex your operations become. And as this modernization goes faster and faster over time, the harder it is to coordinate workloads with high fidelity, especially across legacy systems that require custom-coded connectors, manual refactoring for continuous integration and automation designed for a different era. While it feels like you’re accelerating, legacy systems beneath the surface are quietly pulling the brakes.

Modernization without orchestration is like asking your control tower to manage new aircraft using equipment they’ve never trained on. The sky is getting more crowded, but the systems guiding the traffic are stuck in the past.

The illusion of progress

The problem with mainframes didn’t begin and end in the early 2000s. It lingered for decades. Even as businesses moved to the cloud in the 2010s, their most critical workloads and data remained locked inside monolithic, closed mainframe applications with no APIs, no agility and shrinking pools of technical talent.

During the COVID-19 crisis in 2020, the issue broke into public view when multiple U.S. states issued emergency calls for COBOL programmers to stabilize aging unemployment systems. Rather than isolated IT issues, these were architectural bottlenecks that made rapid response impossible. No DevOps, no iterative improvement, no access to real-time data. Just batch cycles, manual updates and fragile processes buried under decades of technical debt.

Today, many enterprises are facing the same limitations, just in a different disguise. Legacy job schedulers and automation tools are the modern mainframe, standing in the way of AI adoption, API-driven integration and autonomous orchestration across cloud-native ecosystems.

These schedulers were designed for predictable workflows and tightly coupled environments, not for hybrid cloud, continuous delivery and interconnected platforms like SAP Business Technology Platform (BTP), Salesforce and Snowflake. As a result, they can’t scale, they can’t adapt and they certainly can’t keep pace with AI-driven transformation.

Why modernize in the first place?

IT infrastructure modernization isn’t a checkbox. It’s a strategy to:

  • Accelerate innovation
  • Break down data and process silos
  • Support AI and analytics initiatives
  • Reduce operational risk
  • Scale with agility

None of that works without modern orchestration via a control center that can coordinate business processes, eliminate human error, trigger event-based workflows and deliver consistent outcomes. Without it, transformation becomes a patchwork of short-term fixes and long-term headaches.

image 13

Static scheduling vs. intelligent orchestration

Orchestration requires controlling systems with precision and context, rather than just connecting them. That’s where event-based architecture becomes critical.

Unlike traditional scheduling, which runs on fixed times or batch jobs, event-driven orchestration allows your processes to respond dynamically to business and system events. You react to what’s happening now, not just what’s scheduled. Orders get fulfilled the moment inventory updates. Reports run the second data hits the warehouse. Downtime shrinks. You meet service-level agreements (SLAs).

At Redwood Software, we call this architecture an automation fabric: a unified layer that weaves together cloud and on-premises systems and AI innovation with full visibility, scalability and control. What makes it different?

  • Built for hybrid: Connect SAP, Oracle, cloud services and custom apps across environments.
  • Agentless integration: Connect systems without installing or maintaining local agents, so no need for custom scripts. Reduce risk, friction and security vulnerabilities.
  • AI-powered observability: Identify SLA risks and optimize performance before problems arise.
  • Unified monitoring: View everything through a single pane of glass.

Why would you custom-code or patch together manual workflows when intelligent orchestration can adapt autonomously?

Avoid a Newark moment: Your flight plan

Let’s say your global energy company is modernizing for sustainability and scale. You’re juggling regulatory demands, transitioning to RISE with SAP, piloting AI in financial planning and managing dozens of custom systems. But your core automation is still dependent on a legacy scheduler designed for batch processing and nightly jobs.

You’re not alone.

This is where modernization breaks down. It’s not in the cloud migration or the AI launch, but in what keeps it all together. By upgrading to a modern orchestration platform, your company could retire fragile custom scripts, slash risk across compliance-heavy processes and move faster with fewer people.

Rather than just picking a tool, it’s essential to choose a partner with a forward-looking vision. RunMyJobs by Redwood is designed to be air traffic control for the modern enterprise. Even if you’re not feeling the turbulence yet, the future is coming faster than you think. 

Don’t wait until delays, outages or compliance gaps force your hand. Modern orchestration isn’t optional — it’s foundational.

See it in practice: Read our guide to learn how automation fabrics are helping teams orchestrate SAP and non-SAP data across industries.

Everything You Need to Know about the Upcoming Sonos Platform Changes

Everything You Need to Know about the Upcoming Sonos Platform Changes

If you haven’t heard, starting July 8, 2025, Sonos will begin rolling out updates to its platform to comply with new EU Radio Equipment Directive (RED) Regulations. While these regulations originate in the EU, the upcoming platform changes will affect all Sonos users globally, including those using SmartThings integrations. Read on for a breakdown of […]

The post Everything You Need to Know about the Upcoming Sonos Platform Changes appeared first on SmartThings Blog.

