[{"data":1,"prerenderedAt":431},["ShallowReactive",2],{"blog-\u002Fblog\u002Fquantum-readiness-questions-your-board-should-be-asking":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":367,"date":368,"description":369,"draft":370,"extension":371,"faqs":372,"findingsSource":7,"geo":385,"howto":7,"howtoTitle":7,"image":387,"industries":388,"keyFindings":7,"meta":390,"modified":391,"navigation":392,"path":393,"pullquote":7,"recommendations":7,"references":394,"related":410,"seo":415,"seoTitle":416,"signposts":7,"slug":417,"stats":418,"stem":421,"tags":422,"tldr":429,"__hash__":430},"blog\u002Fblog\u002Fquantum-readiness-questions-your-board-should-be-asking.md","Quantum Readiness Questions Your Board Should Be Asking","ArcQubit Team",null,{"type":9,"value":10,"toc":336},"minimark",[11,16,20,26,30,44,51,55,60,76,80,87,91,94,98,102,105,109,112,116,119,123,127,136,140,143,147,150,154,158,161,165,170,174,180,184,187,276,284,288,296,300,329,333],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19],"p",{},"Boards do not need to become quantum experts. They need to ask management twelve questions across four areas: risk exposure, strategy, governance and investment. Quantum risk is a fiduciary issue because nobody can give a date for a machine that breaks today's public-key encryption, and migration takes years. Insist on written answers with owners, dates and evidence.",[17,21,22],{},[23,24,25],"em",{},"Last verified: Sep. 30, 2026.",[12,27,29],{"id":28},"why-the-board-should-ask-now","Why the board should ask now",[17,31,32,33,37,38,43],{},"Experts disagree on timing. In the Global Risk Institute's 2025 survey of 26 experts, the averaged chance of a cryptographically relevant quantum computer was 28% to 49% within 10 years ",[34,35,36],"span",{},"1",". Those figures reflect opinion from a small sample, not a forecast. See ",[39,40,42],"a",{"href":41},"\u002Fblog\u002Fwhat-is-q-day","What Is Q-Day?"," for the detail.",[17,45,46,47,50],{},"Governments already plan around migration time instead of a date. The UK NCSC asks for discovery by 2028 and high-priority migration by 2031 ",[34,48,49],{},"4",". Those dates give a board a reasonable pace to test management against.",[12,52,54],{"id":53},"questions-about-risk-exposure","Questions about risk exposure",[56,57,59],"h3",{"id":58},"_1-what-is-our-exposure-to-harvest-now-decrypt-later-attacks","1. What is our exposure to harvest-now-decrypt-later attacks?",[17,61,62,63,66,67,70,71,75],{},"Attackers can copy encrypted data now and decrypt it once a capable quantum computer exists. The Canadian Cyber Centre defines the threat this way ",[34,64,65],{},"5",", and the U.S. executive order cites it as a reason to accelerate migration ",[34,68,69],{},"3",". No public source confirms which data sets attackers hold, so plan around the risk. Ask which data must stay confidential for 10 years or more. See ",[39,72,74],{"href":73},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later",".",[56,77,79],{"id":78},"_2-do-we-know-where-quantum-vulnerable-cryptography-exists","2. Do we know where quantum-vulnerable cryptography exists?",[17,81,82,83,86],{},"Most organizations cannot answer with confidence. OMB calls a dynamic, continuously updated cryptographic inventory the foundation of the migration plan ",[34,84,85],{},"2",". If management cannot show one, that gap is itself a risk.",[56,88,90],{"id":89},"_3-what-are-our-critical-vendors-doing-about-post-quantum-cryptography","3. What are our critical vendors doing about post-quantum cryptography?",[17,92,93],{},"Part of your exposure sits in products and services you do not control. Ask which vendors have published a plan, which have declined to share one, and who owns each dependency.",[12,95,97],{"id":96},"questions-about-strategic-positioning","Questions about strategic positioning",[56,99,101],{"id":100},"_4-are-our-competitors-and-peers-investing-in-quantum","4. Are our competitors and peers investing in quantum?",[17,103,104],{},"Ask management for evidence, not anecdotes. Request a short benchmark of what peers and regulators in your sector are doing, with sources.",[56,106,108],{"id":107},"_5-have-we-identified-business-problems-where-quantum-computing-could-create-value","5. Have we identified business problems where quantum computing could create value?",[17,110,111],{},"Quantum computing targets specific problem types, such as optimization and molecular simulation. Ask whether management has screened for real use cases and whether a small, time-boxed experiment is warranted.",[56,113,115],{"id":114},"_6-what-is-our-multi-year-strategy-for-building-capability","6. What is our multi-year strategy for building capability?",[17,117,118],{},"Readiness is a sustained posture, not a project with an end date. Ask how security migration and quantum adoption fit into one plan, and how it changes as the technology matures.",[12,120,122],{"id":121},"questions-about-governance-and-accountability","Questions about governance and accountability",[56,124,126],{"id":125},"_7-who-owns-quantum-readiness","7. Who owns quantum readiness?",[17,128,129,130,132,133,135],{},"Readiness spans security, technology, procurement and the business. Federal agencies must name a migration lead within 30 days of the executive order ",[34,131,69],{},", and Canada's roadmap names executive and technical leads ",[34,134,65],{},". ArcQubit guidance: name one accountable executive who reports to the board.",[56,137,139],{"id":138},"_8-how-does-it-connect-to-our-risk-and-compliance-frameworks","8. How does it connect to our risk and compliance frameworks?",[17,141,142],{},"Quantum risk belongs in enterprise risk management, not in a standalone report. Ask where it sits in the risk register and which committee reviews it.",[56,144,146],{"id":145},"_9-what-governance-exists-for-quantum-investment-decisions","9. What governance exists for quantum investment decisions?",[17,148,149],{},"Ask what spending thresholds trigger board review and how quantum work competes with other technology priorities.",[12,151,153],{"id":152},"questions-about-investment-and-timeline","Questions about investment and timeline",[56,155,157],{"id":156},"_10-what-is-our-planned-three-year-investment","10. What is our planned three-year investment?",[17,159,160],{},"Ask for a range covering both migration and exploration, with the assumptions behind it. A number with no assumptions is not an answer.",[56,162,164],{"id":163},"_11-what-milestones-show-we-are-on-track","11. What milestones show we are on track?",[17,166,167,168,75],{},"Expect measurable milestones: inventory coverage, systems migrated, supplier responses received and pilots started. OMB's first migration phase, 2026 to 2027, centers on discovery and inventory ",[34,169,85],{},[56,171,173],{"id":172},"_12-what-happens-if-timelines-compress","12. What happens if timelines compress?",[17,175,176,177,179],{},"Ask for a contingency plan. The Global Risk Institute reports that experts see the timeline accelerating compared with earlier editions ",[34,178,36],{},". Crypto agility, the ability to swap algorithms without a rebuild, is what makes acceleration affordable.",[12,181,183],{"id":182},"sample-answers-and-evidence-to-request","Sample answers and evidence to request",[17,185,186],{},"ArcQubit guidance: a good answer is specific, dated and owned. Use this table to tell strong answers from weak ones.",[188,189,190,206],"table",{},[191,192,193],"thead",{},[194,195,196,200,203],"tr",{},[197,198,199],"th",{},"Question",[197,201,202],{},"A board-ready answer sounds like",[197,204,205],{},"Evidence to request",[207,208,209,221,232,243,254,265],"tbody",{},[194,210,211,215,218],{},[212,213,214],"td",{},"1. Harvest-now exposure",[212,216,217],{},"\"These data sets must stay secret beyond 10 years, and these links carry them.\"",[212,219,220],{},"Data-lifespan classification signed off by data owners",[194,222,223,226,229],{},[212,224,225],{},"2. Visibility",[212,227,228],{},"\"Inventory covers a stated share of high-value systems, refreshed on a schedule.\"",[212,230,231],{},"Coverage percentage and last scan date",[194,233,234,237,240],{},[212,235,236],{},"3. Vendors",[212,238,239],{},"\"We asked our critical suppliers; here are the responses and gaps.\"",[212,241,242],{},"Supplier responses and renewal clauses",[194,244,245,248,251],{},[212,246,247],{},"7. Ownership",[212,249,250],{},"\"One named executive owns it and reports each half year.\"",[212,252,253],{},"Charter or role description",[194,255,256,259,262],{},[212,257,258],{},"11. Milestones",[212,260,261],{},"\"Discovery finishes this year; first-wave migration follows.\"",[212,263,264],{},"Dated roadmap with progress metrics",[194,266,267,270,273],{},[212,268,269],{},"12. Acceleration",[212,271,272],{},"\"We can re-sequence the first wave within a quarter.\"",[212,274,275],{},"Contingency plan and agility assessment",[17,277,278,279,283],{},"If an answer is uncertain, treat that as information. It shows where to direct funding first. The ",[39,280,282],{"href":281},"\u002Fblog\u002Fquantum-readiness-assessment","Readiness Self-Assessment"," gives management a structured way to gather this evidence.",[12,285,287],{"id":286},"how-to-use-these-questions","How to use these questions",[17,289,290,291,295],{},"These questions are conversation starters, not a compliance checklist. Put quantum readiness on the technology or risk committee agenda at least twice a year. Annual review is too slow for a topic with published government deadlines. The ",[39,292,294],{"href":293},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines"," guide shows which dates may apply to you.",[12,297,299],{"id":298},"common-mistakes","Common mistakes",[301,302,303,311,317,323],"ul",{},[304,305,306,310],"li",{},[307,308,309],"strong",{},"Waiting for a firmer date."," The date will not firm up in time to help. Plan from data lifespan and migration time.",[304,312,313,316],{},[307,314,315],{},"Accepting verbal assurance."," Require written answers with owners and dates.",[304,318,319,322],{},[307,320,321],{},"Treating it as a pure security project."," Procurement, legal and the business own parts of it.",[304,324,325,328],{},[307,326,327],{},"Confusing