Back in September 2025, I wrote a blog post about who owns PQC in an organisation. Over a year later, it seems like most organistions still haven’t decided who that is!
The supplier ecosystem around PQC has largely agreed that this isn’t an issue to be owned and driven by the CISO. That might sound counter-intuitive, but it’s the wrong kind of activity.
CISOs are measured on risk, patching, KPIs/monitor, and response. They report, get the organisation through the audit, then repeat next month/quarter. They are not the vehicle for delivering pan-organisational tech refresh/change. They are an important stakeholder, ally, and so on, but they aren’t the owner.
The SOC isn’t the place to drive it from either. For obvious reasons.
A senior company officer needs to own the risk.
An experienced IT transformation leader needs to own the programme of governance, discovery, implementation, remediation and reporting.
In a large corporate, it could be multiple people. The CRO/CFO for ownership, the CTO/Chief Architect for approach, and a heavy hitter (and team) in IT transformation/CIO to deliver it.
And even those large corporates need help. In another recent blog post, I recommend the starting point and approach. To help make that successful, you might need someone to help and guide – the Quantum steward that I reference in the first article.