Retiring SHA-1 Took More Than a Decade: Lessons for Post-Quantum Planning
Retiring SHA-1 took the public web almost 12 years, and NIST's end date for every use is December 31, 2030. Post-quantum planners can learn…
The Four Capabilities a PQC Program Needs
Most organizations don't need four post-quantum hires. They need four capabilities: discovery, architecture, implementation, and delivery. How those map to headcount depends on the…
Overseeing a Migration You Don’t Technically Understand
Directors govern credit models and actuarial assumptions they cannot personally build. Post-quantum migration works the same way: appetite statements, a short list of indicators,…
The CISO, the Three Lines, and Who Owns PQC Migration
Reporting lines say little about what a CISO controls. Who leads post-quantum migration depends on where the cryptographic estate sits and on decision rights…
The Three Shapes of Objection That Stall a PQC Program
Most post-quantum programs stall on organizational arguments, not technical ones. The recurring objections come in three shapes, and each one can be answered without…
No One Can Cost a PQC Migration. Fund It Anyway.
There is no benchmark for a post-quantum migration, because no enterprise has finished one. You can still build a defensible budget from numbers your…
Who Should Own Post-Quantum Migration
Post-quantum migration programs stall on ownership, not technology. Four tests for naming the accountable executive, and the mandate, budget, and authority the role needs…
Sequencing the Waves in a Post-Quantum Migration
Scope is not what sinks a post-quantum program. Order is. A practical guide to gates, dependencies, and how to cut a migration wave that…
The Real Size of a Post-Quantum Migration
One published program plan for a post-quantum migration runs to more than 120,000 scheduled tasks. Here is where the small estimate loses the work.
Quantum Readiness Is Not Only a Vendor Problem
Suppliers will ship post-quantum algorithms. The cryptographic inventory, the risk decisions and the contract terms are work no supplier can do on your behalf.