PQC for Leaders · Final assessment

12 questions, 80% to pass

Answer every question you can, then submit. Grading happens on our server, not in your browser, so the score behind your PQC for Leaders — Certificate of Completion reflects what you actually chose.

Question 1 of 12

Your CFO asks you to submit one number for the entire post-quantum migration in next year's budget, to be approved once and not revisited.

What is the accountable response?

Provide a single number based on a rough estimate, since a number is better than no numberDecline to give any figure until the inventory is completeRequest phased funding tied to the inventory and prioritization results: an initial phase for inventory and top-tier migration, with later phases funded against updated evidenceAsk engineering to name an algorithm-by-algorithm cost so the number sounds precise

Question 2 of 12

Midway through the program, your team reports the inventory is done, but cannot account for cryptography inside three SaaS vendors your organization depends on.

What should you conclude?

The inventory is complete enough to begin final prioritizationThe inventory has a specific, nameable gap — vendor cryptography — and is not yet completeVendor cryptography does not need to be inventoried because your organization does not control itThe team should restart the inventory from scratch

Question 3 of 12

A critical vendor will not say whether or when its product will support post-quantum algorithms.

What is the appropriate leadership response?

Drop the vendor dependency from the inventory since there is nothing you can do about itWait for the vendor to announce a roadmap before taking any actionLog it as a known gap with a named internal owner, raise it through procurement or contract channels, and revisit it on a scheduleEscalate only if a regulator specifically asks about that vendor

Question 4 of 12

An engineering lead proposes delaying all post-quantum work until the standards fully settle.

Given what NIST has actually published, how should you respond?

Agree, since no standards exist yetPoint out that ML-KEM, ML-DSA, and SLH-DSA are already final standards, published in August 2024, so that objection does not hold for core encryption and signatures, while acknowledging that a few areas, like the HQC backup algorithm, are still in progressAgree, but only for algorithms named in NIST IR 8547Disagree, and instead demand immediate migration of every system regardless of priority

Question 5 of 12

A business unit argues its systems are not a target for a nation-state adversary, so harvest-now-decrypt-later does not apply to them.

What is the flaw in that reasoning?

There is no flaw — harvest-now-decrypt-later only applies to nation-state targetsHNDL exposure depends on whether traffic is harvestable and how long the data must stay confidential, not on whether the unit believes it is an interesting targetHNDL only applies to government systemsThe unit is correct as long as it uses any encryption at all

Question 6 of 12

Your legal team asks which deadline actually applies to your organization: NIST IR 8547 or NSA CNSA 2.0.

What is the accurate answer?

Both are final rules that apply equally to every organizationNIST IR 8547 is an initial public draft proposing deprecation after 2030 and disallowance after 2035 — not yet binding; CNSA 2.0 is a published requirement that binds US national security systems and their vendors, with milestones into the early 2030sNeither applies to any organization outside governmentCNSA 2.0 is still a draft, while NIST IR 8547 is final law

Question 7 of 12

A vendor tells you their product is fully post-quantum compliant and considers the conversation closed.

What follow-up question matters most?

None — a compliance claim is sufficientWhat key size their algorithm usesWhether their architecture can adopt a future algorithm change without a redesign, given that the algorithm list itself is not finished — HQC was only selected as a backup in March 2025Whether their marketing team wrote the claim

Question 8 of 12

Your team reports that a migration is stalling because larger post-quantum certificates and handshake messages are breaking assumptions in an older protocol or piece of infrastructure.

How should a leader interpret this?

As a sign the team is making excuses and should push throughAs a known, common category of migration obstacle — protocol and infrastructure limits — that needs its own budgeted work, not just more pressure on the same teamAs proof the post-quantum standards are broken and the organization should waitAs irrelevant, since certificates are not part of the inventory

Question 9 of 12

Six months into the program, migration has stalled because no single person or team considers it their responsibility.

What is the most direct fix?

Send a company-wide reminder emailAppoint a named executive sponsor and a program owner with real budget authority, and assign every inventory entry a named system ownerWait for a team to volunteerEscalate directly to the board without naming an owner first

Question 10 of 12

A team declares a system *migrated* the day after deploying an update, with no further check.

What should a leader ask before accepting that status?

Nothing — a deployed update is sufficient proofWhat evidence confirms the new configuration is actually in effect and negotiated in production, not just shippedHow many other systems are still on the listWhether the update passed code review

Question 11 of 12

A system that passed validation eight months ago is found, during a routine check, to be negotiating classical-only cryptography again after a routine dependency upgrade.

What does this indicate about the program?

The original migration was fraudulentMigration is not a one-time event for this system — it needs continuous monitoring or a release gate to catch this kind of regression before it shipsDependency upgrades should be banned going forwardNothing — occasional regressions are not worth tracking

Question 12 of 12

A system owner requests to defer migration indefinitely, citing that the system is scheduled for eventual retirement *someday*.

What governance response is appropriate?

Approve the deferral with no further conditions, since retirement is a valid reasonDeny the request outright and force immediate migrationGrant a time-bound exception with a firm review date and a named owner, and require a real retirement date, not *someday*Remove the system from the inventory since it is being retired

0 of 12 answered. An unanswered question counts as incorrect, so it is safe to submit a partial attempt to see where you stand.