tech · quantum risk
Is Crypto exceptions Quantum Proof? Cyber Program & PQC
Verdict
Exception management is how crypto-agility stays honest. Time-bound classical-only exceptions with owners and compensating controls—or the inventory becomes fiction.
Overview
Some systems will lag PQC for years (OT, vendors, mainframes). Governance must track them explicitly.
Program inventory focus: Eternal exceptions recreate untracked classical risk. Typical classical surfaces: Approved classical-only residuals. Cross-read /security/program and /assessment. Educational only—not compliance advice.
Cryptographic profile
- Signatures: Approved classical-only residuals
- Hash: Exception tickets
- Public-key exposure: Eternal exceptions recreate untracked classical risk.
What breaks
- Permanent exceptions
- No re-review date
Mitigations
- Max exception duration
- Compensating network and monitoring controls
- Board visibility for critical residuals
FAQ
Who approves?
Risk-appropriate authority—often CISO + system owner; escalate high residual.
Public internet exceptions?
Highest scrutiny—prefer hybrid pilots first.
Key concepts (technical dictionary)
Terms used on this page — open a definition: