The quantum countdown.
Why Governance Leaders Need to Start Preparing Now. Somewhere in a data centre right now, a file is being copied. It might be a customer database, a set of merger documents, a batch of health records, or the encrypted backbone of a piece of national infrastructure. Nobody breaks in. Nobody sets off an alarm. The file simply leaves, encrypted, indistinguishable from a routine backup. The people who took it can’t read it. Not yet. They don’t need to. They just need time. This is “harvest now, decrypt later”: an attack strategy in which adversaries collect encrypted data today with the expectation that future advances in computing, including cryptographically relevant quantum computers, may eventually make it readable.
Security agencies are already warning organisations to account for this risk, particularly where highly sensitive data needs to remain confidential for years or decades. The encryption protecting that data today, including RSA and elliptic curve cryptography, the public key algorithms underpinning everything from secure websites to corporate VPNs, is not broken. But it is on a countdown. A sufficiently powerful quantum computer could eventually render much of today’s asymmetric cryptography ineffective. The disagreement is less about whether cryptographically relevant quantum computing warrants preparation than about when that capability will arrive.
Here’s the part that should unsettle a boardroom more than a server room: the data being harvested today doesn’t need the quantum computer to exist tomorrow. It just needs to still matter when the computer finally arrives. A trade secret with a fifteen-year shelf life. A patient’s genetic data. A defence contract. A negotiated settlement under seal. If an organisation holds anything that needs to stay confidential for years, the “later” in harvest now, decrypt later isn’t a distant, abstract risk. The exposure begins now.
If some of this sounds familiar, it should. Harvest now, decrypt later has become a recurring warning in cybersecurity discussions, and for good reason. What has had far less attention is what happens once quantum readiness stops being treated as a security team briefing and is recognised for what it also is: a governance question, with clear implications for risk oversight, accountability, procurement and regulatory compliance. It can also sit naturally within the Governance pillar of ESG. And in Australia, that governance question now comes with a particularly concrete regulatory timetable.
That is the version of the quantum readiness conversation worth having properly, and it is the one this piece is making.
Why “Later” is actually “Now”
The transition away from today’s encryption isn’t a single event that happens when the quantum computers arrive. It is a migration, slow, complex and already underway, that must be substantially finished before that day, not started on it. In August 2024, the United States National Institute of Standards and Technology (NIST), whose cryptographic standards influence digital security worldwide, finalised the first three post-quantum cryptography (PQC) standards after an eight-year global evaluation process.
The standards cover key establishment and digital signatures. NIST encouraged organisations to begin transitioning immediately because full integration will take time. Those standards exist now, and industry bodies are already incorporating them into protocols and commercial technologies. Two terms are worth defining plainly.
Post-quantum cryptography refers to cryptographic methods designed to resist attacks from quantum computers while still running on the classical computers organisations already use. Crypto-agility is an organisation’s ability to replace or update cryptographic algorithms without having to rebuild every system that depends on them. That matters because cryptography is often embedded deep inside applications, infrastructure and third-party products, making migration much harder when organisations do not have a clear view of where it is being used.
The people building quantum computers are not waiting for certainty either. In March 2026, Google published a blog post titled Quantum frontiers may be closer than they appear and set a 2029 target for its own PQC migration. Google said the timeline reflects progress in quantum hardware, error correction and estimates of the resources required for quantum factoring. The target lands one year ahead of the Australian Signals Directorate’s (ASD) recommended 2030 completion date for Australia’s post-quantum transition.
ASD has also made clear that organisations should not wait until then to begin. Its current roadmap calls for a refined transition plan by the end of 2026, migration underway by the end of 2028 and completion by the end of 2030. The point is not that Google knows exactly when cryptographically relevant quantum computing will arrive. Nobody does. The point is that one of the organisations closest to both quantum computing and global digital infrastructure has decided the uncertainty is not a reason to wait. Quantum readiness is a governance problem, and here’s why that’s not a stretch. Quantum readiness is often discussed as a CISO or CTO problem: something technical, owned by security and technology teams and escalated when it becomes urgent. But a transition that spans years, affects critical systems and third-party dependencies, requires sustained investment and carries regulatory implications cannot sit entirely within the technical function. It belongs within enterprise governance, and can also sit naturally within the Governance pillar of ESG frameworks.