So Many Reasons to Check Out AppViewX at the 2025 RSA Conference

So Many Reasons to Check Out AppViewX at the 2025 RSA Conference

The world of PKI and certificate management is evolving faster than ever. Tech giants like Google and Apple are advocating for shorter-lived certificates, Certificate Authorities (CAs) are undergoing major disruptions, and the push for post-quantum cryptography (PQC) readiness is intensifying. On top of these challenges, machine and non-human identities that rely on certificates for trust, secure access and encryption continue to grow at a significant rate. If you’re in security, staying ahead of these shifts is critical.

That’s why RSA Conference 2025 (RSAC) is the place to be. It’s where the industry’s brightest minds come together to tackle the biggest security challenges and explore path breaking solutions, and AppViewX will be right in the middle of it all.

Join AppViewX at RSAC as we break down the latest PKI trends, share future-ready certificate lifecycle management (CLM) strategies, and show you how automation and crypto-agility can help your organization stay resilient in an ever-changing security landscape. Whether you’re looking to streamline your CLM, manage machine and non-human identities at scale, get PQC-ready, or eliminate certificate-related outages and vulnerabilities—we’ve got you covered.

Here’s everything you need to know about AppViewX and RSAC 2025 to make the most of the event.

About RSA Conference 2025

Mark your calendars! The RSA Conference 2025 is happening from April 28 – May 1 at the Moscone Center in San Francisco, CA.

As one of the biggest cybersecurity events in the world, RSAC brings together top experts, thought leaders, and innovators to tackle the most pressing challenges and showcase the latest advancements in cybersecurity. This year’s theme, “Many Voices. One Community,” highlights the power of a united cybersecurity community that can “foresee risks, address threats and embrace challenges.”

Get to Know AppViewX at RSA Conference 2025

Of course, AppViewX is thrilled to be a part of RSAC 2025. You can meet us at booth #4608.

We are looking forward to discussing the latest developments challenges in machine and non-human identity management, crypto-agility and PKI, such as:

  • Google’s 90-day and Apple’s 47-day TLS validity proposals
  • Disruptive CA incidents and industry changes
  • Post Quantum Cryptography readiness

Swing by our booth #4608 in the North Expo (Moscone Centre) to see how the AppViewX AVX ONE Certificate Lifecycle Management and PKI platform can help your organization navigate these changes with confidence.

You can meet our experts, see live product demos, and discover how AppViewX AVX ONE:

  • Automates certificate issuance, renewal, and endpoint binding to help prepare for Google’s 90-day and Apple’s 45-day TLS certificate validity proposals
  • Enables enterprise crypto-agility to accelerate post-quantum cryptography readiness
  • Migrates seamlessly from one CA to another, minimizing disruptions, reducing the risk of outages, vulnerabilities and risk to ensure security and compliance
  • Eliminates certificate expiry related outages that lead to downtime and revenue loss
  • Ensures PKI and cryptography compliance with industry standards and regulations

Exclusive AppViewX Events

There is also an exciting lineup of AppViewX activities to engage with us at RSAC 2025:

1. AppViewX Customer Conference – April 28, 2025

Kick off your RSAC experience with AppViewX at our exclusive customer conference! Join us at the W Hotel, where industry pioneers, security leaders, and technical experts converge for an afternoon of insightful discussions, hands-on learning, and networking that will help you achieve crypto-agility and accelerate your journey to PQC readiness.

This invite-only event will dive deep into machine and non-human identity management trends, Certificate Lifecycle Management and PKI solutions, and real-world strategies to help you get ready for shorter validity TLS certificates and post-quantum cryptography now.

Why Attend?

  • Exclusive live product demos and insider previews
  • Hands-on technical labs and deep-dive sessions
  • Collaborative roundtables with CISOs and industry experts
  • Sneak peek into Post-Quantum Cryptography readiness with crypto-agility from AppViewX
  • Networking and dinner with peers and thought leaders

Location: W Hotel, San Francisco

Date: April 28, 2025

Time: 2:00 p.m. – 6:00 p.m.

Register Here

2. Meet One-on-One with the AppViewX Executive Team

This is your opportunity to discuss your certificate lifecycle management and PKI strategy with AppViewX leadership. Schedule a private meeting in our executive meeting suite at the W Hotel. Meet with key members of our executive team and subject matter experts to explore how AppViewX can help you get the most value out of our partnership..

Location: W Hotel, San Francisco

Available: April 28 – May 1, 2025

9:00 a.m. – 7:00 p.m.

Schedule a meeting

3. CyAlliance Waterbar Dinner – April 30, 2025

Join us for an exclusive evening at the CyAlliance Waterbar Dinner event that brings together top cybersecurity professionals, thought leaders, and industry executives. Hosted at San Francisco’s iconic Waterbar, this invite-only dinner offers a relaxed setting to engage in meaningful conversations, exchange ideas, and strengthen industry connections while enjoying spectacular views of the Bay Bridge.

Location: Waterbar, San Francisco

Date: April 30, 2025

Time: 6:00 p.m. – 10:00 p.m.

