Governance, Risk, and Compliance for the Migration
PQC migration affects nearly every compliance framework an organization is subject to. Governance, risk, and compliance professionals need to map migration requirements to the frameworks they manage and build the risk assessments that justify the program. They also need to produce the evidence that auditors and regulators will demand. This course covers the GRC dimension of PQC migration in depth.
Course Outline
Module 1 Mapping PQC to Compliance Frameworks
How PQC migration maps to major frameworks: ISO 27001, SOC 2, PCI DSS, HIPAA, CMMC, FedRAMP, DORA, and NIS2. Which controls are affected. How cryptographic requirements appear (and are changing) in each framework. Building a cross-framework compliance view for migration.
Module 2 Risk Assessment for PQC
Conducting quantum risk assessments within existing risk management frameworks. Quantifying quantum exposure for the risk register. The HNDL and TNFL threat models in risk assessment terms. Integrating quantum risk into enterprise risk management and board reporting.
Module 3 Evidence and Audit Frameworks
Producing compliance evidence for PQC migration. What auditors will look for. Structuring documentation as audit-ready evidence. Mapping migration activities to control requirements. Demonstrating progress and compliance during a multi-year transition.
Module 4 Vendor Risk and Third-Party Compliance
Assessing vendor PQC readiness as a GRC function. Third-party risk management for cryptographic dependencies. Contractual and compliance requirements for vendors. Building PQC readiness into vendor assessment frameworks and procurement processes.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CGRC, CRISC and CISA holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Governance, risk, and compliance professionals, internal audit, and second-line risk functions who have to assure a migration they will not run. Also the migration leads who have to satisfy them.
If you are doing the technical work yourself, PQCS Specialist Training is the better route.
What you’ll be able to do afterward
- Map PQC requirements to ISO 27001, SOC 2, PCI DSS, HIPAA, CMMC, FedRAMP, DORA, and NIS2
- Design risk assessment methodologies for quantum exposure
- Define audit evidence and documentation requirements for PQC migration
- Assess third-party and vendor quantum readiness through structured evaluation
- Build the regulatory horizon-scanning function as a standing role
- Structure board-level risk reporting on PQC program status
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training provides the background for this course. You can take this course without either. PQC Vendor Governance covers third-party assurance, and PQCV Validator Training leads to the credential.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