This is a timeline risk, not a technique risk. Unlike many cyber risks that demand an immediate defensive response, this one is about whether a multi-year technical migration can be completed 2 before an external event changes the security assumptions on which existing systems depend. That is exactly the kind of long-horizon risk boards are supposed to be tracking, not something a better firewall solves. It is also, increasingly, a legal one. Australian courts have already made clear that cybersecurity can form part of an organisation’s statutory obligations.
In RI Advice in 2022, the Federal Court found that the licensee had failed to maintain adequate cybersecurity measures. Four years later, FIIG Securities was ordered to pay $2.5 million after admitting prolonged deficiencies in its cyber controls, resourcing and oversight. There is also a broader directors’ duties dimension. Australian commentary on what is often called “stepping stone” liability has examined circumstances in which a company’s breach of its legal obligations can contribute to a finding that directors failed to exercise reasonable care and diligence under section 180 of the Corporations Act. That does not mean that a failure to prepare for PQC automatically creates personal director liability. But it does reinforce a broader point: once a technology risk is known, material and supported by clear regulatory expectations, leaving it unmanaged becomes harder to justify.
Fortunately, the response does not require an entirely new model. In earlier work on quantum computing and ESG, I approached the Governance pillar through three connected areas: transparency and data-driven decision-making, data security and regulatory compliance, and risk management.
Those same areas provide a practical way to examine quantum readiness today. The technology may be new. The governance questions are not.
Transparency and data-driven decision-making.
Governance depends on trustworthy evidence.
Whether the claim concerns emissions, ethical investment screens or supply-chain performance, organisations increasingly need to demonstrate not only what they have disclosed, but how the underlying data, methodology and controls support that disclosure. That gap between claim and evidence is already attracting regulatory attention in Australia. The Australian Securities and Investments Commission (ASIC) has pursued a series of major greenwashing cases, including penalties of $12.9 million against Vanguard, $11.3 million against Mercer Superannuation, $10.5 million against Active Super and, most recently, $7.3 million against Fiducian Investment Management Services. Across those matters, ASIC has focused on issues including misleading sustainability claims, investment practices that did not align with stated ESG screens, insufficient disclosure and governance weaknesses behind sustainability labelled products.
The lesson extends beyond greenwashing. Good governance requires organisations to be able to trace a claim back to the information, controls and decision-making that support it. As emerging technologies create new ways to generate, process and rely on data, that ability to explain where information came from, how it was validated and who was accountable for its use becomes more important, not less. Quantum governance is still developing in this area.
The World Economic Forum’s Quantum Computing Governance Principles, published in 2022, were among the earliest major multistakeholder attempts to establish principles for responsible quantum development and 3 adoptions. Their focus is broad, spanning issues such as accountability, cybersecurity, privacy, standardisation and sustainability rather than data transparency alone. The Organisation for Economic Co-operation and Development’s (OECD) A Quantum Technologies Policy Primer has since expanded the policy discussion through work on anticipatory governance, responsible development and the wider economic and societal implications of quantum technologies. What is still missing is a mature governance framework for how quantum-enabled capabilities should interact with organisational data, evidence and disclosure processes.
That gap matters. Organisations adopting these technologies early will not only need to ask what they can do with new analytical capabilities, but whether the data, assumptions and decisions behind those capabilities can withstand the same scrutiny increasingly being applied to ESG claims today.
Data security and regulatory compliance.
