The governance
Ownership, funding, and accountability
A migration program without a named owner and a budget line is a set of good intentions — this is how leaders make it real.
6 min read · 5 min 22 sec film
What you'll be able to do
- Assign the roles a migration program needs to be accountable rather than aspirational.
- Sequence funding against inventory and prioritization results instead of a single lump sum.
- Use time-bound exceptions instead of indefinite risk acceptance.
Lesson film
Watch: Ownership, funding, and accountability
A permanent waiver and an expiring exception look identical on the day they are signed. By year three they are nothing alike.
5 min 22 sec · 7 scenes
5 min 22 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
Everything so far produces a plan. The decision, the inventory, the prioritisation — all of it lands as a document.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. From plan to programme
2. Four roles
3. Fund it in phases
4. Exceptions will happen
5. The difference shows up later
6. The five-minute test
7. Takeaway
The written lesson
Everything so far in this course, the decision, the inventory, the prioritization, produces a plan. A plan without an owner and a budget line is a document. This lesson is about making the plan real.
| Role | What it is accountable for |
|---|---|
| Executive sponsor | Funding the program and representing it to the board; removing organizational blockers no individual team can clear |
| Program owner | Running the inventory, prioritization, and migration schedule day to day; the person who can answer "where are we" without a special meeting |
| Per-system owners | Each inventory entry has one — the person accountable when that specific system is the one still on the list |
| Budget owner | Approving a justified funding approach, potentially phased, with uncertainty and review gates visible |
Phased funding tied to discovery and prioritization is often useful while evidence is incomplete. An initial tranche can fund inventory and the first pilot, followed by a decision on the next tier. If a board needs an annual commitment, provide a provisional range, assumptions, reserve, and re-estimation gate rather than a falsely precise total or no estimate at all.
Accountability means a responsible leader can promptly retrieve an accurate exception register and explain scope, residual risk, owner, approval authority, and review date. Memorizing every exception is neither necessary nor reliable.
A phased budget is often easier to defend when the inventory is incomplete, but a board may still need a provisional range and reserve for shared infrastructure. Present the basis, uncertainty, and next funding gate. Do not treat one precise up-front number or a refusal to estimate as the only alternatives.
| Exception field | Decision question |
|---|---|
| Scope and reason | Which asset and specific obligation cannot meet the date, and why? |
| Residual risk and alternatives | What remains exposed after compensating measures; can the service retire or isolate sooner? |
| Authority | Who is permitted to accept this risk or reject the exception? |
| Expiry and triggers | When will it be reviewed, and which vendor, incident, or standard change triggers earlier review? |
An expiry date makes a decision reviewable; it does not make the underlying risk acceptable. A high-impact case may require additional controls, a shorter date, or rejection. Maintain a register that a responsible leader can retrieve and explain promptly.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- SP 800-30, Revision 1: Guide for Conducting Risk AssessmentsNIST · Final guidance · checked 2026-09-26
- TR 104 016: A Repeatable Framework for Quantum-Safe MigrationsETSI · Published technical report · checked 2026-09-26
Marking a lesson complete only updates this browser.