Nearly Half of Enterprises Lack Dedicated Owner for Post‑Quantum Cryptography Migration, Study Finds
What Happened — A new Axiad research report shows that 46 % of surveyed enterprises do not have a single person accountable for leading their post‑quantum cryptography (PQC) migration. While 75 % claim to keep an up‑to‑date inventory of certificates, keys and algorithms, ownership, testing and visibility gaps remain, leaving many organizations unprepared for the cryptographic shift required by quantum‑computing threats.
Why It Matters for Compliance & Audit Readiness
- Lack of a defined owner makes it difficult to map PQC‑related activities to SOC 2 security controls (e.g., CC6.1 – Control Activities, CC6.2 – Logical Access) and to produce continuous evidence of remediation.
- Without a single accountable leader, organizations struggle to document testing, risk assessments and migration timelines—key artifacts auditors expect for a defensible SOC 2 audit.
- Continuous visibility into cryptographic assets is a prerequisite for the “risk assessment” and “change management” criteria of SOC 2; gaps translate to audit findings and potential non‑compliance.
Who Is Affected — Enterprises across all verticals that rely on PKI, TLS, digital signatures, or any encryption‑dependent services (technology, finance, healthcare, retail, etc.).
Recommended Actions
- Appoint a dedicated PQC Migration Owner (e.g., a senior security architect) and formalize the role in your governance framework.
- Extend your existing asset‑inventory process to include ownership, testing status, and migration readiness flags for every cryptographic asset.
- Map PQC migration tasks to SOC 2 control objectives (CC6, CC7, CC8) and begin collecting continuous evidence for audit readiness.
Source: Help Net Security – Nearly half of enterprises have no one leading PQC migration
Technical Notes
- The gap is not a technical vulnerability but an organizational control deficiency that can expose enterprises to future cryptographic breakage once quantum‑capable adversaries emerge.
- No specific CVEs or exploit code are cited; the risk is strategic and procedural.