Insurers that write cyber cover have to manage two problems in one post-quantum cryptography (PQC) program. The first is the insurer’s own estate, where policy, claims, and medical underwriting data can stay sensitive for decades. The second is the cyber book, where underwriters decide what to ask insureds about quantum readiness and how to judge the answers. In this workshop, you build one program plan that covers both.
The Financial Services Extension of the Applied Quantum PQC Migration Framework notes that life policy records can stay sensitive for 30 years or more. Exchanges between carriers, brokers, and reinsurers create multi-party cryptographic dependencies, much like a payment chain, and the ACORD data standards used in insurance do not yet address PQC. For the cyber book, The Deadlines That Already Bind Your Cryptography argues that underwriters can already ask whether an organization keeps a cryptographic inventory and score the answer consistently.
We run this intensive as an eight-hour planning workshop, taught live online in two four-hour sessions or as private team training for one organization. You work from your own records or from a sample insurer we provide. No cryptography background is needed. You leave with a draft program plan, a year-one roadmap, and a first set of underwriting questions, with the assumptions you still need to check written down.
Who this intensive is for
Program managers and PMO leads, the CISO or CIO who will sponsor the program, and security architects. Cyber underwriting leads, actuarial and risk staff working on cyber exposure, and claims and policy wording specialists belong in the room too, as do vendor management and compliance. We recommend sending a mixed group from one insurer or reinsurer, ideally the people who would be members of its quantum readiness steering committee. At many insurers, the security team and the cyber underwriters work in different departments.
Bring at least one person from cyber underwriting. Many of the decisions in Modules 6 to 8 are underwriting decisions.
The intensive is for insurers and reinsurers. Banks and other financial institutions should take the Quantum-Safe Financial Services Intensive instead. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.
What you’ll be able to do afterward
- Set up one PQC program for your own estate and your cyber book, with a charter, a business case, and a steering committee
- Plan a cryptographic inventory of your own estate in risk order, starting from records you already hold
- Separate confidentiality horizons from retention periods, then score and tier your estate without guessing unknowns
- Classify vendors by their effect on your timeline, grade the dates they give you, and plan readiness work with brokers and reinsurers
- Write submission and renewal questions, with an evidence checklist, that test an insured’s quantum readiness claims
- Sketch accumulation across a cyber book and list the policy wording questions your organization has to answer
- Structure the program into workstreams and a year-one plan, with KPIs your board can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map marking what your teams, vendors, brokers, and reinsurers control
- A program charter and a steering committee structure, with security and underwriting as members
- An inventory plan, with its tracks, starting records, and order
- Confidentiality horizons for your main data classes and an initial priority list, with evidence gaps recorded
- A vendor and counterparty register that separates evidenced dates from assumptions
- Submission and renewal questions for insureds, with the evidence to request for each
- An accumulation sketch for a cyber book, and a list of policy wording questions with an owner for each
- A year-one plan by quarter, with workstreams, board KPIs, and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization or with a sample insurer and cyber book we provide. If you bring approximate figures from your own organization, you apply each module directly to it, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample insurer’s illustrative figures. You then apply the same templates to your own organization when you return to work.
Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:
- Your main platforms, such as policy administration, claims, and the broker portal, with the vendor for each
- Your records retention schedule and data classification scheme
- The brokers, reinsurers, and other firms you exchange policy and claims data with
- Renewal dates for your main technology contracts
- Your current cyber submission questions and a summary of your cyber book by industry
You decide what you share with the room. If your underwriters cannot share insured-level detail, bring counts by industry instead.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework, and on the insurance material in its Financial Services Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate and cyber book, or to the sample insurer.
Live online, we teach the intensive in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second. As private team training, we can also teach it in one day at your location.
Module 1 Two problems, one program
The instructor walks through the insurance material in the Financial Services Extension, from policy records that can stay sensitive for decades to the data exchanged with brokers and reinsurers. You then map your own estate by domain and mark whether your teams, a vendor, a broker, or a reinsurer controls each one. You also note where your underwriters already ask insureds about quantum readiness.
