An example roadmap for organizational leadership.

Five phases — Awareness, Inventory, Architecture, Migration, Maturity — with what the board does and what management delivers at each stage.

Five Phases for the C-Suite and Board

Phase	What the Board Does	What Management Delivers
1. Awareness 0–6 months	Commission a briefing. Assign committee ownership. Adopt a board resolution establishing a regular cadence for oversight.	Threat briefing. Preliminary gap analysis. Identification of internal leads and external advisors (counsel, cryptographic, audit).
2. Inventory 6–12 months	Review the cryptographic bill of materials. Review data-classification schema. Confirm vendor-risk program is integrated.	A complete inventory of where cryptography lives in the enterprise. Data assets ranked by how long they must remain confidential. A map of third-party dependencies.
3. Architecture 12–24 months	Approve crypto-agility standards. Approve the migration budget. Review the standard procurement clauses.	Crypto-agile architecture adopted as standard. Migration of the highest-risk systems begins. Vendor contracts amended on renewal.
4. Migration 24–60 months	Quarterly review of migration progress. Disclosure-committee coordination. M&A due-diligence integration.	Progressive replacement of today's cryptography with the NIST post-quantum standards. Hybrid (classical + post-quantum) deployments where prudent.
5. Maturity 60+ months	Annual cryptographic-posture review. Continuous alignment with disclosure obligations.	Operational post-quantum posture. Readiness to rotate algorithms if any is later weakened. Ongoing monitoring of cryptanalytic developments.

Table 2 · A representative phased program. The cadence will vary by organization.

Executive leadership and boards that have visibility into each of these phases, with meeting minutes that reflect the visibility, are substantially insulated from oversight liability. A board without a record is exposed regardless of how hard management has been working behind the scenes.