For CIOs and risk leaders, the key management shift is not the cryptography itself but the governance burden it creates. Once PQC migration becomes a time-bound obligation, it stops being a discretionary security upgrade and starts competing for funding, board attention and delivery capacity against other resilience and transformation work. That means the real question is whether the organisation has a decision model that can rank cryptographic exposure alongside other enterprise risks, not whether the security team has a technical plan.
Accountability needs to move above the security function. A single owner is useful, but it is not enough if legal, procurement, architecture, application owners and third-party managers still make isolated decisions. The practical test is whether there is a clear operating model for escalation, exceptions, and sign-off on systems that cannot be migrated quickly. Without that, organisations risk creating a paper programme that looks governed but still leaves critical dependencies unmanaged.
Portfolio trade-offs will be unavoidable. The highest-risk systems are often the least convenient to change: legacy platforms, externally exposed services, and long-lived data stores. Leaders should expect tension between โquick winsโ and the exposures that matter most. Next questions for the executive team are: which systems create irreversible harm if encryption fails, which remediation paths require vendor coordination, and what is the acceptable delay for noncritical assets versus crown-jewel services?
Third-party readiness is another management control point. If suppliers are not contractually tied to migration expectations, the enterprise may inherit risk it cannot directly fix. Boards should ask for a view of where the organisation is dependent on vendor roadmaps, where contract terms allow enforcement, and how progress will be reported in a way that supports audit, insurance and legal scrutiny.
The US federal government just did something subtle yet significant for enterprise risk: It put postโquantum cryptography (PQC) migration on a clock. The executive order (EO), โUshering in the Next Frontier of Quantum Innovation,โ tells agencies to accelerate migration to PQC, assign accountable leaders, run pilots, and work toward defined deadlines for critical systems. The corresponding OMB memo makes the EO operational with requirements, migration planning, and recurring reporting. Together, they shift quantum risk from a vague technical concern into a structured governance model, thereby turning a technology issue into a risk management issue.
What To Know About Post-Quantum Negligence
The debate over whether this is a foreseeable risk just ended. Any board that chooses not to follow a comparable path will need to explain why its own standard of care is lower than that of the US federal government. In the event of a lawsuit, that gap can translate into findings of negligence for executives. Negligence analysis is simple: Was the burden of taking action smaller than the expected harm? The new directives shape both sides of that test because they:
- Put quantum on the enterprise risk register. A quantum computer able to break todayโs public key cryptography is no longer treated as a remote theory. It is framed as an eventual reality on a long but finite timeline. That makes it much harder to dismiss it as speculative.
- Elevate the scale and impact of loss. The focus is on longโlived, highโvalue data and critical systems, where compromise would have lasting and systemic consequences, not just a oneโoff incident.
- Reduce the burden of action. Postโquantum migration is now presented as an executable program: recognized standards, federal guidance, pilots, and staged migration paths. This looks like a manageable transition, not a research project.
Negligence cases arenโt about whether a risk existed; they focus on whether a company failed to act once the risk was both foreseeable and practically addressable. These directives make it much harder to argue that there wasnโt a clear way forward or that reasonable action wasnโt yet possible.
What Risk Management Must Do Now
The question is no longer whether the organization started PQC migration but whether it can demonstrate that it prioritized the right exposures, acted in time, and reduced risk in a way that would withstand scrutiny. For risk pros:
- Assign enterprise accountability, not just functional ownership. Designate a single accountable owner with authority to coordinate across the enterprise, but do not isolate responsibility within security. PQC exposure spans infrastructure, applications, data, and third parties. Accountability must extend across technology, risk, legal, and procurement to prevent gaps in oversight, fragmented decisions, and unmanaged dependencies.
- Prioritize based on business criticality, data exposure, and longevity. Focus first on systems where cryptographic failure creates irreversible outcomes, including exposure of sensitive data, loss of trust in digital signatures, or disruption to critical business processes. Long-lived data and externally exposed systems should drive prioritization. What is easiest to migrate is rarely what matters most from a risk perspective.
- Make third-party quantum readiness a condition of doing business. PQC exposure extends across the ecosystem, where the company has responsibility but limited control. Move beyond assessment to enforcement by embedding PQC expectations into contracts, tracking vendor readiness, and defining acceptable time frames for compliance. Integrate these requirements into third-party risk management processes, procurement decisions, and ongoing vendor oversight.
- Turn cryptographic inventory into an exposure map that informs decisions. An inventory creates visibility but does not reduce risk. Connect cryptographic use to data sensitivity, business criticality, and third-party dependencies to identify where exposure is concentrated. Map where cryptography protects critical data, where it persists over time, and where dependencies introduce risk. If it does not show exposure, it does not enable prioritization or control.
- Monitor for requirements and updates from your cyber insurance carrier. As inaction translates into greater risk, and there is an increasingly clearer path forward, insurers will not only probe more into what policyholders are doing for PQC migration but also factor your readiness into premium pricing. You may have already seen questions about PQC migration roadmaps, data classification, cryptographic inventory, and cryptoagility as early indicators for carriers to assess your maturity. Look for exclusions, too, as insurers draw the line for what they will and will not cover related to this risk.
- Anchor the PQC migration in board-level risk visibility and oversight. PQC risk is a governance issue, not a technical program. Provide boards with clear visibility into exposure, prioritization rationale, and progress against defined timelines. Continuous monitoring and reporting are essential to demonstrate control effectiveness and evolving risk posture, particularly as risk conditions and dependencies change over time.
Your organization needs a cross-functional Q-day team. In five to 10 years, when data breaches tied to outdated encryption are tested in court, the standard will be clear: What did comparable organizations know, what did they do, and when did they do it? In the meantime, enterprise risk managementโs role is to ensure that the company can demonstrate that it recognized the risk, acted deliberately, and can produce the receipts to prove it. Forrester clients can check out the full initiative blueprintย to help drive their PQC migration orย schedule a guidance session or inquiry with us.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.