Module 120 minutes
The Quantum Threat in Plain Terms
Harvest now, decrypt later.
The question: Why does a machine that does not exist yet matter today?
You keep: Lead-time sheet: secrecy years, migration years, scenarios
Specialist programmePost-Quantum Readiness for Security and Finance Leaders
A programme, not a mathematics lecture. Inventory your cryptography, prioritise it, plan the migration and brief the board.
- 6 modules
- About 2 hours 30 minutes
- 6 artefacts you keep
- 30-day plan
Who it is for
For the leaders who will own the migration.
CISOs, security architects, technology risk managers and IT leaders in banks, insurers and critical infrastructure.
The problem
NIST published its first post-quantum standards, FIPS 203, 204 and 205, in August 2024. The standards exist. What most organisations lack is an inventory, a priority order, a budget and an owner.
You leave with an inventory and a migration roadmap for one business unit.
Outcomes
By the end, you can
- Explain harvest now, decrypt later, and estimate your lead time from data lifespan and migration time.
- Name the new standards (ML-KEM, ML-DSA and SLH-DSA), what they replace and when to run hybrid modes.
- Start a cryptographic inventory across network, identity, data and suppliers.
- Score systems for crypto-agility so the next algorithm swap costs less.
- Rank migration by urgency and effort, with a first step and one owner for each item.
- Brief the board on risk, cost range, timeline and the decisions you need from it.
Outline
Six modules. Each ends with something you keep.
Every module answers one question, then you apply it in a timed exercise on a fictional case and complete the artefact before you move on.
Module 225 minutes
The New Standards
What was published and what it replaces.
The question: Which algorithms replace the ones we use, and how final are they?
You keep: Standards map
Module 330 minutes
Building a Cryptographic Inventory
Find every place cryptography lives.
The question: How do you find what you do not know you have?
You keep: Cryptographic inventory, first twenty rows
Module 425 minutes
Crypto-Agility
Design systems that can swap algorithms.
The question: How do you avoid doing this migration again in ten years?
You keep: Agility scorecard
Module 525 minutes
Prioritising Migration
Data lifespan and business risk.
The question: What do we migrate first, and what can wait?
You keep: Prioritised migration list
Module 625 minutes
The Board Briefing
Cost, timeline and accountability.
The question: What do you ask the board to decide, and what do you promise?
You keep: Board briefing one-pager and roadmap
CapstoneThen a 30-day plan
Apply it to your own organisation
A cryptographic inventory and a prioritised migration roadmap for one business unit.
- Week 1. Pick one business unit. Start the cryptographic inventory with certificates and TLS endpoints.
- Week 2. Ask the ten most critical vendors a standard set of supplier quantum questions.
- Week 3. Score the inventory by data lifespan and migration time. Rank the top ten.
- Week 4. Brief the board: cost, timeline, accountability and the first three decisions.
What you produce
Six artefacts, one binder.
A programme you can start on Monday.
- Module 1Lead-time sheet: secrecy years, migration years, scenarios
- Module 2Standards map
- Module 3Cryptographic inventory, first twenty rows
- Module 4Agility scorecard
- Module 5Prioritised migration list
- Module 6Board briefing one-pager and roadmap
Capstone: A cryptographic inventory and a prioritised migration roadmap for one business unit.