PQC Governance & Policy

Establish governance frameworks, define roles, and create policies that guide your organization's PQC transition.

Why PQC Governance Matters

The transition to is not just a technical upgrade — it's an enterprise-wide transformation that touches every system, vendor, and compliance obligation. Without formal governance, organizations risk fragmented migration efforts, missed deadlines, and security gaps.

OMB Memorandum M-23-02 directs federal agencies to establish governance structures with clear roles, responsibilities, and executive sponsorship for their cryptographic transition to post-quantum algorithms — a model that applies equally to private-sector organizations managing complex PQC migrations.

— OMB M-23-02, Migrating to Post-Quantum Cryptography (2022)

Coordination

Align security, engineering, compliance, and procurement teams on a unified migration roadmap.

Accountability

Clear ownership of decisions — who selects algorithms, who approves exceptions, who tracks compliance.

Consistency

Enterprise-wide cryptographic standards prevent teams from making conflicting algorithm and library choices.

RACI: Roles & Responsibilities

A RACI matrix (Responsible, Accountable, Consulted, Informed) is the standard tool for mapping governance roles to migration activities. Every PQC program needs clarity on who does the work, who owns the decision, who provides input, and who needs to know.

Responsible

Does the work

Accountable

Owns the decision

Consulted

Provides input

Informed

Kept in the loop

Key rule: Each activity should have exactly one "A" (Accountable) to avoid diffusion of responsibility. Multiple "R" and "C" assignments are common for cross-functional work.

Policy Hierarchy

PQC governance requires a layered policy framework. Each layer provides increasing specificity, from enterprise-wide principles to team-level procedures.

Enterprise Cryptographic Policy

High-level principles: approved algorithms, prohibited algorithms, exception process, compliance obligations.

Approved by CISO / Board

Key Management Policy

Key lifecycle rules: generation, storage, rotation, destruction. HSM requirements. PQC key sizes and parameters.

Approved by CISO / CTO

Vendor Crypto Requirements

What cryptographic capabilities vendors must demonstrate. PQC readiness criteria for procurement.

Approved by Procurement / CISO

Migration Timeline Policy

Deadlines for each migration phase, system prioritization criteria, hybrid deployment requirements.

Approved by CTO / CISO

Governance Models

Centralized

A single crypto governance team sets all policies, selects algorithms, and manages migration. Best for smaller organizations or those with a strong central security function.

Pros: Consistent standards, faster decisions
Cons: May not account for BU-specific needs

Federated

Each business unit or region manages its own PQC transition within guardrails. Governance board sets boundaries but delegates execution. Common in regulated multi-nationals.

Pros: Local autonomy, compliance flexibility
Cons: Risk of inconsistency, slower alignment

Hybrid

Central team owns algorithm policy and compliance mapping. Business units own migration execution and testing. Most common model for large enterprises migrating to .

Pros: Balance of control and agility
Cons: Requires clear decision-rights mapping

Escalation & Conflict Resolution

PQC migration inevitably creates conflicts: business units resist migration timelines, vendors miss readiness deadlines, and teams disagree on algorithm choices. A defined escalation path prevents these conflicts from stalling the program.

Level 1: Working Group Resolution

Technical disagreements resolved within the PQC working group (e.g., algorithm selection, testing methodology). Timeframe: 5 business days.

Level 2: Steering Committee

Cross-functional conflicts (timeline vs. resource constraints, vendor exceptions) escalated to the PQC steering committee. Timeframe: 10 business days.

Level 3: Executive Sponsor (CISO/CTO)

Unresolved steering committee issues or budget-impacting decisions escalated to executive sponsor. Timeframe: 5 business days.

Level 4: Board / Risk Committee

Enterprise-level risk acceptance decisions (e.g., accepting quantum vulnerability for a critical system beyond deadline). Requires formal risk acceptance documentation.

Measuring Progress: KPIs

Governance without measurement is aspirational. Effective PQC programs track key performance indicators across technical progress, risk reduction, compliance posture, and organizational readiness.

Technical KPIs