Chapter 9 — Cryptography and trust services: leadership and assurance | Postgraduate Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Cryptography and trust services: leadership and assurance

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Leading the programme"]
  N2["9.2 Assurance to the board"]
  N3["9.3 Independent assurance"]
  N4["9.4 Regulatory engagement"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Leading the programme"]
  N2["9.2 Assurance to the board"]
  N3["9.3 Independent assurance"]
  N4["9.4 Regulatory engagement"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Leading the programme]
    |
    v
[9.2 Assurance to the board]
    |
    v
[9.3 Independent assurance]
    |
    v
[9.4 Regulatory engagement]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) lead a cryptographic modernisation programme; (2) provide assurance to boards and regulators; (3) define programme metrics and reporting.

9.1 Leading the programme

Leila becomes programme lead. She sets a two-year roadmap in phases: inventory and baseline in the first six months, key-management consolidation in the next nine, and post-quantum readiness pilots in the final nine, with legacy EDI retirement running throughout. Each phase has deliverables, owners and exit criteria. She meets unit owners monthly and the steering committee quarterly. Leading means removing obstacles, such as negotiating time with business units, more than designing cryptography. She keeps a single-page roadmap visible to every unit, so progress and slips are obvious to everyone.

9.2 Assurance to the board

The board wants assurance that the programme reduces risk. Leila reports a small set of metrics: legacy-accepting endpoints, share of certificates automated, keys without owners, systems with post-quantum readiness assessments and incidents related to cryptography. Each metric has a baseline, a target and a trend. She pairs metrics with narrative: what changed, what slipped and why. She avoids vanity metrics, such as the number of policies published, which say little about risk. Each quarter's report fits on two pages, so busy directors actually read it.

9.3 Independent assurance

Corvane's internal audit team reviews the programme halfway through. Auditors sample evidence: change records, inventory entries and key ceremony minutes. They find the inventory accurate for internet-facing systems but incomplete for internal services, and that two units' owners rarely attend the forum. Leila accepts the findings, adds internal scanning and escalates attendance through unit heads. She values independent assurance because it tests whether the programme works as reported, not only as designed. She shares the audit report with all unit owners.

9.4 Regulatory engagement

Corvane's finance division is regulated and must show sound key management. Leila prepares a pack for the regulator: the cryptographic standard, inventory summary, key-management architecture, evidence of controls and the post-quantum plan. She explains assumptions openly, including the planning scenario chosen in Chapter 4. The regulator asks how Corvane would respond to a compromise of a signing root; Leila walks through the rehearsed procedure. Transparent engagement builds credibility that helps when issues arise later. She keeps a log of every regulator question and answer.

Worked example

Leila leads a phased two-year roadmap, reports five risk metrics with narrative, accepts audit findings on internal inventory and forum attendance, and briefs the regulator on assumptions and compromise response.

Synthetic case. The programme and audit are invented.

Errors and limits

Metrics reported without narrative invite misreading. Assurance limited to design misses whether controls operate.

Exercises

EX041 — Roadmap phases. Describe the three roadmap phases. Rubric: 3 = inventory and baseline (6 months), key consolidation (9), PQ pilots (9), with EDI retirement throughout;; 2 = partial;; 1 = vague;; 0 = none.
EX042 — Board metrics. Name three metrics Leila reports. Rubric: 3 = three of legacy endpoints, automated certificate share, unowned keys, PQ assessments, crypto incidents;; 2 = two;; 1 = vanity;; 0 = none.
EX043 — Audit findings. What did internal audit find? Rubric: 3 = inventory incomplete for internal services; two units' owners rarely attend;; 2 = one;; 1 = vague;; 0 = none.
EX044 — Regulator pack. List three items in the regulator pack. Rubric: 3 = three of standard, inventory summary, architecture, control evidence, PQ plan;; 2 = two;; 1 = one;; 0 = none.
EX045 — Regulator question. What did the regulator ask and how did Leila answer? Rubric: 3 = response to signing-root compromise; walked through rehearsed procedure;; 2 = both;; 1 = one;; 0 = none.

Synthesis

Leadership turns cryptographic plans into delivered change, and honest metrics with independent assurance give boards and regulators justified confidence.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →