For your role
Boards and directors
Practical guidance for the decision, evidence and service this role owns.
The question
“How would we know if our encryption stopped protecting us, and who is accountable?”
Require a named owner, an evidenced Q-Risk posture, gate status, material exceptions and decisions requiring governing-body action.
Why it is urgent for this role
Long-lived data may need protection before a cryptographically relevant quantum computer exists. Boards also need a record showing who owns the risk, what evidence was reviewed and why funding or acceptance decisions were made.
Start with one free document
Annex D, governing body insert template. No form.
The service that fits
Board Governance. A documented oversight process the minutes can show.
Sample deliverable
Does the board need to choose algorithms?
No. The board sets accountability, risk appetite and decision thresholds. Technical owners provide the inventory, evidence and migration options.