Executive control room

Y2Q Board Readiness Control Room

Y2Q is not a date. It is a board-control window: confidentiality lifetime plus migration time, compared against a documented CRQC planning scenario.

Mosca margin

Inside control window by 4 years

2029 framing

Readiness assumption, not a break-date claim

Materials

2/2 official PDFs ready

Evidence packet

0/5 categories identified

Download board materials Start inventory intake

Mosca inequality

confidentiality lifetime + migration time > CRQC scenario

Planning model

X: confidentiality lifetime10 years

How long this data class must remain confidential.

Y: migration duration4 years

How long management believes discovery, prioritization, rollout, and exceptions will take.

Z: CRQC planning scenario10 years

Years until a cryptographically relevant quantum computer under your board-approved scenario.

Inside control window by 4 years

10 + 4 - 10 = 4. Margin = -4.

Management implication: Inventory and severity ranking should already be active for data in this class.
Board question: Which systems still rely on RSA/ECC for this data class, and who owns remediation?
Next action: Start cryptographic inventory intake and produce severity-ranked findings.

Replace the defaults with your board-approved scenario and record the source. This instrument supports governance review; it is not a quantum capability forecast.

Board package

A post-quantum plan should be evidence-backed before it is budget-backed.

This self-check identifies whether the required evidence categories exist. It does not certify readiness, replace independent proof, or create an attestation.

Evidence package not established

Independent validation is still required before board attestation.

Current cryptographic inventorySystems, protocols, certificates, libraries, vendors, and data flows are mapped.Retention and data-class mapConfidentiality lifetime is tied to data class, obligation, and business owner.Severity-ranked exposure findingsFindings connect RSA/ECC exposure to retention, sensitivity, and migration effort.Owned remediation sequenceManagement can show sequencing, owners, dependencies, exceptions, and review dates.Evidence package and attestation pathProof artifacts are ready for audit, procurement, and board-risk review.

Executive takeaways

The briefing arc from scenario uncertainty to governed action.

Select takeaway

Frame

Y2Q is a control problem, not a countdown clock.

Y2K had a fixed date, a mechanical remediation, and a clean test on January 1, 2000. Quantum migration has scenario uncertainty, many ownership boundaries, and no single morning when leadership knows every dependency was fixed.

Official materials

Download the board brief and the webinar deck.

These PDFs are the portable companion materials for the Y2Q executive briefing. The on-page control room is the interactive HTML equivalent for assumptions, evidence, and next actions.

Board brief

Y2Q CISO and Board Brief

Board-language summary of the Y2Q control window, Mosca inequality, governance rule, and management asks.

Audience: Boards, CISOs, audit committees
Use: Meeting brief
Version: Updated Jan 1, 1980
File: 146 KB PDF

Prepared by Qtonic Quantum Corp. HTML summary is provided on this page; the PDF is the portable meeting artifact.

Download Board brief

Webinar deck

Y2Q Webinar Materials

Session companion PDF for the Breaking Encryption: Y2Q and the Quantum Countdown executive briefing.

Audience: Security leadership and board teams
Use: Briefing deck
Version: Updated Jan 1, 1980
File: 145 KB PDF

Prepared by Qtonic Quantum Corp. HTML summary is provided on this page; the PDF is the portable meeting artifact.

Download Webinar deck

Sources and assumptions

A board packet should name the source of every planning assumption.

Use these references as starting points. Replace the default CRQC scenario, retention period, and migration duration with organization-owned inputs before presenting the output as a decision artifact.

NIST PQC standards

FIPS 203, 204, and 205 are the first finalized post-quantum standards; migration planning should start from the official standards and transition guidance.

CNSA 2.0 / NSA

CNSA 2.0 gives specific transition requirements for National Security Systems. It is a strong policy signal, not a universal commercial deadline.

Google 2029 timeline

Google frames 2029 as its post-quantum cryptography migration timeline. This page treats it as a readiness assumption, not a CRQC break-date claim.

