Chapter 32 — Quantum and post-quantum security: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX063.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Law and regulation"]
N2["32.2 Finance and procurement"]
N3["32.3 Communication and governance"]
N4["32.5 Practical activity"]
N5["32.7 Regulators and auditors"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX063"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Law and regulation"]
N2["32.2 Finance and procurement"]
N3["32.3 Communication and governance"]
N4["32.5 Practical activity"]
N5["32.7 Regulators and auditors"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX063"]
[Learning outcomes]
|
v
[32.1 Law and regulation]
|
v
[32.2 Finance and procurement]
|
v
[32.3 Communication and governance]
|
v
[32.5 Practical activity]
|
v
[32.7 Regulators and auditors]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX063]
Learning outcomes
You will (1) connect PQC migration to law, finance, procurement and communications; (2) translate technical risk for board decisions; (3) estimate migration cost drivers; and (4) design stakeholder engagement.
32.1 Law and regulation
Regulators increasingly expect financial institutions to manage cryptographic risk. Contracts define confidentiality periods that become x in Mosca's inequality. Evidence rules for signed documents shape archive design. A lawyer and a cryptographer looking at the same mortgage archive see two sides of one requirement.
Getting both views into the same room early prevents a design that is technically sound but cannot be relied on in a dispute. For HCU, the legal team supplies the confidentiality periods for each data class, and those periods become the inputs to the prioritisation model rather than estimates made by the technical team alone.
32.2 Finance and procurement
Migration cost drivers include inventory effort, software upgrades, hardware replacement, testing, staff training and partner coordination. Aligning hardware replacement with natural refresh cycles lowers cost; procurement clauses requiring algorithm agility, post-quantum support and cryptographic inventories reduce future cost. Finance teams need ranges and assumptions, not single figures.
A range that shows the effect of a delayed vendor or an early replacement is more useful than a precise number that turns out wrong. HCU's estimate separates costs it controls, such as testing and training, from costs set by partners and vendors.
32.3 Communication and governance
Boards need one-page decisions: exposure, options, recommendation, cost range, residual risk. Staff need to know what changes for them. Members need reassurance without alarm. Avoid fear-based messaging; describe what is being protected and why the timing is prudent.
The same facts can serve each audience if the level of detail changes. HCU's board paper on the migration fits on one page, with the technical evidence attached for those who want it. The member notice, if one is ever needed, says what is protected and that nothing is required of members.
32.4 Worked example
HCU's security lead presents to the board: "Our 30-year mortgage archive is exposed to recorded-traffic risk under any plausible quantum timeline. Option A: hybrid key exchange on branch VPNs within 12 months, cost CU 180–260k (synthetic currency units). Option B: wait for full appliance replacement in four years, cost included in refresh budget, but four more years of exposure. Recommendation: A, plus post-quantum requirements in the refresh tender. Residual risk: classical signatures on archive timestamps, addressed in the archive plan." The board approves A with a quarterly report.
32.5 Practical activity
Prepare a stakeholder map for HCU's migration: legal, finance, procurement, IT operations, vendors, partners, members and regulators, with what each needs and provides.
Mark which groups must approve decisions, which must be consulted, and which only need to be informed. Note any group whose cooperation is on the critical path, such as the payment network, and say how and when it will be contacted. Then compare your map with a classmate's and discuss any group one of you missed. Keep the map current as the plan changes.
32.6 Common errors and limits
- Presenting technical detail without a decision.
- Single-figure cost estimates.
- Ignoring procurement as a control.
- Leaving legal and procurement out until the technical design is finished.
- Treating member communication as an afterthought.
- Writing board papers that list risks but do not ask for a decision.
- Assuming regulators want the same detail as engineers.
- Forgetting that partners' timelines may set the pace.
Each makes a sound technical plan harder to fund, approve or carry out. Involving these groups early costs little and avoids rework.
32.7 Regulators and auditors
Auditors will ask for evidence, not intentions: the inventory with its coverage, the prioritisation method, the approved plan and progress against it. Organizing the migration programme so that these artefacts exist as by-products of normal work — the CBOM regenerated each quarter, decision records for each choice — makes audits cheaper and more honest than preparing special documents before each review.
An honest progress report includes the items that are late and why. HCU's internal audit team reviews the CBOM and decision records once a year and reports any gaps to the risk committee.
Exercises
- EX063 — Board slide. Write a five-line board decision for HCU's internal CA migration. Rubric: 3 = exposure, options, recommendation, cost range, residual risk.
- EX064 — Procurement clause. Draft two contract clauses supporting crypto-agility. Rubric: 3 = enforceable, specific clauses.
Synthesis
PQC migration is interdisciplinary: law sets lifetimes, finance and procurement shape cost, and governance turns analysis into decisions.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →