Privileged communications and many other client confidences need to stay confidential for ten years or more. Where that material is stored on platforms that vendors run, the vendor decides when its side of the cryptography changes. For qualified electronic signatures, the trust service provider sets the date. In this workshop, you plan your firm’s post-quantum cryptography (PQC) migration around those dates, and draft what it tells clients.
By the shelf-life tiers in Harvest Now, Decrypt Later: Which Data Is Actually at Risk, long-term contractual and legal instruments need protection for decades. Litigation strategy and M&A material before announcement must stay confidential for years. Signed contracts and filings add a separate clock, which runs for as long as anyone relies on the signature. For data that must stay confidential for decades, a platform vendor’s timeline is directly the firm’s exposure, as Third-Party Cryptographic Risk at Enterprise Scale explains.
We teach this intensive only as private team training, for one organization at a time, online or at your location. It is an eight-hour planning workshop. You work from your own firm’s systems, platform contracts, and confidentiality terms, or from a sample firm we provide. No cryptography background is needed. You leave with drafts of a program plan, a year-one roadmap, and a client position for the partnership, with the assumptions you still need to check written down.
Who this intensive is for
Program managers and PMO leads, and the partner or executive who will sponsor the program. Firm CIOs and information security leads, knowledge management and document systems owners, and practice leaders belong in the room too, with vendor managers, general counsel, and risk partners. We recommend a mixed group, ideally the people who would be members of the firm’s quantum readiness steering committee. In a firm, the document systems, the platform contracts, and the client relationships often have three different owners.
Bring at least one risk partner. Many of the decisions in this workshop are partnership decisions, including the advisory-duty question: whether advising clients on quantum risk creates an obligation to have addressed it internally.
The intensive is for law and accounting firms and for advisory practices. In-house legal teams can plan with their own organization instead, for example in the Quantum-Safe Financial Services Intensive at a bank. To arrange the intensive for your firm, write to training@quantumacademy.com.
What you’ll be able to do afterward
- Explain how confidentiality horizons and platform dependencies set your priorities, and map who controls each part of the estate
- Draft a program charter and a business case the partnership can approve, and define the steering committee
- Plan a cryptographic inventory that starts from records the firm already keeps
- Score systems and archives, record unknowns instead of guessing them, then choose a strategy for each archive
- Classify hosted platforms, and grade every date a vendor or trust service provider gives you
- Decide what the firm tells clients and when, and frame the advisory-duty question for the partnership
- Structure the program into workstreams and a year-one plan, with KPIs the partnership can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map of the firm’s systems, platforms, and signing services, marked by who controls each
- A program charter and steering committee structure
- An inventory plan, with its starting records, its order, and vendor questions for hosted platforms
- An initial priority list, with evidence gaps recorded and a strategy for each archive
- A register of platform vendors and trust service providers that separates evidenced dates from assumptions
- A draft client position, with the advisory-duty question framed for the partnership
- A workstream structure with role and resource assumptions
- A year-one plan with board-level KPIs and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own firm or with a sample firm we provide. If you bring approximate figures from your own estate, you apply each module directly to your firm, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample firm’s illustrative figures. You then apply the same templates to your own firm when you return to work.
Before the day, we send a list of what to gather if you want to use your own data. Approximate figures are enough:
- The firm’s main systems and hosted platforms, and who runs each
- Contract renewal dates for the hosted platforms
- The records an inventory would start from, such as the retention schedule, standard confidentiality terms, and the litigation hold register
- The signature and timestamp services the firm uses, and the provider behind each
- Any client, insurer, or regulatory deadlines and questionnaires the firm already tracks
Bring descriptions and counts, not client documents. If a record cannot leave its system, bring a summary of what it contains.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework. The instructor starts each module with a short briefing. You then apply the module’s template to your own firm or to the sample firm.
At your location, we teach the intensive in one day, with lunch and two breaks. We agree the timetable with you, and a day from 09:00 to 17:00 looks like this:
Online, we agree with you how to divide the eight modules into sessions.