adoption with migration."," Exploring quantum computing and migrating cryptography are separate workstreams with separate owners and budgets.",[12,330,332],{"id":331},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,334,335],{},"ArcQubit's QuCode is enterprise discovery, sold directly, and produces a Quantum Exposure Report that ranks findings and shows whether your team or a supplier must fix each one. QuTrust is the migration system of record and keeps the roadmap and evidence current for ongoing board reporting. For strategy questions and board advisory, the AI & Quantum Consulting team can help.",{"title":337,"searchDepth":338,"depth":338,"links":339},"",2,[340,341,342,348,353,358,363,364,365,366],{"id":14,"depth":338,"text":15},{"id":28,"depth":338,"text":29},{"id":53,"depth":338,"text":54,"children":343},[344,346,347],{"id":58,"depth":345,"text":59},3,{"id":78,"depth":345,"text":79},{"id":89,"depth":345,"text":90},{"id":96,"depth":338,"text":97,"children":349},[350,351,352],{"id":100,"depth":345,"text":101},{"id":107,"depth":345,"text":108},{"id":114,"depth":345,"text":115},{"id":121,"depth":338,"text":122,"children":354},[355,356,357],{"id":125,"depth":345,"text":126},{"id":138,"depth":345,"text":139},{"id":145,"depth":345,"text":146},{"id":152,"depth":338,"text":153,"children":359},[360,361,362],{"id":156,"depth":345,"text":157},{"id":163,"depth":345,"text":164},{"id":172,"depth":345,"text":173},{"id":182,"depth":338,"text":183},{"id":286,"depth":338,"text":287},{"id":298,"depth":338,"text":299},{"id":331,"depth":338,"text":332},"Compliance","2026-02-24","Twelve questions boards should ask management about quantum risk, strategy, governance and investment, plus sample answers and evidence to request.",false,"md",[373,376,379,382],{"q":374,"a":375},"What should a board ask about quantum risk?","Ask who owns the risk, which data must stay secret for a decade or more, whether management has an inventory of its cryptography, what critical vendors plan to do, and which milestones show progress. Require written answers with owners and dates, not verbal reassurance.",{"q":377,"a":378},"Does the board need to understand quantum computing?","No. The board needs to oversee a risk and a budget, not the physics. Focus on data lifespan, migration lead time, supplier dependence and accountability. The Global Risk Institute survey shows experts disagree on timing, so governance should not depend on a predicted date [1].",{"q":380,"a":381},"How often should the board review quantum readiness?","ArcQubit guidance is at least twice a year, through the risk or technology committee. Government timelines already run in phases, such as the UK NCSC's 2028, 2031 and 2035 milestones [4], so a semi-annual review lets the board track progress against them.",{"q":383,"a":384},"What evidence should management bring to the board?","Ask for an inventory coverage percentage, a ranked list of exposed systems with owners, a data-lifespan classification, supplier responses on post-quantum plans, and a dated migration roadmap. Weak or missing evidence tells the board where visibility and planning need work.",[386],"global","\u002Fblog\u002Fboard-quantum-readiness.png",[389],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fquantum-readiness-questions-your-board-should-be-asking",[395,398,401,404,407],{"label":396,"url":397},"M. Mosca and M. Piani, \"Quantum Threat Timeline Report 2025,\" Global Risk Institute and evolutionQ","https:\u002F\u002Fglobalriskinstitute.org\u002Fpublication\u002Fquantum-threat-timeline-report-2025b\u002F",{"label":399,"url":400},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":402,"url":403},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":405,"url":406},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":408,"url":409},"Canadian Centre for Cyber Security, \"Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),\" Communications Security Establishment Canada, Jun. 2025","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Froadmap-migration-post-quantum-cryptography-government-canada-itsm40001",[411,412,413,414],{"label":42,"url":41},{"label":294,"url":293},{"label":282,"url":281},{"label":74,"url":73},{"title":5,"description":369},"Quantum Readiness Questions for Your Board","quantum-readiness-questions-your-board-should-be-asking",[419,420],"Among 26 surveyed experts, the averaged chance of a cryptographically relevant quantum computer within 10 years is 28% to 49% (Global Risk Institute, 2025).","The UK NCSC asks organizations to complete a full cryptographic discovery exercise by 2028 (NCSC, 2025).","blog\u002Fquantum-readiness-questions-your-board-should-be-asking",[423,424,425,426,427,428],"quantum readiness","quantum risk","PQC migration","harvest now decrypt later","for enterprises","post-quantum cryptography","Boards do not need quantum expertise, but they should ask management twelve questions on risk exposure, strategy, governance and investment, and expect written, evidence-based answers with named owners and dates.","4GMpGdznB02m5BIejWjyTBjqX3FDbsoQJACXjKEu4mo",1792182884360]