PQC Governance & Policy
Establish governance frameworks, define roles, and create policies that guide your organization's PQC transition.
Why this matters: Without a policy naming owners, deadlines, and exceptions, migration stalls as everyone's job and no one's.
Start here: Fill the RACI Matrix for the ten migration activities across six roles: one Accountable per row, and the tool flags a row that has two.
For your role
- Executive / Business Leader
- Define roles and responsibilities, generate the policy templates and design the governance KPI dashboard for board reporting: without a policy naming owners, deadlines and exceptions, migration is everyone's job and no one's.
- GRC / Risk & Compliance
- The RACI step, the policy generator and the escalation-tier step that evaluates exception requests are the governance controls a framework expects, each producing an exportable artefact.
- Researcher / Academic
- The governance model's roles, policy structure and exception criteria are explicit and map to the Command Center tools the module hands off to.
Why PQC Governance Matters
The transition to is not just a technical upgrade — it's an enterprise-wide transformation that touches every system, vendor, and compliance obligation. Without formal governance, organizations risk fragmented migration efforts, missed deadlines, and security gaps.
OMB Memorandum M-23-02 directs federal agencies to establish governance structures with clear roles, responsibilities, and executive sponsorship for their cryptographic transition to post-quantum algorithms — a model that applies equally to private-sector organizations managing complex PQC migrations.
— OMB M-23-02, Migrating to Post-Quantum Cryptography (2022)
Align security, engineering, compliance, and procurement teams on a unified migration roadmap.
Clear ownership of decisions — who selects algorithms, who approves exceptions, who tracks compliance.
Enterprise-wide cryptographic standards prevent teams from making conflicting algorithm and library choices.
RACI: Roles & Responsibilities
A RACI matrix (Responsible, Accountable, Consulted, Informed) is the standard tool for mapping governance roles to migration activities. Every PQC program needs clarity on who does the work, who owns the decision, who provides input, and who needs to know.
Does the work
Owns the decision
Provides input
Kept in the loop
Key rule: Each activity should have exactly one "A" (Accountable) to avoid diffusion of responsibility. Multiple "R" and "C" assignments are common for cross-functional work.
Policy Hierarchy
PQC governance requires a layered policy framework. Each layer provides increasing specificity, from enterprise-wide principles to team-level procedures.
High-level principles: approved algorithms, prohibited algorithms, exception process, compliance obligations.
Approved by CISO / Board
Key lifecycle rules: generation, storage, rotation, destruction. HSM requirements. PQC key sizes and parameters.
Approved by CISO / CTO
What cryptographic capabilities vendors must demonstrate. PQC readiness criteria for procurement.
Approved by Procurement / CISO
Deadlines for each migration phase, system prioritization criteria, hybrid deployment requirements.
Approved by CTO / CISO
The PQC Migration Charter
The charter is the founding authority document for the entire program. Without it, the Quantum Readiness Program Manager (QRPM) has no formal power to compel other business units, and budget requests get re-litigated at every phase gate. Framework 2.1 identifies insufficient mandate scope as the most common reason Phase 0 programs stall before Phase 1.
Who signs determines who the charter can compel. CISO-only approval is advisory. CEO + CFO + CISO creates financial obligation and the authority to compel cross-BU cooperation.
Weak: "CISO approved."
Strong: "Signed by CEO, CFO, and CISO."
Named systems, subsidiaries, and geographies — plus explicit out-of-scope exclusions for this phase to prevent future disputes about what was covered.
Weak: "All production systems."
Strong: "All systems handling Confidential or Regulated data in [regions], including third-party-hosted services. Out of scope: systems scheduled for retirement before [date]."
What the QRPM can actually do without requiring a separate approval each time. Advisory language means every enforcement action stalls waiting for sign-off.
Weak: "The QRPM should work with teams to ensure timely migration."
Strong: "The QRPM may require remediation plans and, with CISO approval, delay product launches that introduce non-PQC-ready cryptographic dependencies."
A named, ring-fenced program budget in the operating plan. Project-by-project approval forces re-justification at every phase gate and creates the risk of mid-program defunding.
Weak: "Funding will be allocated as needed."
Strong: "Program budget of [$X] committed for [period], line item: PQC Migration Program, in the [Year] operating plan."
At minimum, the Gate G1 review date and the overall program completion horizon tied to the binding regulatory deadline.
Weak: "Migration will proceed as resources allow."
Strong: "Gate G1 review: [date]. Program completion target: [year], aligned to [regulatory deadline]."
