For directors
Board questions on post-quantum cryptography.
Fourteen questions directors can put to management, grouped by theme and aligned with ASD and APRA guidance. Each comes with a short note on what a good answer covers.
Exposure
Which of our information must remain confidential beyond 2030, and for how long?
Data shelf life drives urgency. Management should identify the records, customer data and intellectual property whose confidentiality must outlast the arrival of a CRQC.
Are we exposed to harvest now, decrypt later today?
Encrypted traffic and stored data can be captured now and decrypted later. Management should state which systems carry long-lived data over channels protected by traditional public-key cryptography.
Which signatures and trust anchors would cause the most harm if forged?
Root certificates, code-signing and firmware-signing keys underpin integrity. Their compromise would allow forged software and certificates to be accepted as genuine.
Inventory
Do we hold a current inventory of where cryptography is used?
ASD expects organisations to know where cryptography is relied upon. The inventory should cover certificates, keys, protocols, libraries, hardware security modules and supplier services.
How complete is that inventory, and what could not be examined?
An inventory is only as useful as its coverage. Management should report coverage and confidence, including systems and suppliers that were out of reach.
Is the inventory held in a form that can be maintained?
A machine-readable record, such as a CycloneDX cryptography bill of materials, allows the inventory to be refreshed and compared over time rather than rebuilt.
Plan and timeline
Do we have a post-quantum transition plan, and who owns it?
ASD recommends a refined transition plan by the end of 2026. The plan should have a named executive owner and be adopted by the organisation as its own.
Are critical systems scheduled to begin migration by 2028 and complete by the end of 2030?
These are ASD's recommended milestones. Management should show how the sequence of migration waves meets them, and where it does not, why.
How have we prioritised systems, and on what evidence?
Priorities should trace to data shelf life, exposure, criticality and migration effort, so the board can see why one system moves before another.
Suppliers
Which material service providers operate cryptography on our behalf?
Under CPS 230, responsibility for service-provider risk stays with the entity. The board should know which suppliers hold keys or terminate encryption for the organisation.
Do our contracts and procurement require post-quantum support?
New purchases and renewals are the lowest-cost point to require approved post-quantum algorithms and crypto-agility. Management should confirm the clauses are in place.
Governance and assurance
How will the board receive progress reports, and how often?
A governance cycle with regular re-scans and an annual plan refresh gives directors evidence of progress rather than assurance by assertion.
Is quantum risk reflected in our information security obligations under CPS 234?
APRA expects boards to understand material information security risks. Cryptographic risk should appear in the risk register and in the reporting that supports CPS 234.
What independent assurance will we obtain over the plan and its delivery?
Internal audit or an independent reviewer should be able to test the inventory, the prioritisation and the evidence for each completed migration.
Prepare the board with a clear baseline.
A 30-minute consultation, led by a PQC expert, helps management answer these questions with evidence.
Book a 30-minute consultation