This page is the research trail for the course's standing claims. Lessons stay readable. Here you will find the documents those lessons rest on, and a dated record of later wording changes.
Foundation links were last checked on 9 October 2026. Primary documents belong here. Press headlines do not. This course is not official PKIC or NIST training.
Foundation sources
The floor the course stands on. Each row names the official document, what it is for this course, and which lessons use it.
NIST algorithm standards
The three finalized Federal Information Processing Standards the course teaches as the replacement algorithms.
Documents the course uses for deprecate and disallow dates. These are guidance and drafts, not a physics forecast for when a cryptographically relevant quantum computer arrives.
Transitioning the Use of Cryptographic Algorithms and Key Lengths. Broader algorithm-transition guidance. Lessons 0.2 and 1.6 now attribute the RSA and ECC 2030/2035 dates to NIST IR 8547.
Still a public draft as of 24 September 2026. The /final URL returns 404. Lessons should keep saying draft until NIST publishes a final revision.
Transition to Post-Quantum Cryptography Standards. Proposes the RSA and ECC 2030 deprecate and 2035 disallow dates taught in Lessons 0.2, 1.2, and 1.6.
Public draft, November 2024. Not a FIPS. PDF: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf
Official PQCMM assesses products and services. Official PKIMM assesses an organization's PKI program. This course is not PKIC training and PKIC has not reviewed it.
Official level names: None, Initial, Foundational, Advanced, Managed, Optimized. The course also uses those six levels as a personal learning scaffold.
Annex K.1.9 pattern: put a pointer to a Vulnerability Disclosure Report in the bill of materials. Do not copy a short-lived CVE list into the inventory.
Recorded lectures the lessons link as extra watching. They are not required. Timeline estimates in a recording may be dated; use this page for current figures.
Michele Mosca and Sara Zafar Jafarzadeh. Cybersecurity and Privacy Institute, University of Waterloo. Lesson 0.3 links Mosca's inequality segment as optional watching.
University channel. Mosca is also CEO of evolutionQ. Any timeline estimates in the recording may be dated.
Chronological record of factual wording changes. Newest first. Typos, layout, and Udemy paste maps do not belong here. An entry is logged when a learner could get a different answer on a quiz or in a vendor conversation.
The step-through labeled key generation and decapsulation as recipient (server) and encapsulation as sender (client). Presenter beat 2 said think server-side key pair.
Now
Sender and recipient stay as KEM roles. In TLS 1.3 hybrid the client is the recipient: it sends the public key in ClientHello, the server encapsulates, the client decapsulates. Lesson 2.2 already showed that handshake and was not changed.
Why
The HTTP picture (server holds the key) is the usual guess and is wrong for X25519MLKEM768. Claude recorded the old 1.2 labels. RFC 10024 puts the ML-KEM encapsulation key in the client share and the ciphertext in the server share.
The size paragraph said hybrid ML-KEM typically adds one extra network round trip. The decapsulation visual said integrity is built in. The hybrid paragraph treated classical deprecation as a settled post-2030 fact.
Now
The size paragraph says a larger ClientHello, still one RTT unless the server retries. The decapsulation visual describes implicit rejection: a tampered ciphertext yields the wrong secret, so the handshake fails. The hybrid paragraph matches Lesson 1.6 (NIST IR 8547, draft). OpenSSL 3.5 native ML-KEM was already on the page from Batch C/G.
Why
Claude flagged four Accuracy-notes items against the recording script. The OpenSSL 3.2/OQS line was already retired. The other three were still on the live lesson.
Lesson 3.4 treated air-gapped OT and ICS networks as a scanner gap and said to deploy on-site agents. Lesson 3.6 firmware updates mentioned change windows but not plant outages.
Now
M1: Lesson 3.4 adds an OT discovery callout after Gap Category 2. M2: that category now says passive monitoring and plant records, not on-site agents. M3: Lesson 3.6 notes that plant firmware updates usually need a production outage.
Why
Active scanning and agents can disrupt plant devices. Discovery in OT is look-do-not-touch. Replacement stays in Lesson 4.4. No new external source URLs.
The header said 3 comprehension questions. Typical preparation time was Weeks, 1–3 months, and 3–6 months. The PKIC cost line said PKIC assessment fees plus preparation investment. Best suited for named products targeting PQCMM Level 3+.
Now
The header says 5 comprehension questions. Preparation time is Varies, with a note that timing and cost vary and PKIC does not publish standard figures. The cost line is assessor fees plus preparation. Best suited for says a product is certified at the level it is assessed to meet. The under-review note stays.