Module 2 Mandate, governance, and the business case
You draft a charter that commits to two outcomes, meeting your dated obligations and being able to change cryptography on the systems you control. You define the steering committee, with security and cyber underwriting as members alongside compliance, legal, and procurement. You then build the business case on your long-horizon data and dated obligations, showing planned refresh separately from new money.
Module 3 Inventory planning for your own estate
You plan the inventory on the Financial Services Extension’s tracks. For an insurer, these include policy and claims platforms, customer and broker portals, document signing, long-retention stores, and third-party interfaces. You start each track from a record you already hold, such as the records retention schedule, and put internet-facing systems that process long-horizon data first. You tag every entry by who controls its change, and grade the evidence for each finding.
Module 4 Risk scoring by confidentiality horizon
You assign a confidentiality horizon to each data class, such as medical underwriting files, claims histories, actuarial data, and reinsurance treaties, and record it apart from the retention period. Harvest Now, Decrypt Later: Which Data Is Actually at Risk explains the difference. You then score the estate on data sensitivity and exposure, trust-infrastructure criticality, migration feasibility, and regulatory pressure, recording unknowns instead of guessing them. You tier each fully scored entry and give every blocked high-priority entry an owner and an interim treatment.
Module 5 Vendors, brokers, and reinsurers
You classify vendors by how much of your timeline they control, from policy administration platforms to certificate authorities, and ask each the two crypto-agility questions first. You grade every date a vendor gives you as committed, forecast, announced, or unknown, and draft clauses for your next renewals. With brokers and reinsurers, you plan readiness inquiries, joint test events, and a published schedule for retiring classical-only connections. You also track the ACORD data standards and the G7 Cyber Expert Group roadmap that insurance regulators are expected to follow.
Module 6 Underwriting quantum risk
You draft the quantum readiness questions for your cyber submissions and renewals, and the evidence to request with each answer. The framework names five documents a migration program should make presentable to underwriters: its cryptographic inventory, migration plan, risk appetite statement, key risk indicator dashboard, and regulatory compliance tracker. You grade each answer with the framework’s evidence grades, from observed at runtime to attested or inferred. Where an insured attests to its inventory instead of sending it, as the framework advises, you check that its coverage statement names the population covered and the discovery method.
Module 7 Accumulation and policy wording
You group the insureds in a cyber book by the cryptographic dependencies they share, such as a certificate authority or an implementation used in several vendors’ products. You then sketch accumulation scenarios, including a published break of a widely used algorithm. Q-Day Is a Confidence Crisis, Not an Outage explains why such a break would change the presumption of safety for every user of that algorithm at once. You list the policy wording questions your organization has to answer, such as which policy period applies when data captured now is decrypted later. You name an owner for each question.
Module 8 Year-one plan, KPIs, and the asks
You organize the program into workstreams with named owners, and assemble a year-one plan by quarter that covers your estate and your underwriting. You choose board KPIs for long-horizon data at risk, exposed broker and reinsurer interfaces, and vendor commitments. You also agree what the steering committee does when a vendor misses a committed date. You list the decisions you need from your executives, vendors, brokers, and reinsurers, and the instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own systems or of cyber underwriting, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.
Can one person attend alone?
Yes. You complete the same templates and note the questions that need a colleague. A mixed security and underwriting group can answer more of those questions in the room.
Is the intensive vendor-neutral?
Yes. We favor no policy administration platform, cloud provider, or security vendor, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Insurance as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads vendor conversations can take PQC Vendor Governance and Supply Chain. Risk and compliance staff who will assure the program can take PQC for GRC Professionals.
Why we teach this
This intensive is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The day also draws on the insurance material in the framework’s Financial Services Extension. The course author wrote the framework. The instructors run migration programs in this industry and teach the sector material from that field work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and FRM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
