Is post-quantum cryptography a board-level topic?

Yes, as a planning and risk item, not as a crisis. It belongs on the board's agenda for three reasons. It is a long change across the company that touches suppliers, products and budgets over several years, and only management can sequence that. It affects data the company has promised to protect for many years, such as customer, patient or design data. And customers, insurers and public tenders are starting to ask about it, so the answer is becoming a commercial matter. Under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., the management bodies of covered entities must approve and oversee the cybersecurity risk-management measures, and a policy on cryptography is one of them. What the board needs is short: an inventory of where quantum-vulnerable cryptography is used, a priority list based on how long data must stay secret, a named owner, and a timeline aligned with the EU's 2030 and 2035 milestones. It does not need a technical briefing on qubits.

← All 33 questions on Post-quantum cryptographyAll topics