Why
Amy asked for a wording-only 5.2 pass before PKIC review. Official PQCMM assesses products and services. PKIC has not reviewed or endorsed this course.
The home page used the default course chrome: a centered serif hero, bordered persona cards, and a collapsed unit tree.
Now
The home page matches the course overview one-sheet: navy hero with Sora headings and the layered polygon motif, persona and unit cards with brand accents, a What learners build row, a Why it is free and plain callout, and a navy framework note. The endorsement sentence stays on the home page. The hero pill still reads PQCMM Levels 0→5.
Why
Amy asked for a home-page-only visual refresh. Official PQCMM assesses products and services. The course uses those six levels as a personal learning scaffold. PKIC has not reviewed or endorsed this course.
Lesson 5.D called the roadmap a full PKIMM compliance evidence package and a complete Knowledge and Training compliance artifact, said the review date satisfies or directly satisfies Periodically Review Knowledge, and used the heading PKIMM compliance note. Lesson 5.8 said it was not part of the compliance evidence pathway.
Now
5.D uses PKIMM evidence package, supports the review requirement, can support Periodically Review Knowledge with the assessor deciding, documented record of Knowledge and Training activity, and the heading PKIMM note. 5.8 says evidence pathway.
Why
Amy asked for a wording-only pass on leftover phrases in source-files, which are copied into public/lessons and loaded in lesson iframes. Official PKIMM is an organizational self-assessment. Nothing may imply PKIC reviewed, endorsed, or certified this course or a learner result.
Lesson 5.D badges said requirement satisfied and the note said compliance evidence folder. Lesson 1.7 labeled the PKIMM card Compliance evidence framework. Lesson 4.3 Year 5 labels said compliance evidence.
Now
5.D badges say supports this requirement and the note says evidence folder. The 1.7 PKIMM card heading is Organizational PKI maturity framework. The 4.3 Year 5 checklist and deliverable labels say supporting evidence.
Why
Amy asked for a wording-only pass on leftover phrases after #104. Official PKIMM is an organizational self-assessment. Nothing may imply PKIC reviewed, endorsed, or certified this course or a learner result.
Home and unit chips said Current PQCMM level: Pre-level 0 and PQCMM 0 → 1. Lesson 4.6 showed Knowledge and Training (after this course) at 3+. Lesson 4.3 called the Year 5 PKIMM assessment the primary compliance evidence artifact. Lesson 1.7 said PKIMM produces auditable compliance evidence. Lessons 5.1, 5.2, and 5.D still had a few satisfy, Level 3 achievement, and compliance-evidence sentences.
Now
Progress chips read Course step: Pre-step 0 and Course step: 0 → 1 (PQCMM scaffold). The 4.6 sample card documents training activity with no level number. The remaining 4.3, 1.7, 5.1, 5.2, and 5.D sentences use supporting-evidence and assessor-decides wording.
Why
Amy approved the flagged items from the endorsement audit. Official PQCMM assesses products and services. Course progress is a scaffold step, not a PQCMM level the learner holds.
Lesson 5.1 used PQCMM-aligned, PKIMM-aligned, dual certificate architecture, and submit as direct compliance evidence. Neither lesson had an under-review note.
Now
Those phrases use the approved scaffold and assessor-decides wording. A personal completion certificate is from Plain PQC. Both lessons open with the under-review note that PKIC has not reviewed or endorsed the lesson.
Why
Amy approved wording-only alignment and endorsement fixes in 5.1 and 5.2 while the lessons stay on hold for content. PKIC has not reviewed or endorsed this course.
Several lessons said course work satisfies PKIMM Knowledge and Training, constitutes a Level 3 evidence package, or is the format assessors expect. Lesson 1.7 said regulators and auditors use PKIMM. The Unit 2 worksheet rated products with learner-scaffold level hints.
Now
Those lessons say course outputs can support Knowledge and Training evidence and that the assessor decides what counts. Lesson 1.7 attributes PKIMM to the PKIMM Working Group. The Unit 2 worksheet rates products with official PQCMM product summaries and notes that the Lesson 0.4 scaffold is for learners only.
Why
Nothing may imply PKIC reviewed, endorsed, or certified this course or a learner result. Official PQCMM assesses products and services. Official PKIMM is an organizational self-assessment; there is no PKIMM certification product.
Lesson 0.4 compared PQCMM and PKIMM in the lesson body and did not offer a printable three-model card.
