Chapter 10, “Define Success Metrics and Risk Tolerance”, offers a comprehensive guide for measuring and managing progress in post-quantum cryptography (PQC) migrations. It emphasizes the strategic role of Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) in aligning cryptographic transformations with business goals, risk appetites, and regulatory demands. Readers are shown how to establish quantifiable success metrics across discovery, planning, implementation, and sustainment phases – enabling leadership to distinguish between activity and meaningful outcomes. The chapter advocates for metrics that go beyond technical deployment to reflect reduced exposure, crypto-agility, and vendor compliance. This chapter introduces a structured approach to defining risk tolerance in quantum security programs. It includes practical guidance for translating cryptographic exposure, data sensitivity, vendor dependency, and operational delays into measurable thresholds. A dedicated risk tolerance assessment questionnaire supports executive alignment and governance documentation. The chapter stresses that risk boundaries should be explicit, actionable, and continuously reviewed to support informed escalation and resourcing decisions.
Chapter 10, “Define Success Metrics and Risk Tolerance”, offers a comprehensive guide for measuring and managing progress in post-quantum cryptography (PQC) migrations. It emphasizes the strategic role of Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) in aligning cryptographic transformations with business goals, risk appetites, and regulatory demands. Readers are shown how to establish quantifiable success metrics across discovery, planning, implementation, and sustainment phases – enabling leadership to distinguish between activity and meaningful outcomes. The chapter advocates for metrics that go beyond technical deployment to reflect reduced exposure, crypto-agility, and vendor compliance. This chapter introduces a structured approach to defining risk tolerance in quantum security programs. It includes practical guidance for translating cryptographic exposure, data sensitivity, vendor dependency, and operational delays into measurable thresholds. A dedicated risk tolerance assessment questionnaire supports executive alignment and governance documentation. The chapter stresses that risk boundaries should be explicit, actionable, and continuously reviewed to support informed escalation and resourcing decisions.
This chapter outlines a comprehensive approach to building a post-quantum cryptography (PQC) migration and testing plan, turning strategic intent into operational action. It introduces a phased roadmap that includes setting migration criteria, defining success metrics, and staging pilot environments for crypto-agility validation. Emphasis is placed on identifying quick wins and high-risk cryptographic workloads that must transition first, while accounting for infrastructure dependencies, vendor constraints, and regulatory requirements. The chapter also presents simplified mitigation strategies, such as data withdrawal or crypto-isolation, for systems that cannot yet adopt quantum-safe algorithms. Readers are guided through practical test lab design, leveraging tools like OpenSSL, BoringSSL, liboqs, and Qiskit to evaluate PQC candidates in controlled environments. The chapter includes guidance on simulating algorithm swaps, measuring application compatibility, and documenting fallbacks for hybrid or dual-stack scenarios. Specific testing protocols are outlined for TLS, VPNs, code signing, encrypted storage, and other critical cryptographic functions, helping organizations uncover performance issues and interoperability gaps before deployment. The role of the Cryptographic Bill of Materials (CBOM) is reinforced as an input to track algorithm usage and inform targeted testing.
This chapter presents a structured approach for preparing organizations for quantum-era cybersecurity. It introduces a domain-based quantum security maturity model aligned with guidance from NIST, ENISA, ETSI, and WEF. Key domains include cryptographic inventory, workforce readiness, crypto-agility, vendor compliance, and PQC migration. Maturity levels range from initial awareness to optimized quantum-safe operations. The chapter outlines a six-phase implementation roadmap: awareness, inventory, risk assessment, migration planning, implementation, and continuous monitoring. Radar charts and TRL-based models assess maturity across cryptographic and quantum capabilities. Mid- and long-term plans extend readiness through 2040, incorporating QML, QAOA, QKD, and emerging quantum applications. Security capabilities are mapped to quantum technologies, providing actionable links between investment and defense outcomes. The chapter emphasizes a phased, risk-prioritized transition and provides milestones and timelines for near- and mid-term actions. Organizations are encouraged to tailor their targets based on operational needs, with a focus on foundational resilience before broader quantum adoption.