Interested in attending? Register here.

Plan Your RSA Conference 2025 Experience

To get the best value from RSAC 2025, make sure to plan ahead. Here are some key things to keep in mind:

  • Register Early – Passes are available at different rates, so register as soon as possible to secure the best price.
  • Build Your Agenda – With hundreds of sessions and keynotes, planning your schedule in advance will help you maximize your experience.
  • Connect with AppViewX – Whether you choose to join us at our customer conference, in our meeting suite, or at our booth, we’d love to meet with you!

See You at RSA Conference 2025!

RSAC 2025 promises to be an incredible event, and we can’t wait to connect with you in San Francisco. Stay tuned for more updates, and don’t forget to register for our customer conference and book a meeting with our leadership team.

Get a free expo pass for RSAC 2025 with this exclusive AppViewX discount code “52EAPPVXXP”. Looking for a full conference pass? Use this exclusive AppViewX discount code “52FCDAPPVX” to get $150 off the full conference pass rates.

Register here for the event.

For more details, visit our RSAC 2025 page

Building a Smarter, Safer Grid with IEEE 2030.5 and Certificate Lifecycle Management Automation

Building a Smarter, Safer Grid with IEEE 2030.5 and Certificate Lifecycle Management Automation

The renewable energy landscape is evolving fast—bringing smarter, more sustainable ways to generate, distribute, and use power. At the heart of this transformation is a lesser-known but vital standard: IEEE 2030.5—a foundational protocol that helps smart energy devices and the power grid communicate safely and reliably.

 

 

Dive into this blog for a breakdown of what IEEE 2030.5 is, why it’s important, and how automated certificate lifecycle management (CLM) helps meet its compliance requirements, driving forth secure and future-ready systems.

Why the IEEE 2030.5 Standard Was Developed

The rise of Distributed Energy Resources (DERs)—like smart meters, rooftop solar panels, wind turbines, smart thermostats, battery storage, EVs, and inverters—has transformed the way our electric grid works. These resources help bring more renewable energy online, cut down on transmission losses, and make the grid more resilient by spreading out power generation. Today, millions of DERs feed into the power grid.

But as great as that sounds, it also brings new challenges like reverse power flows (back feeds), voltage swings, and reduced system inertia—which are tough to manage with traditional power grids that were originally built for big, centralized power plants.

To make things even trickier, many of these DERs are owned by either homeowners or businesses that both generate and consume energy. These setups often come with contractual agreements that set limits on how and when the devices can be used. In this context, grid operators require a solution that provides real-time monitoring and control over DERs while respecting these operational boundaries.

Utilities have traditionally used SCADA communication systems to manage a limited number of large-scale grid assets. However, SCADA isn’t built to handle thousands of small, scattered devices. Extending it to cover DERs is both expensive and impractical—especially since residential DER owners lack the specialized equipment SCADA requires. It is this gap that led to the development of IEEE 2030.5: a communication protocol that runs on the Internet, is accessible to all, and helps grid operators efficiently manage DERs and optimize energy distribution.

So, What Exactly Is the IEEE 2030.5 Standard?

IEEE 2030.5, also known as the Smart Energy Profile (SEP 2.0), is a modern communication protocol built to enable secure and efficient two-way communication between Distributed Energy Resources (DERs) and the centralized smart grid. Think of it as the “language” that lets your rooftop solar panel or EV charger converse seamlessly and safely with the grid.

IEEE 2030.5 uses standard Internet protocols such as TCP/IP and HTTP, and a RESTful architecture—much like modern web applications. This means new devices can plug in seamlessly and start communicating right away, regardless of the device manufacturer. The result is a highly scalable, cost-effective solution for managing the exploding number of DERs on today’s grid.

Security is at the core of IEEE 2030.5. The protocol uses Public Key Infrastructure (PKI) to authenticate devices and encrypt all data exchanges. This ensures that only authorized devices can join the network and that communication is encrypted and remains protected from cyberattacks.

With IEEE 2030.5, grid operators gain real-time visibility into critical information about DERs, such as their location, status, capacity, and usage limits—and can control these resources remotely. This capability translates to smoother load management, faster demand response, and fewer on-site fixes.

In essence, IEEE 2030.5 turns the traditional, one-way power grid into a responsive, intelligent network—paving the way for a more reliable, secure, and green energy future.

The IEEE 2030.5 Standard Use Cases

Designed for versatility and effectiveness, IEEE 2030.5 covers a wide range of use cases:

  • Residential: Enables homeowners to seamlessly integrate home energy systems with the smart grid and gain greater visibility and control over their energy consumption.
  • Commercial and industrial Settings: Helps businesses manage hundreds or thousands of IoT devices across their facilities to optimize their energy usage and cut operational costs.
  • DER Developers: Provides an industry-wide playbook for designing and deploying DERs that work straight out of the box with any compliant grid—eliminating costly custom integrations.