Module 1 The firm's estate and who controls it
The instructor walks through the clocks that apply to a firm’s records, from privileged communications to signed archives. You then map the firm’s estate by domain, such as document management, mail and archives, deal rooms and client portals, and signing services. You mark who controls the change in each: the firm’s IT team, a platform vendor, a trust service provider, or a client.
Module 2 Mandate, governance, and the business case
You draft a charter with two outcomes: meeting the firm’s dated obligations, and being able to change cryptography on the systems it controls. You define the steering committee, with the risk partner, practice leaders, and procurement alongside IT and security. A firm with fewer than about 2,000 staff can use an existing risk forum instead, if its minutes record each program decision and who took it. You build the business case for the partnership, including what cyber insurers ask at renewal, with planned platform renewals shown separately from new money.
Module 3 Inventory planning
You plan the inventory from records the firm already keeps, from the retention schedule to the purchasing records that show tools practice groups bought on their own. You put internet-facing systems that handle client material with long confidentiality horizons first, and tag every entry by who controls its change. For hosted platforms you cannot scan, you plan vendor questions instead and record what you did not examine, as When a Full Cryptographic Inventory Isn’t Possible describes.
Module 4 Confidentiality horizons and priorities
You set confidentiality horizons from professional-secrecy duties and client confidentiality terms, and record retention and preservation periods as separate clocks, each with an owner. You score each entry on data sensitivity and exposure, trust infrastructure, migration feasibility, and regulatory and compliance pressure, and tier only fully scored entries. You give each unknown an owner and a resolution date instead of guessing it. You choose a strategy for each archive, such as re-encryption, re-signing, or deletion, and mark where counsel must confirm the retention and preservation position first.
Module 5 Platforms and trust service providers
You classify each hosted platform by the sensitivity and confidentiality horizon of the data it stores, crossed with the vendor’s PQC posture. You ask every platform vendor the two agility questions first, and grade each date you receive as committed, forecast, announced, or unknown. The firm cannot issue a qualified signature itself, so you ask each trust service provider when it will offer qualified services on post-quantum algorithms. The September 2026 edition of the framework reports no provider offering them yet, from a search it notes was not exhaustive.
Module 6 Clients and the firm's position
You draft what the firm tells clients and when, from questionnaire answers to notices prepared in advance for a public quantum event. You frame the advisory-duty question for the partnership, which decides the firm’s position with counsel. Legal and compliance own the firm’s position on disputes over forged or repudiated signatures, and review it each year with counsel. Post-Quantum Negligence: Legal Risks of Failing to Prepare for the Quantum Threat is one published analysis of these questions, including the position of professional advisors.
Module 7 Program structure and staffing
You organize the work into workstreams and repeatable work packages, and sequence the waves from internal systems to client-facing services. You size the program team to the firm’s estate, and set the gates and the evidence each wave needs. You keep an evidence dossier from the start, recording decisions, risk acceptances, and declined budget requests as the firm’s record of diligence. Where the vendor of a high-sensitivity platform will not commit, you agree the steering committee’s options: accept the risk with monitoring, entrust it with less data, or replace it.
Module 8 Year-one plan, KPIs, and the asks
You assemble the day’s work into a year-one plan sized to the firm, with PQC clauses scheduled into the platform renewals due that year. You set board-level KPIs for coverage, inventory, and platform vendor commitments. You list the decisions you need from the partnership, platform vendors, trust service providers, and clients, and the instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your firm’s systems and platforms, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records the firm already keeps. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.
How is a private intensive arranged?
We agree the date and the format with your firm, online or at your location, and quote each engagement separately. Before the day, we send a list of what to gather.
Is the intensive vendor-neutral?
Yes. We favor no document management, e-signature, or cloud provider, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Legal and Professional Services as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever presents the funding case to the partnership can take PQC Migration: Building the Business Case. Whoever manages platform vendors can take PQC Vendor Governance and Supply Chain. Firms with clients in regulated finance can take Quantum-Safe Financial Services, which covers the regulatory drivers those clients work under.
Why we teach this
This intensive is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. No sector extension of the framework covers legal and professional services yet. Instead, we apply the Universal framework, including its sections on hosted platforms, electronic signature law, and crisis communications. The course author wrote the framework. The instructors run migration programs in this industry and teach the sector material from that field work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and PMP holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.