Now
A Lesson 0.4 resource page, Maturity models at a glance, compares official PQCMM, PKIMM, and CMMI. PKIMM uses Foundational, not Basic, and 16 categories. Official PQCMM places a full CBOM at Managed; the course scaffold still uses a CBOM as the Unit 3 artifact.
Why
A draft handout reused PKIMM 1.0.0 labels (Basic, 15 categories). Learners need the current names next to CMMI so they do not mix the ladders.
Lesson 0.3 Part 2 showed the Mosca inequality cards with no link to Mosca explaining the inequality.
Now
Part 2, after the X + Y > Z cards, includes an optional watch callout to the CPI Talk Are we ready for the quantum era? on the University of Waterloo Cybersecurity and Privacy Institute channel, starting at the inequality.
Why
Amy asked to add a university-channel recording of Mosca as extra watching after the inequality, without embedding a player or putting dated timeline estimates in the lesson.
Lesson 0.1 Going deeper listed Feynman's Messenger Lecture, IBM's qubit explainer, Aaronson's Democritus chapter, and Feynman's 1982 paper. It did not include a video of Aaronson.
Now
Going deeper leads with Scott Aaronson's public lecture The TRUTH About Quantum Computing (YouTube, Simons Center for Geometry and Physics) as optional extra watching after the lesson.
Why
The lecture matches this lesson: what a quantum computer is, why parallel-universe metaphors fail, and why Shor's algorithm is the problem for today's public-key cryptography. Amy asked to add it as additional learning.
Lesson 3.2 treated a sample certificate expiry as a current March 2026 deadline, and Lesson 4.1 described the hybrid window as 4–6 years through 2030–2032.
Now
Lesson 3.2 marks its sample certificate date as an example, and Lesson 4.1 describes the hybrid window relative to NIST's proposed dates.
Why
The sample date is example data, not a live deadline, and the hybrid-window length should stay tied to NIST's proposed transition dates rather than a calendar prediction.
Source pointers were plain-text “See Sources and updates.” phrases, and some lesson text and interactive tools still used dated “now” phrasing or calendar-year predictions.
Now
Source pointers across the course are now compact links. Removed remaining dated phrasing and predictions from lesson text and interactive tools.
Why
Plain-text pointers repeated on every card. Compact links stay visible without crowding the lesson, and dated “now” or prediction phrasing goes stale.
Several lesson paragraphs, cards, and tables in Units 0–2 stated figures or current-status claims without a pointer in the same place. A short cleanup list still used dated hiring, rarity, maturity, and wallet phrasing in Lessons 2.1, 3.1, 3.4, 5.3, and 5.8.
Now
Added pointers to Sources and updates wherever lessons state figures that change, and removed remaining dated phrasing.
Why
Figures and product-status claims change. The lesson should send the reader to Sources and updates instead of leaving a snapshot that will go stale.
Lessons 0.1 and 5.4 implied a Q-Day within this decade. Lesson 2.1 described CMVP PQC certificates as of late 2024. Lesson 5.8 dated did:x509 to 2025 and named Microsoft. Quizzes in 1.6, 5.3, 5.4, 5.7, 2.6 and 4.1 used figures or fabricated dates that change. Lesson 1.7 tied CNSA 2.0 to CMMC. Lesson 2.6's EU calculator used 2028 and notes that did not match the 1.6 sector table.
Now
Lessons 0.1 and 5.4 no longer predict when a quantum computer will arrive. Lesson 2.1 now points to the CMVP search for current PQC validations instead of a late-2024 snapshot. Lesson 5.8 points to Sources for did:x509 status; quizzes in 5.3, 5.4, 5.7, 2.6 and 4.1 no longer depend on figures that change. Lesson 1.7 clarifies that CNSA 2.0 deadlines apply to contractors supplying national security systems, and Lesson 2.6's calculator uses the EU roadmap dates.
Why
The course rule is no Q-Day date and no prediction of when a quantum computer will arrive. Status claims and quiz figures that go stale should point at Sources instead of a snapshot.
Lessons 4.3 and 4.4 used different HSM counts and prices from Lesson 4.7, and 4.3 used a $45–85M total. Lesson 3.1 named a maturity-model level as required evidence.
Now
VBG case-study figures in Lessons 4.3, 4.4 and 4.7 now agree: Lesson 4.7 is the reference. HSM counts and prices are labelled by scope, and all figures are marked as illustrative. Lesson 3.1 now describes maturity-model evidence without a level number.
