Quantum Risk at the Board Level
Board members and non-executive directors do not need to understand quantum physics. They need to understand fiduciary exposure, regulatory risk, competitive implications, and whether management’s response to the quantum threat is adequate. This two-hour briefing provides exactly that.
The quantum threat to cryptography creates board-level governance responsibilities. Harvest-now-decrypt-later attacks mean that data confidentiality failures may already be occurring, even though the decryption capability does not yet exist. Regulatory deadlines are creating compliance obligations. Insurance markets are asking about quantum readiness. Investors and clients are beginning to expect demonstrable preparedness.
Who Should Take This Course
Board members, non-executive directors, audit committee members, risk committee members, and board advisors. Also appropriate for corporate secretaries and governance professionals who prepare board materials on cybersecurity risk.
What You Will Learn
- Assess whether quantum risk constitutes a fiduciary concern for your organization based on data sensitivity, regulatory exposure, and industry position
- Understand the key regulatory timelines and what they require at the governance level
- Evaluate whether management’s quantum risk assessment and migration plan is adequate, premature, or overdue
- Ask informed questions about PQC migration without requiring technical expertise: questions about discovery completeness, vendor dependency, timeline realism, and verification
- Understand the insurance, liability, and disclosure implications of quantum exposure
Course Outline
Module 1 — The Board’s Quantum Risk Exposure (60 minutes)
What the quantum threat means in governance terms: data that your organization holds today may be decrypted in the future. Regulatory deadlines creating compliance obligations. The fiduciary question: is this a risk the board should be tracking? How quantum risk maps to existing risk appetite frameworks. Peer benchmarking: what boards at comparable organizations are doing. The insurance dimension: how cyber insurance questionnaires are evolving to include quantum readiness.
Module 2 — Governance and Oversight (60 minutes)
What a credible management response looks like versus what should raise concerns. The questions boards should ask about PQC migration: Has discovery been completed? Is the migration methodology vendor-independent? What is the vendor dependency exposure? What verification is planned? How to read a management update on PQC migration status. Setting expectations for reporting cadence and milestones. The disclosure question: when and how to address quantum risk in public filings and investor communications.
Prerequisites
None.