How do I explain this to my board?
Walk in with 1 dated obligation, 2 defensible numbers, and a small reversible request. Walk out with a funded inventory, a named owner, and a date to come back.
Briefings on this subject fail in 2 predictable directions. Presented as a catastrophe, the room files you under alarmist and moves on. Hedged in every sentence, it gets deferred another budget cycle. The version that works sounds like a compliance obligation with a date on it, because that’s what it actually is.
The short version:
- Boards fund a dated requirement plus records at risk, rather than a prediction about when quantum computers arrive.
- Two numbers belong on the slide: how many sensitive records sit under the old encryption, and the earliest date that binds you.
- Open on the pattern, close on the request. Lead with data being copied now and read later, never with the mathematics.
- The request is small and reversible: fund a scoped inventory, name an owner, set a return date.
- A dollar figure you can’t defend is worse than no figure, because 1 shaky assumption discredits the rest.
- A historical precedent settles the “is this real” question faster than any technical explanation.
What order do we tell it in?
The sequence is most of the persuasion. In this order each step earns the right to the next.
- Start with what’s happening now. Somebody records encrypted data today and reads it once a capable machine exists, so any record that has to stay confidential for a decade is exposed as of right now. A non-technical director understands that in 1 sentence, and it converts a future problem into a present decision.
- Name 1 dated obligation. Immediately ground it in a requirement with a date and your organization’s name attached. One real deadline beats a list of 9, because a list reads as a survey and a single date reads as a schedule. See What do regulators expect.
- State the records at risk. How many sensitive records sit under encryption that’s scheduled for retirement, and which systems fail hardest if their trust is forged. This gives the deadline a scale without a fabricated dollar figure.
- Make the request. Fund a time-boxed inventory and a quantification pass, and name an accountable executive. You’re asking them to fund a diagnosis rather than authorize a rebuild.
- Set the return date. A specific meeting to come back with the costed program. This converts a one-time scare into a governed program the board oversees, which is the posture directors want on record.
The arc is deliberately front-loaded on story and back-loaded on the request. By the time you ask for money, the room has already agreed the risk is real, dated, and countable.
What do we leave off the slide?
More briefings die on what’s included than on what’s missing. Each line below reads as authority in a technical review and as overreach in a boardroom.
| Leave this off | Why it backfires | Say this instead |
|---|---|---|
| A hard date for when quantum computers arrive | Invites the room to argue the date rather than fund the work, and 1 skeptic with a news article sinks you | The dated obligation you have to meet regardless of when the machine shows up |
| ”Everything is broken today” | It’s false, and a director who knows it discounts everything else you said | Systems are working normally, and the clock on long-lived records is already running |
| An opening built on the mathematics | You lose a non-technical room in 2 minutes, and depth reads as insecurity rather than command | The copying-now-reading-later pattern, told as a historical precedent |
| Nine different regulations | Dilutes urgency into a compliance survey where no single date feels binding | The 1 instrument that names you, with its earliest gate as a hard date |
| A precise cost you can’t yet defend | A CFO probes the assumptions, and 1 shaky input discredits the whole case | Records at risk plus the deadline, with the costed model named as the funded next step |
The through-line is that your authority comes from a dated obligation and a countable exposure. Sober and dated wins the budget.
What number actually lands?
Records at risk, paired with the deadline date. A board weighs a countable exposure against a legal clock far more readily than a speculative loss estimate, because both of those survive questioning and a forecast doesn’t.
Two things make it land:
- Count rather than estimate. “Roughly this many sensitive records sit under encryption scheduled for retirement” is sourced to your own inventory. A dollar loss estimate invites a fight over every assumption behind it.
- Rank by consequence rather than by technology. Say which systems move first by how far a failure spreads, so the board hears risk management rather than a technical shopping list.
The full dollar model is a specialized exercise. Naming it as the output of the funded inventory is a stronger position than inventing a figure to fill the silence. See What does this cost.
How do we answer “quantum is a decade away”?
You’ll hear it, and it rests on an assumption worth naming: that the risk starts when the machine is announced. Two responses, in this order.
The timing arithmetic. Say it close to verbatim: “We aren’t betting on when the computer arrives. We’re betting on how long our data has to stay confidential plus how long our migration takes, and for our regulated records that math is already underwater.” This is also the anti-alarmist position, because it says plainly that some systems are urgent and others can wait, and urgency depends on data lifetime.
The collection clock. A genuine decade of runway on the machine buys no time on confidentiality, because the copying is happening now. Anything recorded today is read later.
That answer concedes the director’s point and shows why it doesn’t change the decision. You don’t win by out-predicting the room on quantum timelines. You win by moving the decision off the machine’s calendar and onto your data’s.
Has this pattern ever actually happened?
Once, at national scale, and it’s the sharpest thing you can put in front of a skeptic.
Starting in 1943, American codebreakers intercepted and stored Soviet diplomatic and intelligence cables. The traffic was protected with one-time pads, which are mathematically unbreakable when used correctly, so at the moment of collection the messages were genuinely unreadable and the Soviets treated them as permanently safe. Under wartime pressure their pad makers duplicated pages, and a one-time pad reused even once stops being unbreakable. From around 1946, the team on what became the Venona project exploited that reuse and began reading the backlog. The work ran for decades and the project didn’t formally close until 1980. Decrypts of 1940s traffic went on exposing agents years after the cables were sent.
