Quantum-safe Digital Infrastructures: Challenges and Solutions for Governance

As quantum computers grow in capability, the cryptographic systems protecting most of the world’s digital infrastructure face a fundamental threat. The “harvest now, decrypt later” attack - collecting encrypted data today to decrypt it once a sufficiently powerful quantum computer exists - means the threat is already operational for long-lived sensitive data, even before quantum computers are powerful enough.

This course equips policy makers, managers, and governance professionals to understand the quantum threat and lead their organisations through the transition to quantum-safe digital infrastructure. Complementary to the technical course - together they form a comprehensive view of the quantum-safe transition challenge.

What you’ll learn

• What Shor’s algorithm does and why it threatens RSA, elliptic curve cryptography, and Diffie-Hellman key exchange - explained without requiring cryptographic expertise
• The harvest now, decrypt later threat: why sensitive data with long confidentiality lifetimes is at risk now, not just when quantum computers become powerful
• NIST post-quantum cryptography standardisation: what standards were finalised in 2024, what they replace, and why their adoption is urgent
• A societal risk assessment method for quantum threats, and the key insights that come from applying it to sectors such as banking, government, and telecoms
• The vulnerabilities of public key infrastructures and the governance measures that build quantum readiness
• Quantum-safe governance terms and concepts, plus the boundary conditions and governance actions involved in a quantum-safe transition
• Governance mechanisms for coordinating the many stakeholders involved in the migration to quantum-safe digital infrastructures
• Stage models for the quantum-safe transition and how to use an organisational readiness assessment tool (the Quantum Safe Readiness Model)

Course structure

The course is self-paced at three to four hours per week. It is explicitly designed for governance professionals without deep technical backgrounds - analogies and concrete examples replace cryptographic mathematics throughout.

The opening week covers the societal impact of quantum computing: an introduction to the threat, a societal risk assessment method for evaluating quantum-related risks, and the key insights that come from applying that method.

The second week covers the difference between classical and quantum computers, the vulnerabilities of public key infrastructures, and governance measures for quantum readiness.

The third week covers quantum-safe governance terms and concepts, plus the boundary conditions and governance actions for a quantum-safe transition.

The fourth week covers stage models for the quantum-safe transition and an organisational readiness assessment tool, the Quantum Safe Readiness Model. A short closing section summarises quantum-safe governance.

Who is this for?

• CISOs and IT governance leaders building a quantum-safe strategy
• Policy professionals in government agencies, regulators, or standards bodies
• Risk and compliance officers assessing quantum threats to data security
• Board members and senior executives who need to understand the quantum threat without getting lost in cryptography
• Legal professionals advising on data protection and compliance obligations

Prerequisites

No technical background in cryptography, quantum physics, or information security is required. The course provides all necessary technical context through accessible explanations. Familiarity with organisational risk management (enterprise risk frameworks, policy development) is helpful. Some exposure to information security governance concepts (ISO 27001, GDPR, NIS2) is useful but not required.

Hands-on practice

The course uses applied governance exercises rather than technical problem sets. You will:

• Apply a societal risk assessment method to evaluate quantum-related threats
• Examine how quantum risks play out in sectors such as banking, government, and telecoms
• Work with stage models to position an organisation on its quantum-safe journey
• Use an organisational readiness assessment tool, the Quantum Safe Readiness Model

Discussion forums allow you to apply course concepts to your own organisational context with peer feedback.

Why take this course?

The quantum threat to encryption is real, has a credible timeline, and is already causing governments and major organisations to act. NIST published its first post-quantum cryptography standards in 2024. The EU’s NIS2 directive addresses quantum risk. Major financial services regulators are beginning to issue guidance.

Organisations that wait until the threat is imminent before beginning their migration will face a far more costly and risky process than those who plan now. This course provides the governance knowledge to act proactively - and the Delft University pedigree gives its content credibility in conversations with technical teams, regulators, and leadership. The companion technical course covers cryptographic and infrastructure details for teams that need them.