This is where the countdown gets a specific, published clock. And in Australia, that clock is moving quickly. ASD, through the Australian Cyber Security Centre (ACSC), has set out three concrete milestones for post-quantum migration: organisations should have a refined, organisation-specific transition plan by the end of 2026; should have commenced migration by the end of 2028, beginning with critical systems and data with long-lived confidentiality requirements; and should have completed the transition by the end of 2030.
At that point, ASD recommends ceasing the use of traditional asymmetric cryptographic algorithms including RSA, Diffie-Hellman, ECDH and ECDSA. That makes the first meaningful checkpoint months away, not years. Those expectations are already shaping procurement, system design and transition planning. ASD’s Information Security Manual includes a dedicated post-quantum transition control requiring organisations to develop, implement and maintain a PQC transition plan. Another control, ISM 1917, requires the development and procurement of new cryptographic equipment, applications and libraries to support ASD-approved post-quantum algorithms, alongside stronger hashing and symmetric cryptography, by no later than 2030. The practical implication is straightforward: organisations making technology investments today need to consider whether those systems will still be cryptographically viable tomorrow.
For Australia’s financial sector, the governance expectation is becoming even more explicit. At the 2026 AFIA Risk Summit, the Australian Prudential Regulation Authority (APRA) said it wants regulated entities to be at least starting to map where cryptography is relied upon across their systems, data and third-party providers, including long-lived data and critical infrastructure. More significantly, APRA said it intends to increase supervisory engagement over the coming year and will be looking for evidence that boards understand the risk, recognise their obligation to act and are progressing against ASD’s recommended timeline. APRA has since reinforced that position in its 2026–27 Corporate Plan, stating that it will increase its focus on quantum computing risks and expects regulated entities to make timely progress in implementing post-quantum transition plans aligned with ASD’s recommended milestones, prioritising their most critical information assets and operations.
That matters because it moves quantum readiness beyond technical best practice. For APRA regulated entities at least, the question is increasingly not simply whether the security team knows 4 about the quantum threat, but whether the organisation can demonstrate governance around it: visibility of cryptographic dependencies, board awareness, assigned responsibility and a credible transition plan. Australia is not moving alone. In June 2026, the United States issued an executive order accelerating the federal transition to NIST-approved PQC, including migration requirements for high-value assets and new procurement expectations extending toward 2030 and 2031.
The United Kingdom’s National Cyber Security Centre has published its own phased roadmap: discovery and initial migration planning by 2028, migration of the highest-priority services by 2031 and completion across systems, services and products by 2035. The direction internationally is therefore remarkably consistent even where the dates differ: discover where cryptography is embedded, identify what matters most, understand supplier dependencies and begin the migration before quantum capability makes the decision urgent.
What distinguishes Australia’s position is the proximity of its first major milestone. Organisations are being asked to move from general awareness to a refined transition plan by the end of 2026. And the industry-wide data suggests that knowing the deadline and being ready for it are two very different things. A 2026 global study by the Ponemon Institute, sponsored by Entrust, found that 68% of IT and security practitioners described managing their cryptographic assets as extremely or very difficult, highlighting the operational challenges organisations still face as they prepare for PQC. The regulatory direction is becoming clearer. The harder question is whether organisations know enough about their own cryptographic environments to respond to it.
Risk management: Once quantum readiness is recognised as a governance issue rather than a purely technical one, the mechanics of managing it are familiar: identify the exposure, prioritise by impact, sequence remediation and monitor progress.
The inventory step has a name: a Cryptographic Bill of Materials, or CBOM. It is a structured and maintained record of the cryptographic dependencies across an organisation’s systems, including algorithms, protocols, libraries, parameters, configurations and third-party components. ASD explicitly points to a CBOM, or equivalent artefact, as a way to build visibility over those dependencies. For many organisations, that visibility is itself the first problem to solve. Before asking “how exposed are we?”, the more basic question may be “do we actually know where cryptography is being used?” ASD has also made the board-level questions unusually clear. Its Cyber security priorities for boards of directors 2025–26 guidance asks boards to consider the long-term impact of quantum computing, assess the potential impact of quantum threats on systems and data, establish a post quantum transition plan and assign executive and senior management responsibility for that transition.