The Critical Role of Automated Certificate Lifecycle Management in IEEE 2030.5

A fundamental aspect of the IEEE 2030.5 standard is ensuring secure and trustworthy communication between Distributed Energy Resources (DERs) and the smart grid. This is achieved through PKI (public key infrastructure) and digital certificates, which help authenticate DERs connecting to the grid and encrypt their communications over TLS (Transport Layer Security). Managing these certificates effectively is critical for maintaining the integrity of the smart grid. However, manually managing certificates becomes nearly impossible as DER deployments scale into the millions.

Traditional methods—like spreadsheets or basic CA tools—are slow, fragmented, and error-prone. A single expired certificate or misconfigured setting can disrupt communication and cause costly grid outages. Moreover, manual processes do not provide complete visibility or control of certificates, making it hard to detect expired certificates or respond quickly to security threats—opening the grid to unauthorized access and data breaches through DERs.

When it comes to managing certificates at scale in an expansive grid environment, automation is indispensable. Automation streamlines the entire process—discovering, tracking, issuing, renewing, provisioning, and revoking certificates across thousands (or millions) of DERs. This efficiency is vital in the power grid, where even a slight delay in certificate renewal or issuance can lead to communication breakdowns. Automation enforces strict policies and role-based access controls (RBAC) for all certificate processes. This helps ensure every certificate remains valid and properly tied to its DER, dramatically reducing human error and keeping security tight.

Automation also brings the visibility grid operators need. With centralized dashboards, real-time alerts, and regular reporting, operators can continuously monitor certificate status and ensure that every DER is using up-to-date, authenticated certificates. This proactive approach is key to keeping the grid secure, compliant, and resilient—no matter how fast DERs scale.

How AppViewX Helps You Meet IEEE 2030.5 Compliance

AppViewX AVX ONE CLM is a ready-to-consume, scalable certificate lifecycle management (CLM) solution that fully automates all certificate processes from start to finish. From discovery and monitoring to renewal and provisioning, it provides complete visibility and control—all through a single, centralized dashboard.

Certificate Lifecycle Management with Visibility, Control and Insights – All in One Place

With powerful automation capabilities and policy enforcement, AVX ONE CLM helps minimize the risk of outages and security vulnerabilities—making it a key enabler for IEEE 2030.5 compliance.

Here’s how AppViewX supports IEEE 2030.5 compliance:

  • PKI Deployment and Redeployment: Seamlessly manage PKI and certificates issued to devices across their entire lifecycle—from first deployment to redeployment and ongoing use.
  • Automated Certificate Issuance: Issues certificates to devices at installation through the manufacturer’s PKI, ensuring each device is trusted and uniquely identifiable from day one.
  • Broad Support for Certificate Types: Handles all relevant certificate types—device, test device, optional TLS, client/server, and self-signed—to support a wide range of grid communication needs.
  • Full CA Hierarchy Support: Supports the entire chain of trust, including SERCA (Root CA), MCA (Manufacturer CA), and MICA (Manufacturer Intermediate CA).
  • OCSP Integration: Verifies the revocation status of certificates issued by non-IEEE 2030.5 CAs before expiration, ensuring continued trust and security.
  • Cryptographic Algorithm Support: Supports ECC key algorithms for efficient, strong encryption—ideal for resource-constrained IoT and Smart Grid devices—and SHA256 with ECDSA for message integrity and non-repudiation.
  • Support for Certificate Policies and Extensions: Enforces certificate policies, such as validity period, authority key identifier and subject key identifier, device type, and serial number to match IEEE 2030.5 requirements.
  • Robust Private Key Protection: Secures private keys with FIPS-compliant HSMs to maintain PKI integrity and device authenticity.

Industry Adoption and The Road Ahead

As the world accelerates toward clean and renewable energy, IEEE 2030.5 will play a central role in ensuring grid stability, security, and innovation. Thanks to its internet-based, plug-and-play architecture, the protocol has made significant strides in recent years, quietly becoming the global standard for DER integration.

California’s Rule 21—governing nearly half of the U.S. renewable energy market—now mandates IEEE 2030.5 for all DERs. The standard is gaining momentum internationally too, with Canada, Europe, and Australia adopting it for DER and EV charging management. Australia even launched its own localized version of the IEEE 2030.5 protocol, CSIP‑Aus, to support its fast-growing DER fleet and clean energy goals.

In December 2024, the IEEE 2030.5 working group released an updated version of the standard, with stronger security and broader capabilities. CSIP 3.0 is slated for 2025, promising further enhancements to meet emerging grid services and market demands. As the protocol continues to evolve, automated certificate lifecycle management (CLM) will become critical for maintaining compliance and securing this dynamic, distributed energy ecosystem.

References:

How Financial Institutions Can Meet DORA Compliance with Crypto-Agility

How Financial Institutions Can Meet DORA Compliance with Crypto-Agility

Today’s financial systems are highly digital and deeply interconnected. That’s great until something breaks. Whether it’s ransomware paralyzing critical services or cryptographic vulnerabilities quietly eroding trust, disruptions are no longer rare—they’re systemic.

