The decision
Why this is a leadership decision
Post-quantum migration is a funding, sequencing, and accountability decision — this course teaches the decision, not the mathematics behind it.
6 min read · 5 min 36 sec film
What you'll be able to do
- State the business risk that post-quantum migration addresses without reference to cryptographic mathematics.
- Identify which decisions in a migration program belong to leadership rather than to engineering alone.
- Distinguish evidence engineering must establish from the funding and risk decisions leadership must make.
Lesson film
Watch: Why this is a leadership decision
The mathematics is somebody else’s job. The sequencing, the funding and the accountability are not, and they are what decide whether this works.
5 min 36 sec · 7 scenes
5 min 36 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
Post-quantum migration sounds like a cryptography problem, and that framing is the first thing worth setting aside.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. Not a cryptography problem
2. Two different questions
3. The business case
4. Who owns what
5. What you should be seeing
6. The thread
7. Takeaway
The written lesson
Post-quantum migration sounds like a cryptography problem. It is not the problem this course is about. The mathematics — what a quantum computer can and cannot break — is covered in PQC Foundations if you or your team ever need it. This course is about a different set of questions: who decides what gets migrated first, who pays for it, who is accountable when a system is missed, and how you know the program is actually working.
- Information whose remaining secrecy need may outlast migration. Contracts, health records, source code, and state secrets need a data-owner assessment of sensitivity and exposure; a retention period alone does not establish quantum risk.
- Regulatory and contractual exposure. Some deadlines already bind parts of the economy; more are being drafted.
- The cost of migrating under pressure instead of on a plan. Organizations that start late do not get a smaller project — they get the same project, compressed, competing with everything else for the same engineering time.
- Trust with customers and partners, who will eventually ask what your organization did about this, and when.
| Decision | Who typically owns it |
|---|---|
| Whether the organization funds a migration program now or later | CEO, CFO, board risk committee |
| What gets migrated first when everything cannot move at once | CISO, CTO, enterprise architecture |
| Who is accountable when a system is missed or an exception drags on | CISO, program owner, named system owners |
| Whether a migration is marked complete on a vendor claim or on evidence | CISO, security engineering leadership |
The rest of this course follows one thread: decide, inventory, prioritize, fund, govern, validate, and keep validating. None of it requires you to evaluate an algorithm.
A leader needs a decision brief, not just a list of algorithms: which information remains valuable, which systems and vendors protect it, what an initial effort buys, what is uncertain, and who owns the next decision. Engineering supplies evidence and viable technical paths; leadership chooses scope, risk tolerance, funding, and accountable owners.
Work it through
Turn a risk statement into a decision
A board asks whether to fund a short discovery phase. The organization knows it has long-lived customer records but has no system-level cryptographic inventory.
About 5 min of unscored practice
Your task
- Write the decision you want the board to make.
- State what the discovery phase will deliver, who owns it, and what you cannot yet promise.
Type here or copy the template. Your response stays in this page and is not submitted or scored.
Reveal model response and self-check rubric
A different answer can be sound when it states its assumptions and follows the evidence.
Authorize a bounded inventory and exposure assessment for the customer-record flows, with a named program owner and a follow-up funding decision after the first priority tier is documented. The team should return system and vendor coverage, data lifetimes, protection paths, assumptions, and candidate pilot costs. The organization cannot responsibly promise a total migration cost or completion date from the current evidence.
Self-check
For each point: 0 = absent or incorrect, 1 = partly supported, 2 = well supported.
- Request a bounded decision with a visible deliverable.
- Assign ownership and a reconsideration date.
- Distinguish evidence needed from conclusions already supported.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- TR 104 016: A Repeatable Framework for Quantum-Safe MigrationsETSI · Published technical report · checked 2026-09-26
- SP 800-30, Revision 1: Guide for Conducting Risk AssessmentsNIST · Final guidance · checked 2026-09-26
Marking a lesson complete only updates this browser.