TL;DR: Boards must act now because adversaries can harvest encrypted data today and decrypt it once quantum computers mature, and migrating cryptography across an enterprise takes years. Starting early protects long-lived data, avoids regulatory exposure, and turns a disruptive risk into a managed, budgeted program.
Step 1: Assign Ownership and Build the Case
Appoint an executive sponsor, typically the CISO with board oversight, and draft a one-page risk brief covering data sensitivity, regulatory timelines, and migration lead time. Tip: frame the initiative as data protection with a deadline, not as an IT science project.
If you want to dig deeper, check out our guide on Quantum-Safe Encryption: Why It’s Now a Board-Level Priority.
Step 2: Inventory Cryptography Everywhere
Discover where encryption, certificates, keys, and signatures are used across applications, infrastructure, vendors, and connected devices. Tip: prioritize systems protecting data with lifespans beyond ten years, such as health records, intellectual property, and financial archives.
Step 3: Adopt a Standards-Aligned Strategy
Direct teams to follow national and international guidance on post-quantum cryptography, including NIST standards and migration playbooks. Define an approved algorithm roadmap and a policy for hybrid approaches during transition. Tip: require cryptographic agility in all new procurement.
Step 4: Run a Pilot and Fund the Roadmap
Choose two or three high-value systems for a pilot covering discovery, testing, and rollout. Measure effort and cost, then convert findings into a multi-year budget with quarterly milestones. Tip: include vendor contract clauses requiring quantum-safe support and disclosure of cryptographic dependencies.
Step 5: Govern and Report Progress
Add a standing agenda item on cryptographic risk to board meetings, with metrics such as systems inventoried, migrated, and pending. Tip: rehearse incident response for a future “decrypt later” breach scenario to test readiness.
FAQ
Q: Is quantum computing a realistic near-term threat?
A: Large-scale quantum computers are not yet here, but long-lived data encrypted today can be stored and decrypted later, so exposure begins now.
Q: How long does migration take?
A: Most enterprises need three to seven years to inventory, test, and replace cryptography across systems and suppliers, which is why starting early matters.
Q: What is the board’s minimum first step?
A: Approve an owner, a budget line, and a deadline for completing a cryptographic inventory and a funded migration roadmap.
Leave a Reply