Chapter 9 — Quantum and post-quantum security: leadership and assurance
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Programme leadership"]
N2["9.2 Three lines of assurance"]
N3["9.3 Evidence for auditors and regulators"]
N4["9.4 Communication"]
N5["9.5 Sustaining"]
N6["9.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Programme leadership"]
N2["9.2 Three lines of assurance"]
N3["9.3 Evidence for auditors and regulators"]
N4["9.4 Communication"]
N5["9.5 Sustaining"]
N6["9.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Programme leadership]
|
v
[9.2 Three lines of assurance]
|
v
[9.3 Evidence for auditors and regulators]
|
v
[9.4 Communication]
|
v
[9.5 Sustaining]
|
v
[9.6 Worked case]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) lead a multi-year migration programme with clear objectives; (2) design an assurance model with independent verification; (3) prepare evidence for auditors and regulators; (4) communicate with boards, clinicians and suppliers; and (5) sustain the programme through staff turnover and changing guidance.
9.1 Programme leadership
A multi-year programme needs a mission ("protect long-lived confidentiality and trust against quantum attack without harming clinical services"), objectives with dates, a roadmap by tier, a budget envelope with ranges, and governance. The leader's job is to keep priorities aligned with evidence as both guidance and technology change, and to protect the programme from being reduced to a compliance checklist.
Write the mission and objectives in a short document that the board approves, and revisit them at each annual review. Keep the roadmap by tier so that it shows what is protected first and why. When guidance or technology changes, record the change and its effect on priorities.
9.2 Three lines of assurance
The first line (platform owners) implements and self-tests; the second line (security and risk) sets standards and monitors; the third line (internal audit) independently tests. For PQC, independent verification means re-observing negotiated algorithms, sampling certificates, reviewing exception registers and testing agility claims, not reading status reports.
At NRHT internal audit re-observed tier-1 flows and found three with classical fallback, which status reports had not shown. The first and second lines should expect such findings and treat them as information. Agree in advance how findings are reported and who acts on them.
9.3 Evidence for auditors and regulators
Prepare an evidence pack: cryptographic standard and its approval; inventory with coverage and grades; prioritisation method and decisions; progress metrics with sources; exception and residual-risk register with expiries; test reports; supplier assurance. Each item should be generated by normal operation, so the pack is cheap to refresh.
Keep the pack in one location with a short index and the date each item was generated. When an auditor asks for something not in the pack, add it to the normal process so it is there next time. Avoid creating documents only for audits; they age immediately and cannot be trusted.
9.4 Communication
Boards need decisions and risk posture; clinicians need assurance that changes will not disrupt care and clear change windows; suppliers need clear requirements and timelines; staff need to know what changes for them. Messages should be calm and specific; avoid both alarm and complacency.
Use the same facts for every audience but change the emphasis. A board paper leads with posture and decisions needed; a clinical briefing leads with change windows and fallbacks; a supplier letter leads with requirements and dates. Keep copies with dates, so that messages can be checked against what happened later.
9.5 Sustaining
Guidance will change: IR 8547 may be finalised with different dates; FN-DSA and HQC standards will appear. Build review cycles into governance, keep decision records, train successors, and keep the inventory alive. A programme that depends on one expert is fragile.
Name a deputy for each key role and keep decision records current, so that a departure does not stop the programme. Run the review cycle on a calendar rather than waiting for news. When a standard changes, update the brief, the standard and any affected decisions in the same review.
9.6 Worked case
NRHT's year-two assurance review (synthetic): internal audit samples 60 tier-1 flows and re-observes 57 (95 %) with the reported algorithm; three show classical fallback due to a reverted configuration — a finding that leads to configuration-drift monitoring. The exception register has 41 entries; six have passed expiry without review — a finding that leads to automatic escalation. The board receives a one-page posture: tier-1 hybrid coverage 64 % (A/B evidence), unknown 7 %, PKI plan on track, two high residual risks accepted with expiry.
Each finding leads to a process change rather than a one-off fix, and the board posture shows both progress and residual risk. Record the audit sample size and method so the next review can compare results.
9.7 Common errors and limits
- Assurance by status report.
- Evidence packs built specially before audits.
- Programmes dependent on a single expert.
Each error has a guard. Re-observe negotiated algorithms instead of reading reports. Generate evidence from normal operations. Train successors and keep decision records, so the programme continues if its lead leaves. At NRHT the year-two audit sample of 60 tier-1 flows (9.6) is the model: re-observation found what status reports had missed. The evidence pack is generated from normal operation and refreshed each quarter. A named deputy can run each review if the lead is absent, and decision records explain why each choice was made, so a newcomer can continue the work.
Exercises
- EX041 — Objectives. Write three dated, measurable programme objectives for NRHT. Rubric: 3 = specific, measurable, time-bound, tied to tiers.
- EX042 — Audit test. Design an independent test of the claim "all tier-1 inter-site links use hybrid key exchange". Rubric: 3 = sampling, re-observation method, pass criterion.
- EX043 — Evidence pack. List seven items in the evidence pack and their sources. Rubric: 3 = seven items with operational sources.
- EX044 — Clinician message. Write a 100-word message to clinical leads about a PACS change window. Rubric: 3 = what, when, impact, contact, reassurance.
- EX045 — Continuity. Propose three measures that keep the programme alive through leadership change. Rubric: 3 = documentation, governance cycles, distributed expertise.
Synthesis
Leadership keeps a multi-year programme aligned with evidence; assurance re-observes rather than reads; evidence packs arise from normal operations; and continuity is designed in.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →