SITG-CONSULTING
Post-Quantum Cryptography and Quantum Risk: The Questions Boards Ask
Straight answers for directors, risk owners and procurement teams, each anchored in who is accountable and what evidence that accountability rests on.
Inquire About Our Quantum Security Services
Speak with SITG-Consulting about quantum security, PQC and cryptographic risk in your organisation.
Working with a Post-Quantum Cryptography Consultancy
What is a post-quantum cryptography consultancy, and when does an organisation need one?
A post-quantum cryptography (PQC) consultancy advises the board and its delegated owners on the governance of a cryptographic transition: who is accountable, what evidence that accountability rests on, and how the transition is controlled from first inventory to final verification. One is needed when cryptographic dependencies have no named owner, when a regulator or customer asks for a migration plan the board can stand behind, or when a vendor's PQC claims are about to be accepted without independent evidence. SITG-Consulting advises and validates; it does not sell or deploy products. The PQC Discovery Sprint is the usual starting point.
What does PQC consulting cover?
Four things, in order. Visibility: a record of where cryptography sits across the estate, with an owner against each dependency. Exposure: a quantified view of what that cryptography protects, for how long it must stay protected, and what is already at risk from data harvested today for decryption later. Pathway: a migration plan with gates, evidence requirements and decision rights the board can defend to a supervisor. Verification: confirmation that what was delivered matches what was claimed. The Discovery Sprint, the PQC Readiness Assessment and the Cryptographic Transformation Methodology cover the first three in sequence; assurance covers the fourth.
Who commissions independent PQC validation?
Boards and risk committees before approving a migration programme or accepting its completion. Procurement teams before buying a quantum-safe product, so the claim is tested before the contract is signed. Regulated firms assembling evidence for supervisors under rules such as the EU's Digital Operational Resilience Act (DORA). PQC vendors who want their claims tested by a party with no stake in the sale.
How is SITG-Consulting different from a cybersecurity vendor?
SITG-Consulting holds no product, no reseller agreement and no equity in any client. It does not perform remediation work for 24 months after issuing a validation verdict, so the verdict cannot be a sales lead for its own services. A waiver exists only in extremis, requires named board-level sign-off from the client, and is disclosed annually in anonymised form. We never mark our own work: we do not validate anything we delivered. That independence is what gives a verdict weight with a board, an auditor or a regulator.
PQC Assurance and Independent Validation
What is PQC assurance?
PQC assurance is independent validation that a product, protocol or implementation claiming to be quantum-safe is what it says, and that the governance around it would survive an audit. The technical tests cover protocol correctness, implementation, entropy sources and crypto-agility. The governance tests cover documentation, version control, change management, incident readiness and audit trail. A control that works technically but has no owner, no record and no place in the operating model is incomplete. Each engagement concludes in a verdict: validated, conditional or not validated. SITG-Consulting conducts assurance under its own Quantum Cryptographic Assurance Standard (QCAS).
How do we know a vendor's quantum-safe claim is true?
You don't, until someone with no stake in the sale has tested it. A claim rests on three things that are rarely shown together: the algorithms in use and how they are combined, the implementation that carries them, and the governance that keeps both correct over time. Independent validation examines all three against the vendor's own documentation and produces a written verdict procurement can file. Accepting a claim on a datasheet transfers the vendor's risk to your board.
What does a validation verdict mean, and who is it for?
Validated means full technical and governance evidence has been verified and the finding is fit for a board record or regulatory submission. Conditional means the core technical function is valid but governing artefacts or lifecycle integration need evidenced remediation before approval. Not validated means the evidence fails to support the claim. The verdict is written for the people who carry the decision: the board, the risk committee, procurement and the auditor.
Quantum Risk Governance for Boards
What is quantum risk advisory?
Quantum risk advisory is board-level guidance on the risk that a cryptographically relevant quantum computer poses to an organisation's data, contracts, regulatory standing and fiduciary duties. It establishes risk appetite, assigns ownership, defines what the board reports and to whom, and sets the evidence standard against which progress is judged. It treats cryptography as a governance obligation with a lifecycle, not a technical setting, and sits above the technical work so that each decision has a named owner and a record.
What should a board ask about quantum risk?