Those are not specialist cryptography questions. They are questions about visibility, ownership, prioritisation and oversight. Vendor risk deserves its own line item because few organisations control every cryptographic dependency themselves. In July 2026, ASD released Post-quantum questions to ask your vendors, a vendor-neutral framework covering cryptographic dependencies, risk assessment, transition planning, implementation and ongoing communication with suppliers. ASD specifically recommends using these questions across procurement, contract renewal and vendor assurance activities. Building those questions into supplier conversations now is one of the most immediately actionable steps available to a risk function. It also exposes a wider truth about the transition: an organisation can have a strong internal roadmap and still be constrained by a vendor whose products are not ready.
The questions leaders should be asking now.
Pulled together, five questions do most of the work of finding out where an organisation stands:
- What’s our exposure? Start the cryptographic inventory. If the organisation does not yet have a clear view of where cryptography is used, that is the honest starting point.
- What data has the longest shelf life? Prioritise by sensitivity and longevity, including intellectual property, health and personal data, and long-term contracts, rather than trying to migrate everything at once.
- Where do we sit against ASD’s clock? A refined transition plan is recommended by the end of 2026. For most organisations, that is not far away. 4. Who owns this, formally? Not simply which team is aware of it, but who has the authority, resources, and reporting line to leadership to drive the transition.
- What are our vendors doing? Use ASD’s vendor question framework as a starting point and build those conversations into procurement, assurance and contract renewal processes.
The ESG thread.
Treating post-quantum readiness through an ESG governance lens is still an unusual move. Much of the discussion around quantum and ESG tends to focus either on the technology’s potential sustainability applications or on quantum security as a standalone cyber risk. But the Governance connection is increasingly difficult to ignore. An organisation that can demonstrate a current cryptographic inventory, a transition roadmap aligned with ASD’s milestones, clear ownership and evidence of board oversight is doing more than preparing for a technical migration. It is building evidence of how a long-term technology risk is being identified, governed and acted upon.
That matters because the broader direction of Australian regulation is already clear: claims, controls and governance arrangements increasingly need to be supported by evidence rather than intent alone. Quantum readiness deserves a place in that same conversation.
Prepare before urgency forces the issue.
Most risks that reach a board’s agenda arrive as events: a breach, an outage, a lawsuit. This one is arriving as a countdown, with standards already published and, in Australia, the first major transition milestone only months away. Quantum computing’s reckoning for most organisations is unlikely to arrive as a single dramatic technical event. It may arrive instead as a quiet audit question, a due diligence request, a procurement decision or a regulator’s inquiry.
By then, the honest answer will either be “we started years ago”, or it won’t be. Further reading • ASD, planning for post-quantum cryptography: the milestone timeline referenced throughout this piece. • ASD, Cyber security priorities for boards of directors 2025–26. • Ponemon Institute / Entrust, 2026 Global State of Post-Quantum and Cryptographic Security Trends. • Suzart, P. S. and Porto, A. T., “ESG e computação quântica,” Section 4: “Tecnologias Quânticas e Corporate Governance,” in Integrando o ESG às práticas das empresas: do discurso à transformação. Via Ética, 2025. ISBN 978-85-85272-07-4.
Bio:
Amanda Tolfo Porto is a Perth-based cybersecurity governance, risk and compliance professional with a background in law, privacy, information security and emerging technologies. She recently completed a Master of Information Technology specialising in Cybersecurity and co-authored a published book chapter on ESG and quantum computing. Her work focuses on responsible technology adoption and the intersection of regulation, business risk and innovation.
You may contact the Author at:
https://www.linkedin.com/in/amanda-tolfo-porto/