Why
Amy decided on 27 September 2026 that Lesson 4.7 sets the official VBG figures. Other lessons point to it and keep both HSM counts and both price bands, labelled by scope.
The 2027 card in Lesson 1.6 still said civilian agencies follow OMB/CISA guidance. Lessons 1.7 and 2.5 dated a CA/B Forum PQC requirement. Lesson 2.6's calculator used federal 2026, CMMC 2026, FFIEC 2028, HIPAA 2030, and a hard-coded 2025 year, and dated CNSA 2.0 to 2024. Lesson 4.4 Q3 option D feedback named 2029. Lesson 4.5 still said OpenSSL 3.2+ in two checklist rows.
Now
Lessons 1.6, 1.7, 2.5 and 2.6 now use the same verified deadlines as the Lesson 1.6 sector table (EO 14412, OMB M-26-15, CNSA 2.0, CA/Browser Forum status). Lesson 2.6's deadline calculator now uses the current year automatically. Lesson 2.6 corrects the CNSA 2.0 publication year to 2022. Removed an unsourced year from a Lesson 4.4 quiz, and aligned remaining OpenSSL references to 3.5.
Why
Those sentences contradicted the verified 1.6 sector table from Batch O (#84) and leftovers from Batch P.
Some lessons applied Grover's algorithm to Curve25519/Ed25519, dated CNSA 2.0 new acquisitions to 2026, treated NIST 2030/2035 as final policy, cited OpenSSL 3.x or 3.2, and described HSM PQC as firmware-only.
Now
Lessons 3.1, 3.3 and 3.6 now state correctly that Curve25519/Ed25519 is broken by Shor's algorithm. Lesson 1.7 now gives the same CNSA 2.0 date as Lesson 1.6 (1 January 2027 for new acquisitions). Lessons 1.5, 1.6, 2.4, 2.6, 3.3, 3.5, 4.1 and 4.3 now describe NIST's 2030/2035 dates as proposed (IR 8547, initial public draft). Lessons 1.1, 1.2 and 4.5 now consistently cite OpenSSL 3.5 as the first release with native ML-KEM. Lessons 5.3 and 4.4: corrected HSM upgrade path and removed an unsourced date.
Why
These sentences contradicted other lessons or treated draft NIST dates and OpenSSL versions as settled. The audit file (#83) listed them as P1 accuracy items.
Lesson 1.6 combined US federal and national security systems, gave US financial services a 2028–2030 deadline, healthcare a 2030 HIPAA update, defense contractors 2025–2026 under CMMC, and CA/B Forum expected 2026–2028 requirements.
Now
Lesson 1.6's sector deadline table now reflects Executive Order 14412 and OMB M-26-15 for US federal agencies, splits out national security systems, adds Canada's federal roadmap, and removes deadlines that no primary source supports (US financial services, healthcare, defense contractors, CA/Browser Forum).
Why
Amy verified the primary sources on 27 September 2026. The old sector dates were not supported by those documents.
Lesson 4.2 Q2 wrong-answer feedback, Persona B pbb, and Pattern C Best for still described a Bridge CA as the pattern for devices that cannot be updated or unmanageable device populations.
Now
Lesson 4.2 now consistently describes Bridge CA as the pattern for devices whose trust stores can't be updated.
Why
A Bridge CA avoids trust store updates. Devices still need firmware that can verify post-quantum signatures. Devices that cannot be updated at all need replacement (Lesson 4.4).
Lesson 4.2 Pattern C said a Bridge CA solved IoT without physical replacement and with no change on legacy devices. Quiz Q2 asked only about trust store updates. Lessons 4.1 and 4.4 headers said 3 comprehension checks.
Now
Lesson 4.2 now explains that a Bridge CA avoids trust store updates, but devices still need post-quantum-capable firmware or replacement. Fixed quiz-count headers in Lessons 4.1 and 4.4.
Why
A Bridge CA path starts at the already-trusted classical root. It does not make the chain fully quantum-safe, and it does not replace firmware that cannot verify ML-DSA (Lesson 4.4).
Lesson 4.2 Pattern B still said there was no need to distribute an entirely new root, next to a con that trust store updates are still required. Lesson 1.5 told learners to build a new hierarchy instead of converting the old root in place, without naming root key rollover.
Now
K2: Lesson 4.2 clarifies that root key rollover keeps the CA identity but still distributes the new root certificate. K3: Lesson 1.5 aligns its root-migration wording with Lesson 4.2. K1 was already applied in J.