Chapter 16, “Readiness Assessments and Compliance Audits”, provides a comprehensive roadmap for demonstrating the effectiveness and accountability of post-quantum cryptography (PQC) programs. As organizations adopt quantum-resistant algorithms, passing a formal audit becomes a critical milestone especially for sectors governed by regulatory bodies such as NIST, CISA, and the PCI Security Standards Council. This chapter outlines the transition from implementation to verification, guiding readers through internal, external, and self-assessments that validate both technical controls and governance alignment. The chapter introduces a practical PQC audit readiness framework, emphasizing the need for documented migration policies, asset inventories, testing records, and real-time cryptographic monitoring. Internal audit guidelines are detailed with a sample worksheet, focusing on key elements like algorithm usage, entropy validation, certificate management, and hybrid cryptography behaviors. The importance of aligning with authoritative standards – NIST SP 1800-38, IR 8547, and PCI DSS 4.0 – is stressed throughout, along with specific audit preparation tools such as IBM Guardium and post-quantum telemetry dashboards.
This chapter introduces the Q-Ready Framework, a structured and practical model for guiding organizations through their post-quantum cryptography (PQC) transition. Developed in alignment with National Security Memorandum-10 (NSM-10), NIST SP 1800-38, FIPS 203–206, and CISA guidance, the framework translates federal directives and industry best practices into an actionable strategy tailored for enterprise security leaders. The framework includes five key phases – Discovery, Planning, Implementation, Validation, and Maintenance – each with three steps designed to help organizations inventory cryptographic assets, prioritize risk, deploy quantum-safe algorithms, and sustain long-term readiness. The Q-Ready Framework addresses the real-world challenges of cryptographic migration, including fragmented inventories, legacy infrastructure, complex supply chains, and regulatory mandates. It integrates with established cybersecurity governance models such as the NIST Cybersecurity Framework (CSF) and Risk Management Framework (RMF), ensuring audit and compliance alignment. The chapter also outlines how the rest of the book is organized around this framework, allowing readers to access field-tested advice, tooling guidance, success metrics, and organizational strategies based on their current phase in the quantum readiness journey.
Chapter 19 of Quantum Ready focuses on the essential human and operational dimensions of post-quantum cryptographic resilience. As quantum computing threatens to destabilize today's cryptographic foundations, technology alone is insufficient. This chapter outlines the critical organizational capabilities required to sustain quantum-safe operations, including quantum literacy training, role-specific assessment frameworks, and the development of tested playbooks and tabletop exercises. It highlights the importance of building institutional capacity, aligning responsibilities, and ensuring preparedness across security, DevOps, incident response, and compliance functions. Key themes include the creation of a quantum-aware workforce, the integration of cryptographic failure scenarios into real-world preparedness simulations, and the designation of a quantum risk owner who oversees lifecycle management, incident coordination, and executive reporting. The chapter introduces resources such as hands-on labs, certification pathways, and internal enablement strategies to promote continuous education and operational readiness. It also examines how behavioral change management and gamification can drive cultural adoption, making cryptographic resilience a shared responsibility. In addition, this chapter emphasizes the importance of embedding post-quantum cryptography (PQC) into third-party risk management and procurement processes. It provides guidance on updating vendor questionnaires, contract terms, SLAs, and audit procedures to enforce PQC readiness across the supply chain. By operationalizing training, governance, and third-party accountability, organizations can move from ad hoc preparation to sustained cryptographic agility.
This introductory chapter offers a strategic executive summary of the post-quantum cryptography (PQC) challenge, providing cybersecurity leaders, board members, and C-suite executives with a high-level, business-focused overview of the quantum computing threat. It explains how quantum computers will eventually break the public key cryptography that secures digital trust and emphasizes why organizations must begin preparing now – before adversaries can exploit these vulnerabilities at scale. The chapter defines Q-Day, explains the “Harvest Now, Decrypt Later” threat model, and reframes quantum risk in terms of enterprise revenue, cost, and regulatory exposure. Designed as a standalone executive briefing, the chapter outlines the Q-Ready Framework: a five-phase operational roadmap for quantum readiness encompassing discovery, planning, implementation, validation, and maintenance. It highlights critical actions such as cryptographic inventory, migration planning, crypto-agility, vendor risk assessment, and executive governance. The chapter also includes communication templates, boardroom messaging, key performance indicators, and frequently asked questions to help CISOs engage stakeholders and secure organizational buy-in.