GRI 2025 survey signal

The Global Risk Institute report is an expert-survey input on uncertainty and planning urgency, not deterministic forecast evidence.

Mosca / XYZ framing

The control test compares confidentiality lifetime and migration duration against a threat-arrival scenario. Each variable should carry an owner and source.

Next moves

Convert the briefing into evidence management.

Start cryptographic inventory intake

Find public and internal-facing cryptographic exposure before approving a remediation budget.

Continue

Review remediation sequencing

Move from current-state cryptography to hybrid readiness to post-quantum readiness.

Continue

View methodology and assumptions

See how evidence, severity, and proof artifacts are structured for review.

Continue

Executive control room

Y2Q Board Readiness Control Room

Y2Q is not a date. It is a board-control window: confidentiality lifetime plus migration time, compared against a documented CRQC planning scenario.

Mosca margin

Inside control window by 4 years

2029 framing

Readiness assumption, not a break-date claim

Materials

2/2 official PDFs ready

Evidence packet

0/5 categories identified

Download board materials Start inventory intake

Mosca inequality

confidentiality lifetime + migration time > CRQC scenario

Planning model

X: confidentiality lifetime10 years

How long this data class must remain confidential.

Y: migration duration4 years

How long management believes discovery, prioritization, rollout, and exceptions will take.

Z: CRQC planning scenario10 years

Years until a cryptographically relevant quantum computer under your board-approved scenario.

Inside control window by 4 years

10 + 4 - 10 = 4. Margin = -4.

Management implication: Inventory and severity ranking should already be active for data in this class.
Board question: Which systems still rely on RSA/ECC for this data class, and who owns remediation?
Next action: Start cryptographic inventory intake and produce severity-ranked findings.

Replace the defaults with your board-approved scenario and record the source. This instrument supports governance review; it is not a quantum capability forecast.

Board package

A post-quantum plan should be evidence-backed before it is budget-backed.

This self-check identifies whether the required evidence categories exist. It does not certify readiness, replace independent proof, or create an attestation.

Evidence package not established

Independent validation is still required before board attestation.

Executive takeaways

The briefing arc from scenario uncertainty to governed action.

Select takeaway

Frame

Y2Q is a control problem, not a countdown clock.

Official materials

Download the board brief and the webinar deck.

These PDFs are the portable companion materials for the Y2Q executive briefing. The on-page control room is the interactive HTML equivalent for assumptions, evidence, and next actions.

Board brief

Y2Q CISO and Board Brief

Board-language summary of the Y2Q control window, Mosca inequality, governance rule, and management asks.

Audience: Boards, CISOs, audit committees
Use: Meeting brief
Version: Updated Jan 1, 1980
File: 146 KB PDF

Prepared by Qtonic Quantum Corp. HTML summary is provided on this page; the PDF is the portable meeting artifact.

Download Board brief

Webinar deck

Y2Q Webinar Materials

Session companion PDF for the Breaking Encryption: Y2Q and the Quantum Countdown executive briefing.

Audience: Security leadership and board teams
Use: Briefing deck
Version: Updated Jan 1, 1980
File: 145 KB PDF

Prepared by Qtonic Quantum Corp. HTML summary is provided on this page; the PDF is the portable meeting artifact.

Download Webinar deck

Sources and assumptions

A board packet should name the source of every planning assumption.

NIST PQC standards

FIPS 203, 204, and 205 are the first finalized post-quantum standards; migration planning should start from the official standards and transition guidance.

CNSA 2.0 / NSA

CNSA 2.0 gives specific transition requirements for National Security Systems. It is a strong policy signal, not a universal commercial deadline.

Google 2029 timeline

Google frames 2029 as its post-quantum cryptography migration timeline. This page treats it as a readiness assumption, not a CRQC break-date claim.

GRI 2025 survey signal

The Global Risk Institute report is an expert-survey input on uncertainty and planning urgency, not deterministic forecast evidence.

Mosca / XYZ framing

The control test compares confidentiality lifetime and migration duration against a threat-arrival scenario. Each variable should carry an owner and source.

Next moves