Imagine you've just bought a state-of-the-art deadbolt for your front door. It's pick-proof, drill-resistant, certified by every locksmith association on Earth. But nobody's told you how to install it, your door frame is from the 1970s, and the screws in the box don't fit. That's where post-quantum cryptography sits right now. NIST has standardized the algorithms — ML-KEM, ML-DSA, SLH-DSA — and they're solid. The problem this paper maps is everything else: how do you get those algorithms into actual shipping software without leaving gaps that make the whole exercise pointless? This SoK (Systematization of Knowledge) surveys the existing literature on PQC integration across implementation libraries, migration strategies, and developer education. The committed claim: existing work provides important technical and organisational foundations but offers disconnected, lifecycle-fragmented support. Preparation, implementation, migration, deployment, maintenance, and developer practices are each addressed in isolation. Nobody has stitched them into a coherent end-to-end pipeline. The paper evaluates existing approaches against five lenses: alignment with NIST PQC standards and migration guidance, coverage of software development lifecycle phases, cybersecurity best practices, deployment maturity, and testing/evaluation evidence. The finding that cuts deepest: evaluation evidence is concentrated in controlled or early-stage settings. Translation: people have demonstrated that PQC libraries compile and pass unit tests, but almost nobody has stress-tested migration in production-grade systems with real traffic, real latency budgets, and real key management headaches. Architecturally, this is a survey-and-gap-analysis paper, not a systems paper. It belongs to the SoK tradition in security research — synthesizing a fragmented subfield to make the gaps visible. The method is structured literature analysis against well-defined evaluation criteria. There's no new algorithm here; the contribution is the map itself. The paper leans on NIST's published PQC standards and migration guidance as its normative anchor, which is the right call — NIST is the de facto referee for this space. The integrity picture is mixed in the way all SoKs are: the authors can only be as strong as the primary literature they survey, and they're honest about its limits. They flag that most existing evaluation evidence shows technical feasibility, not operational readiness. What they don't do is quantify the gap — how many of the surveyed approaches have been tested at scale, what percentage cover more than two lifecycle phases, what the median deployment maturity level is across the literature. Numbers would have made the gap analysis much sharper. The milestone question for this subfield isn't about algorithm performance — it's about migration completeness. Right now, the field needs a reference implementation that takes a real-world TLS stack from classical to hybrid to pure PQC across key exchange, authentication, and certificate chains, validated in a production environment with measured performance overhead. That's the next gate. The paper doesn't name this milestone explicitly, but the gap analysis points directly at it. The obvious next experiment the authors didn't run: an empirical developer study. They identify developer education as a gap, but didn't test whether developers using existing PQC migration guidance actually produce secure implementations. This is almost certainly a scope/resource constraint — developer studies are expensive and slow — but it's the experiment that would convert their gap analysis from descriptive to prescriptive.
