Quantum Risk, The CISO’s Assessment
As a CISO, you need more than an awareness briefing. You need to assess quantum exposure against your specific risk profile, determine whether and when to launch a migration program, design the program’s governance structure, frame the budget conversation, and communicate the risk to your board in terms that drive appropriate action without creating panic.
This course is built for that conversation. It goes deeper than the executive briefing into threat modeling, regulatory analysis, program design, and budget framing, the specific competencies a CISO needs to own the quantum risk decision.
Course Outline
Module 1. Threat Assessment for Your Organization (60 minutes)
CRQC timeline analysis: how to build a defensible assessment from published research rather than vendor timelines or media predictions. Mapping HNDL exposure across your data estate: which data has sensitivity windows (regulatory, contractual, competitive) that extend 10, 15, or 20+ years. Mapping TNFL exposure: which signing systems (software updates, legal documents, financial transactions) could be targeted. Risk quantification approaches for quantum exposure. Integrating quantum risk into your existing enterprise risk management framework.
Module 2. Regulatory and Compliance Assessment (60 minutes)
Every regulatory requirement that applies to your organization, mapped to specific actions. CNSA 2.0 implications for government contractors and suppliers. EU directives and NIS2 crypto-agility requirements. DORA for financial services. Sector-specific mandates. Insurance questionnaire trends. Client and partner contractual expectations. Building a compliance calendar that keeps migration on track.
Module 3. Program Design and Budget (60 minutes)
Designing a PQC migration program: governance structure, phasing (discovery, planning, implementation, verification, operations), resourcing, and vendor strategy. The vendor dependency problem and how to mitigate it. Budget construction: what each phase costs, what drives cost variation, and how to build contingency. ROI framing: quantified risk reduction, regulatory compliance value, insurance premium implications, and competitive positioning. The budget conversation: presenting to CFOs and boards.
Module 4. Board Communication and Ongoing Governance (60 minutes)
Structuring board-level quantum risk communication: the threat, the exposure, the plan, the ask. Avoiding both fear-based messaging and dismissive minimization. The board-briefing toolkit: templates, metrics, and reporting frameworks. Setting expectations for migration milestones and reporting cadence. Ongoing governance: how quantum risk monitoring changes as the CRQC timeline evolves and as migration progresses. Peer benchmarking: what CISOs at comparable organizations are doing.
Prerequisites
None. Designed for experienced security leaders.
Who this course is for
CISOs, Deputy CISOs, security directors, heads of security architecture, and senior security leaders. Also relevant for CROs and heads of operational risk at organizations with significant cryptographic exposure.
What you’ll be able to do afterward
- Assess organizational quantum exposure using Mosca’s inequality applied to your data classifications and system inventories
- Build a multi-year business case using regulatory deadlines, insurance requirements, and contractual obligations as budget drivers
- Design governance structures for PQC migration programs that align with existing enterprise risk management
- Define team composition across the five bench areas (cryptographic engineering, infrastructure/PKI, vendor management, GRC, program management)
- Assess vendor PQC readiness and create vendor engagement strategies
- Integrate PQC migration into existing security programs, compliance frameworks, and risk registers
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Nothing is required, and no technical background is assumed. PQC Migration: Building the Business Case for the funding argument, and the sector overview for your industry for the regulatory specifics.
Why we teach this
The material comes from Quantum Ready, the book on organizational readiness written by the course author, and from faculty who sit in these conversations on the other side of the table. We teach executives the questions we have watched go unasked.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. This is not a professional certification.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
