Cryptographic infrastructure is mission-critical. The standards are finalized. The federal mandates are issued. The peers are moving. The fiduciary expectation has shifted.
Under In re Caremark International Inc. Derivative Litigation (Del. Ch. 1996), and as expanded by Marchand v. Barnhill (Del. 2019), directors have a non-delegable duty of oversight. That duty applies with particular force to mission-critical risks where the board has reason to believe an issue is foreseeable and material.
Cryptography is the foundational control protecting customer data, financial transactions, regulatory disclosures, intellectual property, and operational continuity. The post-quantum migration is now a publicly disclosed, federally mandated, peer-acknowledged transition with documented timelines from NIST, NSA, the SEC, and major cybersecurity authorities.
For a director to conclude that PQC governance is not yet a board-level matter requires affirmative reasoning, not silence. The information environment has changed.
Boards do not need to be technologists. They do need to be able to answer eight questions.
From the QuantaCyber Board Briefing. Eight questions across two governance dimensions: risk and exposure first, execution and ownership second.
QuantaCyber's tabletop exercise places the board in a controlled scenario approximating a near-future Q-Day disclosure event. Directors are asked to navigate fiduciary, regulatory, and reputational exposure in real time, alongside CISO and General Counsel role players, with structured pause points for governance discussion.
The exercise is designed and facilitated jointly with Robert Taylor, JD, who leads the legal and fiduciary tracks of the QRS Board Training program.
Boards typically run the exercise as a half-day session. Outputs include a board-level governance gap memo, a CBOM coverage assessment, and a 12-month action plan keyed to the federal mandate timeline.
From the QuantaCyber Board Briefing. Each commitment has a named owner, a deliverable, and a date. The briefing earns the case; this is what comes out of it.
A named director, in committee minutes, with quantum-risk oversight. Only 12% of boards have done this.
Owner: Nominating & Governance
General Counsel and outside counsel deliver a written Rule 33-11216 assessment to the Audit Committee. A briefed board cannot claim unawareness.
Owner: GC + outside counsel
CEO-sponsored, board-mandated. CBOM is the prerequisite for migration planning. Phase 1 scope, timeline, and budget reported to Audit by day 90.
Owner: CISO + Risk
Most cyber and D&O policies now exclude quantum-derived breach. Coverage gap report delivered before next renewal.
Owner: CFO + Risk
Critical vendors assessed against actual PQC roadmaps. New contracts require quantum-safe capability or a contractual migration commitment.
Owner: CISO + Legal + Procurement
Quantum risk and migration progress reported with KPIs. Own line on the board agenda. Reporting continues beyond initial PQC migration as standards evolve.
Owner: Board Chair
This is a capital allocation timing decision: early spend versus breach-driven spend. Industry analyst syntheses put migration at roughly 2 to 5% of annual IT security spend, sustained over a four-year migration window. Multi-year transformation, not a single project.
For a Fortune 500 enterprise, Phase 1 discovery and CBOM commission typically anchors in the $300K to $800K range as a fixed cost. Phase 2 migration execution then varies by HSM count, regulated workload density, and legacy load. Without a CBOM the variance is unbounded; with one, the planning range tightens to roughly ±20%.
The cost of inaction is harder to bound. A quantum-attributed breach carries customer notification, Rule 33-11216 disclosure exposure, contractual breach, IP loss, and market cap impact. Most cyber and D&O policies now exclude quantum-derived breach, leaving the exposure unpriced on the balance sheet. Caremark attaches to directors who knew and did not act.
Boards consistently underestimate where their peers stand on this. The data on board readiness, and the production deployments your enterprise already depends on, tell the same story.
If your board is not yet asking the eight questions, the most likely explanation is not that the risk is immaterial. It is that the conversation has not yet been initiated by management or by counsel.
A 60-minute board readiness session, customized to your sector, regulatory exposure, and governance maturity. Co-presented with Robert Taylor, JD, where appropriate.
Request a briefing