The Modern Heist Bank Report 2025 shows just how serious it’s become: 64% of surveyed financial institutions reported cyber incidents in the past 12 months. Regulators aren’t standing by waiting for institutions to catch up. They’re demanding proof that firms have the countermeasures to withstand and recover fast from operational shocks. 

That’s what the EU’s Digital Operational Resilience Act (DORA) sets out to enforce.

What Is DORA?

The Digital Operational Resilience Act (DORA) is a European Union regulation designed to strengthen the digital operational resilience of financial institutions. The goal is to ensure they prepare for, respond to, and recover from ICT (Information and Communications Technology) risks—from cyberattacks to system outages and industry disruptions. 

Effective across the EU since January 17, 2025, DORA applies to a wide range of financial entities, including banks, insurance companies, investment firms, payment service providers, crypto‑asset (currency) service providers, and even ICT third‑party suppliers that support them. 

Why Focus on ICT Resilience ?

Modern financial operations run on ICT systems for everything from data processing and API integrations to cloud infrastructure and network security. But when these systems are mismanaged or targeted, they become serious points of failure. A single breach or outage can leak sensitive data, disrupt services, and destabilize the broader financial system. To prevent this, DORA enforces a comprehensive resilience framework to manage, mitigate, and report ICT-related incidents. 

It focuses on five key areas:

  1. ICT Risk Management: Implement structured policies, ongoing risk assessments, and governance mechanisms to proactively manage ICT risks.
  2. Incident Reporting: Establish clear protocols for detecting, classifying, and reporting ICT-related incidents that could impact operational continuity or customer trust.
  3. Third-Party Risk Management: Conduct due diligence, establish contractual safeguards, define clear exit strategies, and continuously monitor critical third-party ICT service providers.
  4. Resilience Testing: Conduct regular risk-based penetration tests, such as Threat-Led Penetration Testing (TLPT), on critical ICT systems to simulate real-world attack scenarios and identify vulnerabilities. Implement incident response plans to mitigate attacks quickly.
  5. Information Sharing: Share information and threat intelligence with other EU financial institutions to drive awareness and improve collective resilience.

Together, these five pillars form the backbone of DORA’s resilience strategy, ensuring resilience against cyber threats and operational disruptions.

Cryptography Requirements Under DORA

As financial institutions go increasingly digital, cryptography has become more than a security best practice. It is crucial to ensuring the confidentiality, integrity, and availability of sensitive data. Recognizing this, DORA—along with its supporting Regulatory Technical Standards (RTS) under Delegated Regulation (EU) 2024/1774—lays out clear expectations for how financial institutions should govern cryptographic controls.

You Must Prioritize Post-Quantum Cryptography (PQC) and Shorter TLS Validity Readiness

Encryption and Cryptographic Controls (RTS Article 6)

Under DORA, financial institutions must develop, document, and implement a formal encryption policy covering all data and communications as part of their ICT risk management framework. Key requirements include:

  • Encrypting data at rest and in transit—as well as in use where feasible. If encrypting in use isn’t technically possible, organizations must process such data in isolated, protected environments.
  • Encrypting all internal network traffic and external communications 
  • Defining clear criteria for choosing cryptographic algorithms and key lengths based on industry standards, risk analysis, and data classification
  • Updating or replacing cryptographic methods as threats evolve; When updates aren’t immediately possible, compensating controls must be documented and justified.

Cryptographic Key Management (RTS Article 7)

DORA expects financial institutions to maintain a documented key management policy that covers the entire lifecycle of cryptographic keys to prevent key exposure and misuse. Core expectations include:

  • Secure key handling across every stage—generation, storage, backup, transmission, rotation, and revocation
  • Strict access control and usage policies throughout the key lifecycle to prevent unauthorized access, theft, loss, or tampering
  • Clear procedures for key replacement following suspected compromise or damage
  • A comprehensive register of all digital certificates used in critical systems—along with processes to ensure timely renewals.
  • Protecting keys during their active use, often through encryption or isolation in secure hardware such as hardware security modules (HSMs)
  • Proper disposal of retired keys, including securely deleting keys and associated metadata to prevent recovery or misuse

Secure Authentication and Access Controls (Article 9)

Access to cryptographic assets must be carefully managed. Article 9 reinforces the need for strong identity verification and strict privilege controls. This includes:

  • Least-privilege access policies that restrict both physical and logical access to only those who need it, with documented and continuously monitored access rights
  • Strong authentication mechanisms to protect cryptographic keys from unauthorized use

Why Crypto-Agility Matters for DORA?

DORA’s technical standards—especially Article 6—send a strong message: cryptographic systems must evolve with the ever-changing threat landscape. In practice, this means building crypto-agility into your infrastructure. Financial institutions are expected to monitor cryptographic developments, assess emerging risks, and update algorithms or protocols—quickly, smoothly, and without disruption.

