A board member asks how the organization is addressing the long-term threat that quantum computing poses to current public-key encryption. No practical attack exists today, but some customer data must remain confidential for many years. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
You don't rebuild the whole house for a storm forecast years out, but you do find out where the weak windows are and make sure they can be swapped fast. That's cryptographic inventory plus crypto-agility. The traps are panic replacement on one side and 'not my problem yet' on the other, especially when your data has to stay secret for years.
Full Explanation
The quantum threat is an emerging risk with a long time horizon but a real present-day component: data intercepted today could be decrypted later if it must remain confidential for many years. The proportionate response is to understand the exposure and prepare to change. That means building an inventory of where cryptography is used, which algorithms and key lengths protect which data, and which systems or suppliers would be hard to change, then planning for crypto-agility so algorithms can be replaced as post-quantum standards are adopted, prioritizing long-lived sensitive data. Replacing all public-key encryption immediately is disproportionate and impractical; it disrupts the business and may adopt options that are not yet broadly supported. Excluding the threat from the register ignores the harvest-now, decrypt-later scenario that the long confidentiality requirement creates. Contractual guarantees from cloud providers cover only part of the estate and do not transfer accountability for the organization's data. Exam caveat: the board needs a risk-based roadmap, not a technical deep dive into algorithms. Operational check: confirm a cryptographic inventory exists, that long-lived sensitive data is identified, and that a migration roadmap with owners is in the risk register.