Every week I see organisations announcing their Post-Quantum Cryptography strategy. Strategies. Roadmaps. Working groups. Steering committees. Pilot programmes. Then along comes some actual data. DigiCert's 2026 Quantum Readiness Outlook surveyed 1,001 IT and cybersecurity decision-makers across the United States, United Kingdom and Australia. 87% say they are planning, testing or implementing PQC. Only 7% have deployed quantum-safe or hybrid cryptography across most of their

For many years we have run cryptographic module readiness reviews inside larger governance and assurance engagements. It was never a named line item. It was the work done before a vendor spent money at a testing laboratory, so the money was not wasted. We have now formalised it as a defined service: the SITG FIPS 140-3 Gap Analysis. The context is a hard deadline. FIPS 140-2 certificates sunset on 21 September 2026 and move to the Historical List. From that date, a module wit

Without sounding narcissistic, we’re often told we’re opinionated. Everyone is 100 percent correct. We are, and we will remain so. Not for ego. For rigour. If a proposition is weak, confused or stretching novelty beyond necessity, it should be challenged. Governance is a mature discipline. Reinventing it with diagrams and slogans helps nobody. Yesterday was a good example. A post appeared describing AI governance as a neat four layer staircase. I challenged it: "This is a per

Sensitive documents reportedly linked to India's Kudankulam Nuclear Power Plant have been exposed following a ransomware attack affecting a contractor. According to Reuters, the leaked material includes engineering drawings, supplier information and inspection records, while there is currently no evidence that reactor control systems themselves were compromised. That distinction matters. Too often, critical infrastructure security is viewed through the lens of perimeter defen

July 12, 2026 The quantum threat isn't coming. It is already in your infrastructure. PQC Discovery and PQC Posture Management are maturing fast, but neither can deliver a governed, evidence-driven transformation. The missing capability is Transition Orchestration: the programme architecture that validates and proves every cryptographic decision. If your organization cannot prove every decision it makes, it does not control its cryptographic estate. It merely tracks it. Hard T

𝐃𝐨 𝐨𝐫𝐠𝐚𝐧𝐢𝐬𝐚𝐭𝐢𝐨𝐧𝐬 𝐫𝐞𝐚𝐥𝐥𝐲 𝐧𝐞𝐞𝐝 𝐚 𝐬𝐭𝐚𝐧𝐝𝐚𝐥𝐨𝐧𝐞 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲 𝐏𝐨𝐥𝐢𝐜𝐲? I’m starting to think the default answer of “yes” might be wrong. I recently reviewed the Dutch Government’s Framework Cryptography Policy for the Central Government. What’s interesting is that it doesn’t push organisations to create yet another standalone document. Instead, it recognises that cryptographic governance can - and often should - be embedded across

One of the questions we're asked more than any other is: "What actually happens during a Discovery Sprint?" This carousel answers that question. Rather than talking about methodology, we've opened the lid on a real engagement for an anonymised digital challenger bank. You'll see how assumptions are tested, how evidence is gathered, why cryptographic inventories rarely reconcile, and how governance failures become visible long before any discussion about post-quantum algorithm

#PQC and #Data: The Three #Cryptographic Domains Post-quantum risk is about the data being protected, not the algorithms themselves. Every cryptographic dependency maps to one of three data states. If you do not know which state you are protecting, you do not know what you are securing. #Data in #Motion Information moving across networks or channels. TLS sessions, VPN tunnels, 5G key agreement, SWIFT messages, API calls. Quantum relevance: interception and harvest. If the con

Words matter. Especially when organisations are making strategic decisions. One of the biggest problems across cyber security, governance, risk, resilience and quantum isn't technology. It's language. Different vendors define the same term differently. Standards use different terminology. Consultants invent new phrases. Boards are expected to make decisions using inconsistent vocabulary. That creates confusion before the real work even starts. To address that, we've made the

𝐘𝐎𝐔 𝐇𝐀𝐕𝐄𝐍'𝐓. 𝐅𝐅𝐒. Every few weeks someone announces the next revolution. AI Governance. Quantum Governance. Sovereign Intelligence. Machine-Layer Authority. Algorithmic Governance. No. You've discovered a new technology, a new risk profile or a new application. You haven't discovered a new discipline. So let me ask one question. 𝐖𝐡𝐲 𝐝𝐨 𝐲𝐨𝐮 𝐭𝐡𝐢𝐧𝐤 𝐲𝐨𝐮'𝐯𝐞 𝐬𝐮𝐝𝐝𝐞𝐧𝐥𝐲 𝐟𝐨𝐮𝐧𝐝 𝐭𝐡𝐞 𝐜𝐮𝐫𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲𝐭𝐡𝐢𝐧𝐠 𝐠𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐡

NIST CSF 2.0 may be one of the most important Quantum Readiness frameworks available today. Not because it contains a section on quantum computing. It doesn't. Not because it tells organisations which algorithms to deploy. It doesn't do that either. What CSF 2.0 does provide is something far more important. Governance. The 2024 update elevated governance to a core function, recognising that cybersecurity is no longer solely a technology challenge. It is a board, executive and

That should concern every board, regulator, CISO and risk committee still treating post-quantum cryptography as a distant technology problem. The United States has issued a new Executive Order accelerating PQC migration requirements. Notably: • PQC key establishment for High Value Assets by 31 December 2030 • PQC digital signatures for High Value Assets by 31 December 2031 This is the second major shift in federal timing expectations. That matters. Governments do not compress

Is it just me, or has the World become one giant credential parade? I am going to try and make this a regular feature. The working title is: **The Sunday Slop** *Another week. Another guru.* Former Navy SEAL. Former Secret Service. Former MI6. Former Commando. Former Special Operations. Former Intelligence Officer. Former Special Agent. Former Operator. Former Tactical Something. Former Strategic Something Else. At this point I am beginning to wonder whether LinkedIn has a mi

For many years, SITG Consulting has delivered independent product assurance, validation and challenge as part of our broader Assurance and Validation services. What has changed is demand. Every week we receive enquiries from founders, technology companies, investors and advisory firms seeking independent assessment of products, platforms, governance frameworks and strategic claims. Many of those conversations begin in the same way. "We have built something." "Can we prove it?