Why is this important? Because cryptographic standards don’t last forever. They age, weaken, and get replaced. Crypto-agility gives you the ability to:

  • Replace outdated algorithms and vulnerable keys without operational delays
  • Adapt to new regulatory mandates, such as DORA, with minimal friction
  • Stay ahead of new threats, such as the potential vulnerability of current encryption methods like RSA or ECC to quantum resilient algorithms, by transitioning to NIST-approved post-quantum cryptography (PQC) algorithms before these methods are compromised.

Whether you are preparing for PQC, adapting to 47-day TLS certificate lifespans, or responding to Certificate Authority distrust incidents, crypto-agility ensures your cryptographic infrastructure remains resilient, secure, and compliant throughout.

How AppViewX Enables Crypto-Agility and Supports DORA Compliance 

Crypto-agility isn’t a checkbox—it’s a continuous capability. AppViewX AVX ONE CLM, our certificate lifecycle management solution, helps you build and maintain it through powerful visibility, automation, and policy control—fully aligned with DORA’s technical requirements.

Complete Crypto Visibility

Under DORA Article 7, a complete, up-to-date certificate registry is non-negotiable. AVX ONE CLM delivers it by: 

  • Automatically discovering certificates across your infrastructure—from any public or private CA, across all endpoints and cloud services—consolidating them into a centralized inventory
  • Mapping certificates to their location, owner, issuing CA, expiry date, and crypto standards for a single-pane-of-glass view
  • Providing dynamic visual dashboards to understand risks, manage renewals, prevent outages and vulnerabilities, and ensure compliance

End-to-End CLM Automation

DORA demands secure, consistent handling of digital certificates across their lifecycle—and AVX ONE CLM delivers precisely that.

  • Full lifecycle automation, including issuance, renewal, provisioning, revocation, and last-mile binding to endpoints
  • A low-code workflow builder and a rich library of automation templates to tailor automation to your environment
  • CA-agnostic operations—manage all public and private certificates from one place and implement cryptographic changes quickly, without disruption

Built-In Policy Control and Governance:

Strong cryptographic governance is central to DORA compliance. AVX ONE CLM enables:

  • Automatic enforcement of defined policies for approved CAs, algorithms, validity periods, upgrades, and more. 
  • Role-based access controls (RBAC) to ensure secure and authorized certificate issuance
  • Detailed audit logs, automated policy checks, and periodic reports to simplify audits, ensure compliance, and strengthen overall crypto hygiene

DORA Compliance Starts with Crypto-Agility

DORA marks a major step forward in strengthening the financial sector’s defense against growing digital threats. With its strong focus on operational resilience and crypto-agility, DORA pushes financial institutions to move beyond static defenses to dynamic systems that can adapt, recover, and stay secure as risks evolve. 

Crypto-agility is central to making that shift.

With AppViewX AVX ONE CLM, crypto-agility isn’t an afterthought—it’s built in. From complete certificate visibility and lifecycle automation to centralized policy control and reporting, AppViewX helps your organization meet DORA requirements with confidence.

Explore our Crypto-Agility Solution Brief to understand how AppViewX makes it possible.

Or better yet—schedule a quick call with our team and see how easily your organization can hit DORA benchmarks.

Culture of curiosity: How software champions lead the charge on automation

Culture of curiosity: How software champions lead the charge on automation

Imagine a brand-new, high-efficiency car. It’s got all the latest tech, promising to get you from point A to point B faster and more smoothly than ever. 

Now, imagine you’re only using the basic functions — driving, accelerating, braking. You’re getting where you need to go, but you’re not using cruise control, lane assist or advanced navigation. That’s what it’s like when a team adopts a powerful automation platform without fully investing in training. 

The car (the software) is fantastic, and it’s working, but there’s so much more it can do. A team of admins may have created basic automated tasks, transferred essential files and set up fundamental reports. But are they leveraging all the features that will help them achieve their goals? How much valuable time was spent setting up those rudimentary processes, and how often did they need to reach out to support or success teams to gain even minimal traction? 

This is where a “learning champion” can shift things into high gear.

Learning champion: An individual who proactively seeks and shares software knowledge and best practices with their team, fostering a culture of continuous learning and improvement and driving increased productivity and efficiency

We’ll explore how becoming a learning champion boosts your individual productivity and career and amplifies that effect across your team and organization, especially if you’re in the process of adopting automation.

Taking control: Why become a learning champion?

According to the Customer Education Trends in 2025 report from Skilljar, the modern learner has been thrown into an “everything, everywhere, all at once” environment, consuming self-paced content, articles, documentation and live support on their own terms and at their own pace.

While the flexibility to find information in the format that makes sense to you and without waiting to be assigned a course can feel empowering, it also adds complexity. When you consider the number of people who must learn a given skillset or platform, you can understand the nth-degree potential for confusion or frustration — an undesirable and non-scalable state.

