tech · quantum risk
Is CISO 90-day PQC Quantum Proof? Cyber Program & PQC
Verdict
A 90-day plan will not finish enterprise PQC, but it can establish inventory, owners, one hybrid pilot, vendor questions, and board language—the minimum credible start.
Overview
Days 1–30: scope inventory, pick pilot channel, brief leadership. Days 31–60: run discovery, questionnaire top vendors, stand up metrics. Days 61–90: pilot hybrid or agility change, tabletop crypto IR, lock 12-month roadmap funding ask.
Program inventory focus: Delay before first inventory leaves blind spots. Typical classical surfaces: Pilot targets: edge TLS, remote access, IdP. Cross-read /security/program and /assessment. Educational only—not compliance advice.
Cryptographic profile
- Signatures: Pilot targets: edge TLS, remote access, IdP
- Hash: Plan milestones
- Public-key exposure: Delay before first inventory leaves blind spots.
What breaks
- Only slideware
- Pilot with no success criteria
Mitigations
- Written charter and RACI
- Success metrics pre-declared
- Use migration checklist
FAQ
Need new headcount?
Often a virtual team first; budget for tooling and vendors later.
Outsource all?
Advisors help; ownership must stay internal.
Key concepts (technical dictionary)
Terms used on this page — open a definition: