Governance, Risk, and Compliance for the Migration
PQC migration intersects with nearly every compliance framework an organization is subject to. Governance, risk, and compliance professionals need to map migration requirements to the frameworks they manage, build the risk assessments that justify the program, and produce the evidence that auditors and regulators will demand. This course covers the GRC dimension of PQC migration in depth.
Course Outline
Module 1. Mapping PQC to Compliance Frameworks
How PQC migration maps to major frameworks: ISO 27001, SOC 2, PCI DSS, HIPAA, CMMC, FedRAMP, DORA, and NIS2. Which controls are affected. How cryptographic requirements appear (and are changing) in each framework. Building a cross-framework compliance view for migration.
Module 2. Risk Assessment for PQC
Conducting quantum risk assessments within existing risk management frameworks. Quantifying quantum exposure for the risk register. The HNDL and TNFL threat models in risk assessment terms. Integrating quantum risk into enterprise risk management and board reporting.
Module 3. Evidence and Audit Frameworks
Producing compliance evidence for PQC migration. What auditors will look for. Structuring documentation as audit-ready evidence. Mapping migration activities to control requirements. Demonstrating progress and compliance during a multi-year transition.
Module 4. Vendor Risk and Third-Party Compliance
Assessing vendor PQC readiness as a GRC function. Third-party risk management for cryptographic dependencies. Contractual and compliance requirements for vendors. Building PQC readiness into vendor assessment frameworks and procurement processes.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background. Some courses assume security engineering experience.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. CPE credits earned may apply toward Quantum Academy certification maintenance.
Who this course is for
Governance, risk, and compliance professionals, internal audit, and second-line risk functions who have to assure a migration they will not run. Also the migration leads who have to satisfy them.
If you are doing the technical work rather than assuring it, PQCS Specialist Training is the better route.
What you’ll be able to do afterward
- Map PQC requirements to ISO 27001, SOC 2, PCI DSS, HIPAA, CMMC, FedRAMP, DORA, and NIS2
- Design risk assessment methodologies for quantum exposure
- Define audit evidence and documentation requirements for PQC migration
- Assess third-party and vendor quantum readiness through structured evaluation
- Build the regulatory horizon-scanning function as a standing role
- Structure board-level risk reporting on PQC program status
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training give the grounding this course builds on. Neither is enforced. PQC Vendor Governance for third-party assurance, and PQCV Validator Training for the credential.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. The people who teach this course are running migration programs inside organizations now, and the course covers what those programs hit.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.