Framework 2.1 common failure: organizations reach Gate G1 with a signed email thread instead of a formal charter. The SteerCo has no documented authority, budget re-approval is required at each phase, and the first procurement dispute stalls the program for months.
Governance Models
A single crypto governance team sets all policies, selects algorithms, and manages migration. Best for smaller organizations or those with a strong central security function.
Cons: May not account for BU-specific needs
Each business unit or region manages its own PQC transition within guardrails. Governance board sets boundaries but delegates execution. Common in regulated multi-nationals.
Cons: Risk of inconsistency, slower alignment
Central team owns algorithm policy and compliance mapping. Business units own migration execution and testing. Most common model for large enterprises migrating to .
Cons: Requires clear decision-rights mapping
Roles, Workstreams & Lines of Defense
CISO or CIO — visible owner, clears roadblocks, briefs the board quarterly. Reports to the Board / Risk Committee.
Cross-functional: Security, Enterprise Architecture, AppDev, Infra/NetSec, PKI/Identity, Compliance/Legal, Procurement, and Business-Unit reps. Reports monthly to the Sponsor.
Day-to-day leader — runs the plan, risk log, and KPIs. Reports weekly to the SteerCo lead.
One per domain — execute the phase activities and report weekly to the QRPM.
Decision cadence: weekly PMO · monthly SteerCo · quarterly Board / Risk Committee. We recommend the CISO leads in most organizations — PQC migration is a security risk response, not a technology refresh. (OMB M-26-15 sets the structure for US federal agencies only.)
Owns and executes — workstream leads and system owners running the migration.
Governs — CISO, risk, and compliance functions. The QRPM sits here, setting policy and the risk-appetite framing.
Assures — internal audit provides independent assurance over the program.
The critical SOC/GRC handoff is the cryptographic inventory — a shared, machine-readable, SIEM-integrated asset that both the SOC (threat detection) and GRC (evidence, KRIs) depend on.
Escalation & Conflict Resolution
PQC migration inevitably creates conflicts: business units resist migration timelines, vendors miss readiness deadlines, and teams disagree on algorithm choices. A defined escalation path prevents these conflicts from stalling the program.
Technical disagreements resolved by the Crypto Engineering Lead (e.g., algorithm selection, test environment blockers, minor schedule slippage under 2 weeks). Timeframe: 5 business days.
Template triggers: cross-team dependencies, vendor delivery misses, budget variance over 10%, or policy exception requests escalated to the PQC Program Manager. Timeframe: 10 business days.
Regulatory deadlines at risk, critical production migration blockers, vendor non-compliance, or risk acceptance requests for high-severity gaps escalated to the Chief Information Security Officer. Timeframe: 15 business days.
Program-wide compliance misses, board-level risk exposure, or regulatory enforcement action escalated to the Executive Steering Committee (CTO / CRO / CFO) — the terminal tier, with no further escalation path. Timeframe: 30 business days.
Measuring Progress: KPIs
Governance without measurement is aspirational. The governance layer tracks KPIs that reflect how well the program is governed — policy health, accountability, and organizational readiness. For operational migration progress KPIs (systems migrated %, budget utilization, phase completion dates), see Migration Program Management.
- • Policy coverage rate (% of systems under documented PQC policy)
- • Active exception count (# of open policy exceptions)
- • Board reporting cadence (on schedule: yes / no)
- • Training completion rate
- • Vendor PQC readiness score (weighted across supply chain)
- • Compliance gap closure rate
- • % of vendors with signed PQC migration commitments
Board Oversight & Risk Appetite
60–90 minutes, once, during Phase 0 — establish the mandate and the risk framing.
15–20 minutes — the five board KPIs: Coverage, Trust, Inventory, Vendors, Agility.
Re-confirm tolerances as the threat horizon and standards evolve.
Material CRQC-timeline change, program >6 months behind the regulatory buffer, a confirmed vulnerability in a deployed PQC algorithm, or a Tier-1 vendor abandoning PQC without an alternative.
Illustrative figures — calibrate to your sector, jurisdiction, and confidentiality horizons. The GRC function owns the risk-appetite statement and the KRI framework.
Related Resources
Build a RACI matrix, generate PQC policies, and design a governance KPI dashboard.
Related modules
Check your understanding
10 questions on PQC Governance & Policy, each with its answer and the reason.
Take the quizNext step
Produce the artifact: RACI BuilderThis module belongs to phase 0 (Executive Mandate); RACI Builder produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.