Purpose of the Template
Post-quantum cryptography (PQC) is now a regulatory requirement for federal agencies and their contractors. Executive Order 14412 mandates that high-value assets and high-impact systems use PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. NIST guidance warns that these deadlines "leave little margin."
For your board or audit committee, the focus isn't on selecting algorithms but on ensuring management has a risk-based plan, clear ownership, and evidence of progress. This template offers a one-page oversight charter to adapt and adopt at your next committee meeting. It transforms a technical migration into a governed compliance program with measurable checkpoints.
Prerequisites
Before adopting the charter, ensure these elements are in place or have a designated owner and due date:
- Cryptographic inventory or a funded plan to create one. You can't prioritize what you haven't identified. This includes third-party and supply chain components, as NIST advises agencies to consider the entire cryptographic supply chain.
- A designated executive owner, typically the CISO, with a business counterpart for application owners.
- An entry in your Cybersecurity Risk Register for quantum-enabled cryptographic failure, including "harvest now, decrypt later" exposure.
- A reference to the NIST post-quantum standards published in 2024, including FIPS 203 for key establishment, as the technical baseline.
- A reporting channel into your GRC Dashboard so progress is visible without special requests.
The Template
Copy the text below into your committee charter or board resolution. Complete the bracketed items as needed.
PQC TRANSITION OVERSIGHT CHARTER
1. Purpose. The Committee oversees management's transition of [Organization]'s cryptographic systems to post-quantum cryptography in line with [Executive Order 14412 / contractual flow-down / internal Cyber Risk Appetite], aiming to protect sensitive personal data and long-lived confidential data against future quantum-enabled decryption.
2. Regulatory Obligations in Scope. Management will maintain, in the Obligations Library, each applicable obligation, including: PQC key establishment for in-scope high-value assets and high-impact systems by December 31, 2030; PQC digital signatures by December 31, 2031; and [customer, contractual, or international mandates].
3. Accountability. [Role] is the accountable executive. [Role] owns the cryptographic inventory. [Role] manages supplier and supply chain engagement. The Chief Audit Executive will provide independent assurance over the program.
4. Prioritization Standard. Management will rank systems using a documented Risk Prioritization Matrix with, at minimum, these factors: (a) data sensitivity; (b) required confidentiality lifespan; (c) exposure to "harvest now, decrypt later" collection; (d) system criticality; (e) dependency on third-party cryptography. Systems with long-lived sensitive data are prioritized for PQC key establishment.
5. Hybrid Encryption Position. For particularly sensitive systems, management will evaluate hybrid encryption (conventional plus PQC). Any decision to adopt or decline hybrid mode will be recorded with its rationale, including the added computational cost, and approved by [Role].
6. Conventional Algorithm Sunset. Management will maintain a schedule showing when each conventional algorithm in use becomes disallowed or allowed only at the user's own risk. Any system retaining conventional cryptography past its permitted date requires an Approved Exception with an expiry date, compensating controls, and Committee visibility.
7. Reporting. Management will report [quarterly] to the Committee on the Key Control Indicators in Section 8, open Approved Exceptions, supplier readiness, and changes to external deadlines.
8. Key Control Indicators. (a) Percentage of in-scope assets inventoried; (b) percentage of prioritized systems with a funded migration plan; (c) number of Approved Exceptions and days to expiry; (d) percentage of critical suppliers with a documented PQC roadmap; (e) milestones missed against plan.
9. Escalation. Any forecast that a regulatory deadline will be missed is escalated to the Committee Chair within [number] business days.
10. Review. This charter is reviewed [annually] and upon material change in guidance or threat assessment.
Customizing the Template
Section 2. If you're not a federal agency, replace the Executive Order reference with the obligation that binds you, such as a federal supplier contract clause or a customer requirement. Governments including Canada, Australia, Japan, and the UK have set milestones between 2028 and 2030, so multinational organizations should log each jurisdiction separately in the Regulatory Inventory.
Section 4. Heavily weight the confidentiality-lifespan factor. Data that must remain secret for many years is at risk today, even though a cryptographically relevant quantum computer doesn't yet exist. Some large technology firms have set 2029 targets for full migration, and warnings that such machines could arrive sooner than expected mean your timeline shouldn't assume the outer deadline is the working one.
Section 5. Hybrid mode adds protection but demands more computing resources. Tie the decision to measured performance impact on the specific system, not a blanket policy.
Section 6. Keep Approved Exceptions rare, time-bound, and tied to a named risk owner. An exception without an expiry date is a deferred finding.
Section 8. Choose indicators your team can produce from existing tools. If your GRC Platform can't yet report them, note that gap as a Control Design action item.
Validation Steps
Once adopted, test the charter rather than assuming it works:
- Trace one asset end to end. Pick a high-value asset and confirm it appears in the inventory, carries a priority rating, has an owner, and maps to a migration milestone.
- Check supplier coverage. Request the roadmap of your three most critical cryptographic suppliers. Silence is itself a finding.
- Reconcile the exception log. Every system running past its permitted conventional-algorithm date should have a current Approved Exception.
- Have the Chief Audit Executive scope assurance. Include the charter in Risk-Based Audit Planning, with Audit Fieldwork covering inventory completeness and prioritization logic.
- Run a deadline stress test. Ask management to show the plan if the working deadline moved forward by a year. The answer reveals how much slack, if any, the program carries.
Revisit these checks at each reporting cycle. A charter that is adopted but never tested gives the board comfort without assurance.