Individual ownership matters, especially when you’re adopting complex or evolving tools like automation platforms. A learning champion becomes a catalyst for team efficiency and organizational progress.

Elevate personal productivity

Proactive learners make fewer basic errors, reduce support tickets and implement automation faster.  Plus, upskilling a team contributes to business agility. As BytePlus notes, “Employees with diverse, updated skills can adapt more quickly to technological and market changes.”

Quick tip: Gauge your starting point. How long does it take you to complete a process? How often are you asking for help? Once you complete training, measure again. You’ll see tangible signs of your growth, and so will others. Share these insights with your team and manager to make the case for upskilling.

Advance your career with certification

Becoming a learning champion isn’t just about helping your team; it’s a smart career move. Achieving certification, especially in complex automation software, validates your expertise and positions you as a subject matter expert. It signals to your organization (and future employers) that you’re not just using the tool but owning it.

Certifications in automation software demonstrate that you can do more than execute tasks: You can understand workflows, configure processes and lead others. For example, the Automation Developer Specialist Certification from Redwood University challenges your understanding of advanced functions, complex workflow automation and process scheduling best practices. Users with this certification leverage their deep knowledge of the software to drive transformation instead of just reacting to the tool. 

The initiative can start during your onboarding: Learning champions don’t wait for permission to explore new things, and proactiveness is a quality your current leaders and future employers seek.

Quick tip: Ask about learning paths that align with your team and career goals, then dive in and get started. Share feedback with your immediate team on how the material helped you. Post your new credential on LinkedIn for wider reach.

Share what you learn

Knowledge is best when shared widely and in ways that are digestible. As Skilljar puts it, “Educators are curating, not just creating.” Software vendors can offer a full library of content (like what you’ll find in Redwood University), but it’s up to learners to enroll, complete lessons and share their knowledge.

Whether you’re forwarding helpful documentation, recommending training courses or showing a colleague how to fix a recurring issue, you become the go-to person. Don’t stop there. Your goal should be to elevate yourself AND others. A lone learning champion is a great start, but real efficiency comes when your whole team levels up.

Quick tip: Create a “Top 3 takeaways” list after every course you complete and email them to your team. Keep it light, useful and actionable.

The impact of software education on team productivity

A well-trained team is a fast team. When many users understand how to leverage automation software fully, you get better data, fewer bottlenecks and less reliance on external support.

In other words, you’re making the most of your investment. 

According to TSIA, product adoption is a key business metric. Leaders expect returns on software purchases, and ongoing, quality training is how you get there.

The real power of education becomes clear when users go beyond the fundamentals of process automation. Too often, users are taught just enough to complete their tasks. But it’s essential to go deeper: to grasp why a process works the way it does, where automation eliminates inefficiencies and how to extend those benefits across other business processes.

This level of knowledge comes from hands-on experience — working through real use cases, experimenting in a safe environment and applying lessons immediately to daily work. If you discover a faster way to automate a handoff between departments, for example, you’re building consistency and making sure everyone is working from the same playbook.

Build a culture of curiosity

When one person steps up, others follow. A team that values education creates a ripple effect. Questions become learning moments, and continuous improvement becomes the norm.

That kind of culture pays off. 

BytePlus emphasizes an SHRM stat: Replacing a single employee can cost up to 200% of their salary. Investing in learning reduces turnover and keeps your best people engaged and growing.

Bonus: Training builds loyalty. A team that learns together stays together.

User to influencer: How to lead the learning revolution

Whether you’re in leadership and setting up a flexible, comprehensive learning environment for your team or an individual looking to influence your peers, use the following steps to influence other automation software users.

  1. Blaze the trail: Ask your vendor what training they offer and which courses fit your role. Choose the format that works best for you — live, self-paced, etc. 
  2. Elevate your team: Recommend key features or tricks your team can use today and encourage them to explore help centers, learning academies and documentation.
  3. Look outward: In many enterprises, different teams use different tools for similar goals. Your experiences can help standardize education, in turn consolidating spend and scaling success.
  4. Share your team’s gains: Are you submitting fewer support tickets? Are processes faster? Are you automating more? Compare your pre-training and post-training metrics.

Be the spark

Investing time in learning pays off at every level, from your own growth to company-wide productivity.

You gain:

  • The confidence to navigate the software
  • Mastery of tools that drive automation
  • Speed and accuracy in your day-to-day work
  • Recognition as a subject matter expert
  • Momentum to shape your career path

Your organization gains:

  • Stronger product adoption rates
  • Greater ROI
  • A lesser need for IT intervention and manual workarounds
  • Faster onboarding for new team members
  • Reduced turnover due to better engagement and support for each role

Become a learning champion for your team’s Redwood Software products by utilizing Redwood University. It’s free and open to all customers and partners. Sign up today.

