Why "Start With Discovery" Is the Wrong First Step in PQC Transformation

Brian Couzens

2 hours ago

4 min read

Glowing wax seal displacing scattered discovery tools on a dark navy background, representing governance-led PQC transformation

Open any search engine, any industry publication, any social feed. Type "post-quantum cryptography readiness" and start reading.

Within seconds, you will find a pattern. The advice is almost always the same. Start with discovery. Map your cryptographic estate. Build an inventory. You cannot change what you cannot find.

It sounds reasonable. It is not.

Discovery without governance is a scan, not a programme. It produces an inventory with no owner, no mandate, no decision authority, and no accountability for what happens next. The output sits in a spreadsheet. The spreadsheet sits in a shared drive. Nothing moves. Nobody is answerable. And the organisation is no closer to cryptographic resilience than it was before the scan was commissioned.

Why "start with discovery" fails

The problem is not that discovery is unnecessary. It is essential. The problem is sequence.

A discovery exercise conducted without an executive mandate, a governance structure, or an assigned owner produces findings that have nowhere to go. There is no one with authority to act on the results. There is no gate preventing the programme from lurching forward on incomplete evidence. There is no reporting line to the board. There is no defined scope, no terms of reference, and no agreed threshold for what constitutes acceptable risk.

The result is predictable. The inventory is produced, circulated, filed, and forgotten. Months later, someone asks what was done about post-quantum cryptography readiness, and the answer is a spreadsheet that nobody owns.

This is not a theoretical failure mode. It is happening now, across financial services, critical infrastructure, and government sectors worldwide.

The correct sequence: mandate, governance, discovery

The first step in any credible PQC transformation is assigning an executive owner with board-level authority, budget, and accountability for the outcome.

That owner is not the Chief Information Security Officer (CISO). PQC transformation is an enterprise risk programme, not a security project. The appropriate owner is the Chief Risk Officer (CRO) or equivalent, because the programme touches procurement, supplier management, regulatory compliance, data governance, and operational continuity. It crosses every business unit and every contractual boundary. It is not contained within the security function.

Once the owner is assigned, the governance structure follows. The mandate. The reporting framework. The gates. The evidence requirements. The escalation path. The decision authority for each phase.

Discovery then operates inside that structure, with defined scope, clear terms of reference, and an accountable executive who is answerable for what the findings mean and what the organisation does about them.

This is the sequence that produces outcomes. Everything else produces reports.

The SITG-Consulting Cryptographic Transformation Model

The SITG-Consulting Cryptographic Transformation and Modernisation methodology is built around this principle. It begins at Level 0: executive mandate, funding, governance and accountability. Discovery sits at Level 1 and beyond, inside six mandatory governance gates that prevent uncontrolled progression.

No gate progresses without validated evidence. This creates accountability, transparency, and measurable programme control at each phase of the transformation.

The six levels run from executive board view (Level 0) through programme view, governance gates, engineering execution, operating model, and continuous evidence (Level 5). Each level has defined outputs. Each gate requires documented evidence before progression is permitted.

The model treats cryptographic transformation as a long-term business programme, not a technology upgrade. It is designed to satisfy board oversight, regulatory expectations, and the operational reality that cryptographic readiness does not end when new algorithms are deployed.

Who is writing the advice you are reading?

Now consider a different question. Not what the advice says, but who is writing it.

The overwhelming volume of PQC preparedness content is produced by tooling vendors, discovery platform companies, and equipment manufacturers. Organisations whose commercial model depends on the reader buying a scan before they have established who owns the result.

Their advice starts at step three because step three is what they sell. There is no commercial incentive for a vendor to tell you to spend six weeks establishing governance before you buy their product. That is six weeks of delayed revenue.

And now that enterprise PQC budgets are being released, the volume of this content has become relentless. The same line, repeated daily, by the same category of seller, targeting the same uninformed buyer. Start with discovery. Buy the tool. Worry about governance later.

Later never comes. And the programme fails for lack of the structure that should have been in place before a single scanner was deployed.

What governance-led PQC transformation looks like

A governance-led programme starts with three questions before any technology is discussed:

Who owns this programme, and what authority do they hold? What governance structure will control progression, evidence, and decision-making? What assurance standard will the programme be measured against?

Only when those questions have documented answers does the programme move to discovery. And that discovery is scoped, governed, and accountable from the first day.

The difference between a governance-led programme and a discovery-led programme is the difference between a transformation that reaches completion and one that produces a spreadsheet.

The full SITG-Consulting Cryptographic Transformation and Modernisation methodology is published and available for review. It is vendor-independent, evidence-driven, and built to satisfy the expectations of boards, regulators, and auditors.