A starting point for counsel.

A template for adaptation to the organization's governance documents and sector-specific requirements.

Resolution of the Board of Directors

WHEREAS, the security of the Corporation's information systems, customer data, intellectual property, and operational infrastructure depends materially upon the integrity of asymmetric cryptographic algorithms currently expected to be rendered ineffective by sufficiently capable quantum computing; and

WHEREAS, the National Institute of Standards and Technology has finalized post-quantum cryptographic standards (Federal Information Processing Standards 203, 204, and 205), and the Board recognizes that the orderly migration of the Corporation's cryptographic posture to those standards is a multi-year undertaking requiring coordinated planning; and

WHEREAS, the Board has considered the risk that adversaries may already be collecting encrypted data for later decryption when quantum capability emerges (“harvest now, decrypt later”); and

WHEREAS, the Board intends to discharge its fiduciary duties with respect to this risk through informed oversight, documented deliberation, and appropriate internal and external expertise;

NOW, THEREFORE, BE IT RESOLVED, that the [Risk Committee / Audit Committee / Technology Committee] of the Board is hereby designated to exercise ongoing oversight of the Corporation's post-quantum cryptographic transition;

RESOLVED FURTHER, that management shall deliver to the designated Committee, within 180 days of the date hereof, (i) a cryptographic bill of materials; (ii) an accounting of sensitive information with required confidentiality duration; (iii) a preliminary gap analysis against the NIST post-quantum cryptographic standards; and (iv) a proposed migration roadmap;

RESOLVED FURTHER, that the designated Committee shall report to the full Board on post-quantum readiness not less frequently than [quarterly / semi-annually], and that such reports shall be reflected in the minutes of the Board;

RESOLVED FURTHER, that the General Counsel shall coordinate with the designated Committee to ensure that the Corporation's public disclosures accurately reflect the material risks and responses associated with the post-quantum cryptographic transition;

RESOLVED FURTHER, that the officers of the Corporation are authorized and directed to take such actions as they may deem necessary or appropriate to carry out the purposes of these resolutions.

[ RESERVED FOR SIGNATURES ]