Why
Pattern B on the page is a same-identity key rollover (Batch J). Converting a classical key into a post-quantum key is not a path (G4).
After Batch I, Lesson 4.2 titled Pattern B a cross-signed transition (new post-quantum root, old root cross-signs new) while the advantages and trade-offs still described an in-place / same-CA key change.
Now
Lesson 4.2 now describes Pattern B as a root key rollover that keeps the CA identity and cross-signs the old and new keys. The quiz and decision table use that name.
Why
An existing RSA/ECC key cannot become post-quantum (Lesson 1.5 / G4). Same CA identity with a new post-quantum key, linked by cross-signatures, is a valid rollover. The H3 two-root wording made the leftover in-place bullets contradict the label.
Lesson 4.2 still described Pattern B as in-place migration in the decision table, personas, and quiz. Lesson 0.3 still said 2025 data was decrypted in 2033. Lessons 3.1–3.5 and 4.4 used placeholder alerts instead of next-lesson navigation. Lessons 5.4–5.7 Continue buttons had no href. Lesson 4.5 header said 3 comprehension checks.
Now
I1: Lesson 4.2 now describes Pattern B consistently as a cross-signed transition, including the quiz. I2: Lesson 0.3 no longer names 2025/2033 in the HNDL closer. Fixed navigation and quiz-count errors in Lessons 3.1–3.5, 4.4, 4.5 and 5.4–5.7.
Why
Pattern B on the page is a cross-signed transition (H3). The course does not predict a Q-Day year (H5). Next-lesson buttons and quiz-count headers should match what is on the page.
Lesson 4.1 nextLesson() alerted that 4.2 was still being built. Lesson 5.3 Continue did not navigate. Lesson 4.2 Pattern B described generating new ML-DSA keys for the existing root CA and re-issuing that root. Lessons 5.3–5.8 headers said 3 comprehension questions. Lesson 0.3 said 2025 communications become readable in 2033.
Now
H3: Pattern B is a cross-signed transition — keep the classical root, stand up a new post-quantum root, and use a cross-signature for reach during the window. It does not make the classical chain quantum-safe. H5: the 0.3 Decrypt step now says communications recorded today could become readable years from now if a large enough quantum computer is built. Fixed navigation and quiz-count errors in Lessons 4.1, 5.3–5.8.
Why
An existing RSA/ECC root cannot become post-quantum (Lesson 1.5 / G4). The course does not predict a Q-Day year. Next-lesson buttons and quiz-count headers should match what is on the page.
Lesson 1.6 still named SP 800-131A Rev 3 as the RSA/ECC transition timeline. The 1.6 term box and Part 2 used different IR 8547 draft sentences. 1.6 said NIST depreciates an algorithm. Lesson 1.5 said an intermediate is re-signed by an already-migrated root CA, and Persona C cited OpenSSL 3.2+. Lessons 1.1 and 1.2 treated OpenSSL 3.2 as the PQC-capable release. After G5, 1.2 Q3 had two OpenSSL 3.5 answers. Lesson 2.4 Persona C still said OpenSSL 3.2+ supports hybrid ML-KEM. Lesson 1.7 NIST org-explorer role still named SP 800-131A Rev 3 as the deprecation timeline. Lesson 2.5 said PKIC has 450+ members.
Now
G1: 1.6 objective and 2030 card attribute the RSA/ECC timeline to NIST IR 8547. G2: 1.6 term box and Part 2 use the same IR 8547 initial-public-draft wording and point at Sources. G3: 1.6 depreciates → deprecates. G4: 1.5 intermediate is issued by a new post-quantum root CA. G5: 1.5, 1.1, and 1.2 name OpenSSL 3.5, not 3.2, as the PQC-capable release. G6: 2.5 member count is hundreds of member organizations. G8: 1.2 Q3 option d is OpenSSL 3.2, so 3.5 is the only correct answer. G9: 2.4 Persona C says OpenSSL 3.5 and later support hybrid ML-KEM. G10: 1.7 NIST org-explorer role attributes the transition timeline to IR 8547.
Why
These leftover sentences contradicted Batch C attributions already used in 0.2, 1.2, 1.3, and 1.7. Figures that will move keep pointing here.
Lessons already taught PKIMM 2.0.0 as 16 categories with Cryptography under Governance and the retired Excel tools, but they did not say the version had been released. Lesson 4.6 used unofficial labels (CP/CPS, CLM, Incident Response, Crypto-Agility). Lesson 5.5 still said the working group was expanding coverage and told new members to download the assessment tool.
