The governance
Validation, monitoring, and the questions to ask
Migrating once is not the same as staying migrated — how to validate a claim, monitor for drift, and the specific questions worth asking your own teams.
5 min read
What you'll be able to do
- Explain why validation and continuous monitoring are separate steps from migration itself.
- Recognize the organizational patterns that cause migrated systems to regress.
- Use a concrete set of questions to test whether a team's progress claim holds up.
A system that migrated successfully six months ago is not necessarily migrated today. Dependencies get upgraded and quietly reintroduce an old default. A certificate renews through a process nobody updated. A new service ships from a copied, outdated configuration template. Post-quantum migration does not remove the need for the rest of a security program: a well-migrated system that nobody watches is still a system nobody watches.
This is why validation and continuous monitoring are separate line items from the migration itself, not an afterthought. Validation confirms a specific claim is true right now. Continuous monitoring confirms it stays true after the next release, the next dependency upgrade, and the next acquisition.
None of this replaces judgment. Ask your own teams directly, on a schedule, and expect specific answers, not reassurance.
| Question to ask | A good answer sounds like | A worrying answer sounds like |
|---|---|---|
| Do we have a complete cryptographic inventory, including vendors? | Here is what we have, here is what we are still missing, and here is who owns closing each gap. | Yes, it is done. (With no detail on scope, vendors, or ownership.) |
| How did we prioritize what migrates first? | By data lifetime, exposure, and harvestability, with the reasoning documented per tier. | We started with whatever was easiest to change. |
| What happens when a system misses its migration deadline? | It becomes a time-bound exception with a named owner and a review date. | It quietly drops off the list. |
| How do we know a migrated system has not regressed? | Continuous monitoring and a release gate catch reintroductions before they ship; here is the last time it caught one. | We checked it once when we migrated it. |
| What is our position on authentication, not just key exchange? | Key exchange is hybrid in most places; authentication is still classical, and here is our plan and timeline for it. | We are fully post-quantum. (Without distinguishing key exchange from authentication.) |
| What would change our prioritization tomorrow? | A new regulatory deadline, a vendor announcement, or new evidence about a specific system, and here is who monitors for that. | Nothing — the plan is fixed. |
Marking a lesson complete only updates this browser.