Governance & program

Standing up a post-quantum migration program

How to turn 'we should do something about quantum' into a funded program with an owner, a plan, and a budget: roles, a RACI, a phased timeline, and the first ninety days.

Briefing leadership on quantum risk: the risk and the ask

A no-hype template for the conversation with executives or the board: what the risk actually is, why it is a present-tense problem, what you are asking for, and how to answer the pushback.

Measuring and reporting post-quantum readiness

What to measure so leadership can see progress, and how to report it without drowning in jargon: a small set of honest readiness metrics and a reporting cadence that survives contact with a busy board.

Designing a blame-free security awareness program

Phishing simulations and training that change behavior instead of punishing people: why blame backfires, how to run simulations humanely, and what to actually measure.

Assessing third-party and vendor post-quantum readiness

Most of your cryptographic risk lives in software you did not write. How to fold PQC readiness into vendor risk management: the questions to ask, the contract language to add, and how to prioritize.