Now
Lessons 1.7, 4.6, and 5.D state that PKIMM 2.0.0 was published 25 September 2026. Lesson 4.6 uses official category names, adds the Policies and documentation certificate-validation requirement, notes catalog traceability for approved algorithms, and points at the optional PQC Readiness Extension 0.6.0 as under development. Lesson 5.5 current-focus and first-action lines match the published web tool.
Why
The PKI Consortium tagged and published PKIMM 2.0.0 on GitHub and pkic.org on 25 September 2026. Same-day model changes added certificate validation and catalog traceability. The PQC extension remains optional and unfinished.
Unit 0 used millions-of-qubits wording, an unsourced TLS-certificate count, and an unsourced 300-trillion-year factoring figure. Lessons 0.2 and 1.6 attributed the RSA/ECC calendar to SP 800-131A Rev. 3 as if it were final. Lesson 1.2 cited OpenSSL 3.2+ via OQS. Lesson 1.3 described converting a root in place. Lesson 1.6 used relative-year labels and a 2026 CNSA date. Lesson 1.7 stated 450+ PKIC members.
Now
C1: 0.1 qubit requirement points at Sources. C2: 0.1 superposition, library, and entanglement wording. C3: 0.2 cites Gidney 2025 and Sources. C4: dropped the unsourced TLS certificate count. C5: dropped the unsourced 300-trillion-year figure. C6: 0.2 timeline attributed to NIST IR 8547 (IPD). C7: 1.2 OpenSSL 3.5+ native ML-KEM and IR 8547 draft. C8: 1.3 new-root wording. C9: 1.5 OpenSSL 3.5+, CA roadmaps, parallel-hierarchy note. C10: 1.6 IR 8547 attribution, no relative-year labels, CNSA 2.0 from 2027. C12: 1.7 member count is hundreds, not 450+.
Why
Udemy highlight videos are meant to stay current by pointing at the live site. The site has to hold accurate, sourced figures, and every figure that will move has to point here.
Lessons 0.1 and 0.2 say a cryptographically relevant quantum computer will require millions of physical qubits.
Now
Applied in Batch C items C1 and C3 (24 September 2026). Lesson 0.1 no longer states a millions figure. Lesson 0.2 cites the 2025 Gidney estimate (under one million noisy physical qubits, about a week) and points here for later updates. No CRQC exists. Do not write CRQC by 2029 as a course deadline.
Why
The millions line was the earlier Gidney-era picture. 2026 resource papers and Scott Aaronson's own posts treat that figure as the older estimate. The standing claim does not change: no CRQC exists, do not name a Q-Day, migrate because of Harvest Now, Decrypt Later.
Lesson 3.4 named a short fixed tool list and described CBOMkit-theia as scanning source. Lesson 3.1 did not mention a bill of materials linking out to a vulnerability report. Lesson 3.5 did not mention contract fields for an SBOM URL and a Known Vulnerability Report URL.
Now
Lesson 3.4 points at the PKIC tooling registry, keeps category examples, and states that CBOMkit-theia (Post-Quantum Cryptography Alliance) finds material in container images and directories and does not scan source. Lesson 3.1 adds a callout on the SPDX VDR-pointer pattern and the curl vulnerability table as an example. Lesson 3.5 mentions NAESB-style SBOM URL plus Known Vulnerability Report URL language without claiming CBOM is required or that the Word file is a finished standard. Lesson 3.2 keeps CycloneDX 1.6 as the teaching format and notes that 1.7 exists. Lesson 5.5 notes that CBOM Profiles map onto SPDX and CycloneDX.
Why
The PKIC registry, SPDX 2.3 Annex K.1.9, and the NAESB cybersecurity addendum draft are the documents learners will meet in procurement and inventory work. The lessons needed to match those primary pages.
Course labels included Unaware / No awareness (0), Initial action (1), Production-ready / Developing (2), and Inventoried / Defined (3).
Now
Headings use the official PQCMM names: None, Initial, Foundational, Advanced, Managed, Optimized. Learner-scaffold descriptions stayed in place. Some unit titles still use older short names.
Why
PQCMM v1.0.1 publishes official names. The course can still explain the scaffold, but it should not invent different level titles.
The course used PQCMM levels as a personal scale without saying that official PQCMM assesses products and services.
Now
Lessons state that official PQCMM assesses products and services in the supply chain, and that this course adapts the same six-level structure as a personal learning scaffold.
Why
A learner who later opens the PKIC PQCMM page would otherwise think the course was claiming official individual or organizational certification.