Five questions. Who owns cryptographic risk, by name? Do we have an inventory of where cryptography sits and what it protects? Which of our data must stay confidential beyond the point at which a quantum computer could break today's encryption? What is our migration plan, what are its gates, and what evidence passes each gate? Who has independently tested the claims we are relying on? A board that cannot answer the first question cannot credibly answer the other four.
What is "harvest now, decrypt later", and why does it matter before quantum computers exist?
Encrypted data intercepted and stored today can be decrypted later, once a capable quantum computer exists. Anything with a confidentiality life longer than the time to that capability is already exposed, whatever the migration timetable says. The governance consequence is that exposure is measured from the sensitivity life of the data, not from the arrival date of the machine, and the board's risk register should carry it on that basis.
Why is governance the deciding factor in a cryptographic transition?
Because the failures are organisational before they are technical. Cryptography with no owner is not inventoried; an inventory with no evidence standard is not trusted; a migration with no gates cannot be stopped when it drifts. Governance supplies the ownership, the evidence standard and the gates. Without them the technical work produces activity that nobody can sign off.
PQC Migration and Cryptographic Agility
How should an organisation structure its migration to post-quantum cryptography?
As a governed programme with gates, not a technology refresh. Start with the inventory, so every cryptographic dependency has an owner and a classification. Rank by the sensitivity life of the data and the exposure of the system. Set a pathway whose phases each end in evidence the board can review. Verify independently before closure. The Cryptographic Transformation Methodology sets this out as a multi-year, gated programme.
What is a cryptographic inventory, and why is it the first step?
A cryptographic inventory is a record of every place cryptography is used across systems, suppliers and data flows, with the algorithm, key length, purpose, owner and dependency for each. It is the first step because nothing else can be prioritised, evidenced or signed off without it. Organisations that skip it migrate what is visible and leave the rest, which is where the exposure sits.
What is cryptographic agility?
Cryptographic agility is the ability to replace an algorithm, key or protocol without rebuilding the systems that depend on it, under change control and with a record. It matters because the current post-quantum standards will themselves be revised, and an organisation that migrates once without agility will face the same programme again. Agility is assessed as a governance capability: who can authorise a change, how it is tested, and how it is evidenced.
How long does PQC migration take?
Longer than the budget cycle assumes. Discovery can be scoped in weeks; the migration it informs runs over years, because it touches suppliers, legacy estates and contracts the organisation does not fully control. National guidance, including the UK National Cyber Security Centre's published milestones, sets staged targets through the early 2030s. The board question is not the end date but whether each gate between now and then has an owner and an evidence requirement.
Regulation, Suppliers and Evidence
Which regulations require post-quantum readiness?
Few name post-quantum cryptography directly; many require what it depends on. The EU's Digital Operational Resilience Act requires financial entities to manage ICT risk with evidenced controls and to govern third-party dependencies. The EU's second Network and Information Security Directive extends comparable duties to essential and important entities. National bodies, including the UK National Cyber Security Centre and the US National Institute of Standards and Technology, have published migration guidance and standards. The common thread is evidence: a supervisor will ask what you knew, when, and what you did about it.
How do we assess supplier and third-party quantum risk?
By treating the supplier's cryptography as part of your own estate. Identify which suppliers carry data or run systems with a long confidentiality life. Ask for their inventory, their migration plan and their evidence, not their assurance letter. Rate each against the same standard you apply internally and record the rating in the risk register with an owner. Where a supplier's claim is material, have it independently validated.
What evidence will auditors and regulators expect to see?
A named owner for cryptographic risk. An inventory with classification and dates. A board-approved risk appetite and a migration pathway with gates. Records showing each gate was passed on evidence, not assertion. Independent validation of any third-party claim the organisation relies on. The absence of any one of these is a finding in itself.
About SITG-Consulting
What does SITG-Consulting not do?
It does not sell products, resell products or take referral fees. It does not deploy or implement. It does not perform remediation for 24 months after a validation verdict. A waiver exists only in extremis, requires named board-level sign-off from the client, and is disclosed annually in anonymised form. We never mark our own work: we do not validate anything we delivered. It does not issue certifications; it produces evidence and verdicts that certifying bodies and auditors can rely on.
Where can we read SITG-Consulting's research?
White papers, thematic reviews and national post-quantum readiness reports for the UK, EU-27, ASEAN and Africa are published on Zenodo with permanent identifiers, and summarised on the White Papers and Thematic Reviews pages.