Source: NSA, “Venona” historical release, nsa.gov.
Everyone whose name sat in that 1943 traffic assumed the moment of exposure had passed. The only thing that changes for this transition is the weakness being exploited: a quantum computer solving the mathematics rather than a pad-reuse mistake.
The point a director feels is that the people who needed to protect that traffic had to act years before the decryption they were guarding against ever happened.
What exactly are we asking them to approve?
Four things, and the shape is why it gets approved.
- Budget for a scoped inventory. Time-boxed, aimed at your most sensitive systems rather than the whole estate. It answers 1 question: where does the old encryption live, and on what data.
- Budget for a quantification pass. The step that turns the inventory into the cost figure the board will ask for at the return meeting.
- A named accountable owner. One executive senior enough to move budget across teams, with this written into their objectives.
- A return date. A specific board meeting to come back with the costed program and a prioritized sequence.
Frame the reversibility out loud, because it’s what unlocks the approval: this funds a diagnosis, it commits the organization to nothing except knowing where it stands, and the full number comes back on the date you set.
Here’s the memo skeleton, and it fits on 1 page.
SUBJECT: Encryption scheduled for retirement, funding a scoped inventory
RECOMMENDATION (one sentence, leads the page)
Approve a time-boxed cryptographic inventory and costing pass,
budget not to exceed [$X], with [executive] accountable,
returning to the board on [date] with the full program.
THE RISK
- Obligation: [the one dated requirement that binds us]
- Confidentiality: [N sensitive records under retiring encryption]
- Revenue: [customer requirements we inherit at renewal]
Add the exposure to the enterprise risk register.
OPTIONS
1. Defer: same work, nearer deadline, higher price
2. Fund the diagnosis: RECOMMENDED. Bounded, reversible, produces the numbers
3. Fund the program: premature, an unscoped migration can't be budgeted
WHY OPTION 2 IS SAFE
Time-boxed and reversible. We are funding a diagnosis rather than
committing to a multi-year rebuild.
BOARD ACTION
(1) approve budget not to exceed [$X]; (2) direct the risk-register entry;
(3) note [executive] as owner; (4) calendar [return date].
The recommendation leads because directors read the top of a page and skim the rest. Three options with the middle one recommended keep the decision with the board, and writing the do-nothing option out explicitly turns declining into a documented choice.
What will they push back with?
Rehearse these and the room never watches you improvise.
| The pushback | Your answer |
|---|---|
| ”Quantum is a decade away.” | We’re betting on our data’s confidentiality lifetime plus our migration time, rather than on the machine’s arrival. The copying is happening now. |
| ”Why now and not next cycle?” | The collection clock is running on data we can’t un-expose, our earliest gate is dated, and a compressed migration costs more than a phased one. |
| ”Can’t we wait for the standards?” | They’re finished. The first 3 were finalized on August 13, 2024. |
| ”What will it cost?” | We size it by funding a time-boxed inventory first, rather than signing a blank check. |
| ”Aren’t our vendors handling this?” | Mostly not, and we verify rather than assume. A roadmap is a promise; a contract term is an obligation. |
| ”Is the threat even real?” | Real enough that multiple governments have published dated deadlines against it, and the copy-then-decrypt pattern already ran at national scale. |
| ”What if we do nothing?” | Long-lived records copied today become readable later, we miss a dated obligation with our name on it, and we lose contracts whose buyers inherit the requirement. |
Source: NIST, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, nist.gov.
One mechanic underneath all 7: validate the question before answering it. A director who feels smart for asking becomes an ally evaluating your answer rather than an opponent defending their standing.
Questions people ask
How long should the briefing be? About 10 minutes of content and a 1-page leave-behind. A board reads a page and skims a deck.
What does a win in the room look like? Three concrete outcomes: approved budget for the inventory, a named accountable owner, and a scheduled return date. Steer toward those rather than toward general concern.
Do I need the full cost before I can ask for anything? No. Records at risk plus the deadline are enough to fund the inventory, and the inventory is what produces the cost.
Who should deliver this, the CISO or an executive? Whoever owns the budget conversation. A security leader presents the facts, and an executive sponsor asking for the money changes how the room hears the request.
What if our board asks why they’re hearing this now? Because the standards finished in August 2024, the deadlines are dated, and the migration is already live in consumer products. The only piece that hasn’t happened is the machine.
Should I bring the technical detail as backup? Yes, in an appendix nobody reads unless challenged. The first hard question about any number is answered from that evidence.
What if they say no? Ask what would need to be true for a yes, and put the do-nothing option in the minutes with its named consequences. A documented decline is materially different from an undocumented deferral.
Where to go next
- What should I ask my security team is how to gather the answers before you present.
- What of our company data is at risk produces the records-at-risk number.
- What do regulators expect produces the deadline.
- What does this cost covers the money conversation.
- For Business Leaders MOC is the full executive route.
Go deeper into the technical detail
The technical version, written for security leaders, is Brief Your Board and The Three Numbers.
These open the Post-Quantum Field Guide, a separate site written for security professionals.
Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.