SAP Sapphire 2025: Redwood customers ready for SAP AI transformation

If I had a dollar for every time I heard “AI” at SAP Sapphire 2025 …

AI was simply everywhere at this year’s events. From Christian Klein’s keynote to the show floor demos, it was the foundation of nearly every conversation. But beneath the buzzwords and bold visions, I noticed one question kept surfacing: How do you actually do it? How do you make AI actionable inside the day-to-day workings of an enterprise?

That’s the question we were thinking about at the Redwood Software booth and in our customer sessions and roundtables. It was fantastic to see the energy this year: standing-room-only demos, deep discussions with IT and business leaders and a steady stream of customers stopping by to share what they’re already doing with job scheduling, orchestration and workload automation (WLA). The excitement was real, but the deeper story was about who’s already rolling up their sleeves instead of just dreaming about digital transformation that actually realizes the value of AI.

Redwood was proud to be recognized for the second year in a row with the SAP Pinnacle Award in a category honoring innovative partners that provide economically relevant solutions, validating our ability to consistently drive high adoption and ROI for SAP customers. We also announced that RunMyJobs by Redwood is now an SAP Endorsed App, Premium certified — the highest level of SAP verification, indicating outstanding customer value. 

The best part? We’re not talking in hypotheticals. These milestones are a testament to the real-world outcomes our customers achieve when integrating with the latest SAP technologies, maximizing the value of their SAP investment. We saw that in full color in sessions and roundtable discussions with RS Group and others, whose teams shared striking results they’ve achieved using RunMyJobs. They haven’t been waiting for the AI wave. Instead, they’ve been preparing for it by modernizing their WLA. And it’s paying off.

We’re making business AI real as we drive digital transformations that help customers thrive in an increasingly unpredictable world. 

Christian Klein, CEO of SAP

Klein’s sentiment rang true throughout the event, especially his keynote theme: To thrive in an AI-powered world, it’s not enough to modernize ERP. Foundational processes, especially the ones running behind the scenes, must be intelligent, agile and orchestrated. WLA platforms like RunMyJobs are already doing the work of preparing SAP landscapes for AI by coordinating processes end to end, orchestrating the tasks that drive efficient data pipelines and ensuring the reliability that AI output depends on.

Redwood customers leading the charge

SAP made it clear: the future isn’t about cobbling together best-of-breed tools. It’s about building a smart, cohesive suite. That suite extends beyond core ERP to include the applications and automation fabrics that make an entire business run. Redwood customers are already there.

RunMyJobs isn’t a standalone job scheduler. It’s the connective tissue for automation fabrics across SAP and non-SAP systems, delivering the kind of real-time orchestration that complex, data-intensive environments demand. Redwood’s shared product vision with SAP is helping customers optimize operations to scale with AI. That alignment is also what earned RunMyJobs its SAP Endorsed App status.

We spotlighted compelling Redwood customer stories at SAP Sapphire this year, including the following.

RS Group: Transforming global supply chain operations for a demanding market

As a global industrial distributor, RS Group faces an unforgiving supply chain environment. Before RunMyJobs, they couldn’t even run business operations processing (BOP) daily for all 26 markets they serve. The complexity was enormous. They had to stagger market runs, which put customer promises, such as delivery timelines, at risk.

Using RunMyJobs to re-engineer processes and workstreams and optimize job logic, they now run BOP for all 26 markets daily

We now meet our promise to our business and customers. 

Dharmesh Patel, Head of SAP Development & Services, RS Group

But that was only the beginning. Previously, RS Group faced issues with poor monitoring, alerting and visibility, leading to frequent Priority 1 (P1) and Priority 2 (P2) incidents in critical operations like order processing and warehouse management. With RunMyJobs, they introduced custom alerting, rebuilt job frameworks and created a governance model for continuous improvement.

This isn’t just operational success. It’s setting the stage for AI readiness, because AI needs more than just access to data. It needs reliable, actionable data at the right time, integrated into the processes that power the business. RS Group is ready. When you run a global supply chain, “ready” isn’t a luxury.

Ready on day 1: How fit-to-suite automation prepares you for the AI future

The real takeaway from SAP Sapphire wasn’t that AI is coming. It’s that AI is already here, and the companies reaping the benefits are the ones that did the foundational work early. Redwood customers like RS Group have already modernized their WLA. They’re not bolting on AI. They’re ready for what’s happening now and what’s to come because their automation is fit-to-suite: deeply integrated, spanning SAP and non-SAP systems and built for scale and AI innovation.

RunMyJobs provides the automation fabrics enterprises need to orchestrate complex, cross-system workflows and support the data pipelines AI depends on. It connects SAP S/4HANA to the hybrid architectures, business process layers and related data AI needs to drive better, faster decisions and more efficient attainment of business outcomes.

When your business runs on well-managed, intelligent processes, you don’t just hope your AI strategy will work — you know it can.

An obvious and undeniable message of SAP Sapphire 2025? WLA modernization isn’t a side project. It’s a prerequisite. See how Redwood supports SAP customers in future-proofing their ecosystems.