The Board Factor: What Makes PQC Programs Succeed or Stall

Cryptographic resilience requires multi-year enterprise transformation, not a technical remediation exercise. Yet many organizations still treat it as one. That is a mistake.

Digital trust depends on a cryptographic estate that is everywhere, used by everyone, yet owned by no one. Its closest organizational parallel is not in technology. It’s data. And that parallel is not reassuring. Data management and governance programs are decades old and rife with failure. Meanwhile, PQC has a hard three- to eight-year deadline.

Like early data initiatives, PQC programs meet nearly every condition for failure: a long-time horizon, lack of business ownership, deep technical complexity, unmapped dependencies, low enterprise literacy, and budget cycles that reward near-term value over invisible risk reduction. Compounding these challenges, uncertain impact timelines mean that those responsible for acting on PQC today may be the ones to suffer tomorrow’s consequences, weakening urgency, ownership, and escalation.

Enterprise transformation is ultimately a complex systems problem. Ashby’s Law of Requisite Variety is clear: the system will defeat any controller that lacks the capacity to manage its complexity. That controller is your PQC program.

Drawing on systems theory, modern data governance principles, and more than 30 years of experience leading complex enterprise transformations, this session demonstrates why inventories, standards, and vendor readiness are necessary but insufficient, and why early board engagement is a determining factor in PQC program success. Participants will leave with a concrete, practice-tested framework for establishing cryptographic governance and securing sustained board engagement.