Quantum Risk: The CISO’s Assessment
As a CISO, you need more than an awareness briefing. You need to assess quantum exposure against your own risk profile and decide whether and when to launch a migration program. You also need to design the program’s governance, frame the budget conversation, and explain the risk to your board clearly enough to prompt action without causing panic.
This course goes deeper than the executive briefing. It covers threat modeling, regulatory analysis, program design, and budget framing, the skills a CISO needs to own the quantum risk decision.
Course Outline
Module 1 60 minutes Threat Assessment for Your Organization
CRQC timeline analysis: how to build a defensible assessment from published research, without relying on vendor timelines or media predictions. Mapping HNDL exposure across your data estate: which data has sensitivity windows (regulatory, contractual, competitive) that extend 10, 15, or 20+ years. Mapping TNFL exposure: which signing systems (software updates, legal documents, financial transactions) could be targeted. Risk quantification approaches for quantum exposure. Integrating quantum risk into your existing enterprise risk management framework.
Module 2 60 minutes Regulatory and Compliance Assessment
Every regulatory requirement that applies to your organization, mapped to specific actions. CNSA 2.0 implications for government contractors and suppliers. EU directives and NIS2 crypto-agility requirements. DORA for financial services. Sector-specific mandates. Insurance questionnaire trends. Client and partner contractual expectations. Building a compliance calendar that keeps migration on track.
Module 3 60 minutes Program Design and Budget
Designing a PQC migration program: governance structure, phasing (discovery, planning, implementation, verification, operations), resourcing, and vendor strategy. The vendor dependency problem and how to mitigate it. Budget construction: what each phase costs, what drives cost variation, and how to build contingency. ROI framing: quantified risk reduction, regulatory compliance value, insurance premium implications, and competitive positioning. The budget conversation: presenting to CFOs and boards.
Module 4 60 minutes Board Communication and Ongoing Governance
Structuring board-level quantum risk communication: the threat, the exposure, the plan, the ask. Avoiding both fear-based messaging and dismissive minimization. The board-briefing toolkit: templates, metrics, and reporting frameworks. Setting expectations for migration milestones and reporting cadence. Ongoing governance: how quantum risk monitoring changes as the CRQC timeline evolves and as migration progresses. Peer benchmarking: what CISOs at comparable organizations are doing.
Prerequisites
None. Designed for experienced security leaders.
Who this course is for
CISOs, Deputy CISOs, security directors, heads of security architecture, and senior security leaders. Also relevant for CROs and heads of operational risk at organizations with significant cryptographic exposure.
What you’ll be able to do afterward
- Assess organizational quantum exposure using Mosca’s inequality applied to your data classifications and system inventories
- Build a multi-year business case using regulatory deadlines, insurance requirements, and contractual obligations as budget drivers
- Design governance structures for PQC migration programs that align with existing enterprise risk management
- Define team composition across the five bench areas (cryptographic engineering, infrastructure/PKI, vendor management, GRC, program management)
- Assess vendor PQC readiness and create vendor engagement strategies
- Integrate PQC migration into existing security programs, compliance frameworks, and risk registers
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Nothing is required, and no technical background is assumed. PQC Migration: Building the Business Case covers the funding argument. The sector course for your industry covers the regulatory specifics.
Why we teach this
The material is based on Quantum Ready, the book on organizational readiness written by the course author. It also draws on faculty who have been the decision-makers in these discussions. We teach executives the questions that too often go unasked.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM and CRISC holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
