BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-028c6b17-e8d4-4737-bb3d-2fdf73bc48c5@ics.pkic.org
SEQUENCE:0
DTSTAMP:20261023T000842Z
DTSTART:20261201T094500Z
DTEND:20261201T101000Z
STATUS:CONFIRMED
SUMMARY:From Inventory to Action: A Risk-Based Scoring Model for Prioritizi
 ng PQC Migration at Enterprise Scale
DESCRIPTION:Many enterprises have now begun cryptographic discovery and bui
 lt Cryptographic Bills of Materials (CBOMs)\, only to find themselves facin
 g a new problem: a list of tens of thousands\, sometimes millions\, of cryp
 tographic artifacts with no clear way to decide what to remediate first. In
 ventory answers "what do we have?" but it doesn't answer "where do we start
 ?"\nThis session presents a practical\, risk-based scoring model for priori
 tizing post-quantum migration at enterprise scale\, developed and applied i
 n a large organizational environment. Rather than treating all inventoried 
 artifacts as equally urgent\, the model scores each one against a set of fa
 ctors: exposure (internet-facing vs. internal-only)\, data sensitivity clas
 sification (e.g.\, PCI\, PII\, PHI)\, the harvest-now-decrypt-later (HNDL) 
 risk window based on data longevity relative to projected quantum timelines
 \, the availability of a non-invasive remediation path\, business criticali
 ty\, and environmental readiness (including whether the underlying platform
  even supports the protocols required for migration\, since gaps here can m
 ean a hardware refresh rather than a configuration change).\nAttendees will
  see how these factors combine into a composite priority score\, walk throu
 gh worked examples showing how superficially similar systems can land in ve
 ry different priority tiers\, and examine the model's limits\, which will i
 nclude a deliberate\, defensible "cost exceeds risk\, do not migrate yet" d
 ecision point and how to document that decision for auditors and leadership
  rather than treating it as an oversight.\nThe session will also cover the 
 organizational friction this approach surfaces in practice: who owns the sc
 oring process\, how it integrates with existing GRC and risk functions\, an
 d what changes as quantum timelines and remediation costs shift over time.\
 nAttendees will leave with an adaptable scoring rubric\, a set of questions
  to apply to their own CBOM data\, and a framework for prioritizing migrati
 on work that can be defended to stakeholders\, not just executed against a 
 spreadsheet.\n\nSpeakers: Elizabeth Wood
LOCATION:Red hall
CATEGORIES:Red hall
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR