Chapter 9 of 14 · Months 3–6
Programs, Not Projects: PQC, AI and Identity
- What's the difference between a project and a program?
- Do I need to worry about quantum computing now?
- How do I get ahead of AI use I didn't approve?
- Why does everyone say identity is the new perimeter?
A project has an end date. A program is how the organisation keeps doing something well, year after year. Some of your biggest areas will never be finished, because the technology and the threats keep moving. Treat those as programs: a named owner, a direction, a regular check-in and a budget line that renews.
Post-quantum cryptography
Future quantum computers are expected to break some of the public-key encryption in wide use today. NIST has published post-quantum standards, and in October 2026 it finalised NIST IR 8547, which describes how it expects organisations to move from quantum-vulnerable algorithms to quantum-resistant ones. Read the current version yourself for the dates that apply to you.
You do not need to replace anything this month. You do need to know where you use encryption, which systems would be hardest to change, and which suppliers you depend on for it. That inventory is slow, boring and the most valuable first step. It also helps with every other crypto change you will ever make.
AI security
Staff are already using AI tools, whether or not there is a policy. Start with what is in use, what data goes into it and who approved it. Then agree simple rules: which tools are allowed, what data must never go in, and who to ask. The ISO/IEC 27090 practice path is one way to build a shared vocabulary for AI-specific threats.
Identity
Many serious intrusions do not break anything. They log in. Accounts, passwords, tokens, service accounts and now AI agents with their own access are where much of your real risk sits. A program here means knowing every identity that can reach something important, removing what is not needed and protecting the rest well. The Identity Risk tool helps you think through human, service and AI identities together.
The question you might not ask out loud
How do I fund three programs when I can barely fund one?
Start each one small: an owner, an inventory and a quarterly update. That costs mostly time. Ask for real money once the inventory shows the size of the problem. Funding requests backed by your own findings land far better than ones backed by headlines.
Rule of thumb:Rule of thumb: if it will still matter in five years, give it an owner, not a deadline.
Sources
- NIST IR 8547 (Final), Transition to Post-Quantum Cryptography Standards (read 2026-11-14)