Post Quantum Cryptography (PQC) training course

• Lattice-Based Cryptography
  • Key concepts and applications
  • Popular schemes (e.g., NTRU, Learning with Errors)
• Hash-Based Cryptography
  • Understanding hash-based signatures
  • Existing schemes (e.g., XMSS)
• Code-Based Cryptography
  • Introduction to code-based systems (e.g., McEliece)
  • Implementation challenges

Implementation and Security Analysis

• Best practices for integrating PQC
• Hands-on exercises and code examples
• Evaluating the security of PQC algorithms
• Understanding potential attack vectors

Cryptographic Discovery, Governance and Migration Planning
•    Building a cryptographic inventory (CBOM) and why discovery, not algorithm choice, is the binding constraint
•    Mosca's inequality as a planning tool, and harvest-now-decrypt-later as a board-level risk
•    Comparing published lifecycle and roadmap models (NIST, NCSC, NIS Cooperation Group) and their differing governance assumptions
•    Establishing accountability: crypto-agility ownership, sequencing dependencies and trust-anchor management

Economics, Budgeting and Financial Reporting for PQC
•    Estimating migration cost across cryptographic classes rather than treating it as a single line item
•    Security economics: misaligned incentives, externalities and why under-investment is rational without intervention (after Anderson, 2001)
•    When quantum vulnerability becomes a financial reporting matter (impairment triggers, regulatory capital, asset useful-life assumptions)
•    Making the business case to a CFO rather than a CISO

Regulatory Compliance and Supply-Chain Implementation
•    Mapping obligations under DORA, EBA operational-risk expectations and sector regulators
•    Third-party and supplier dependency risk, including concentrated providers and CDN/TLS termination paths the organisation does not directly control
•    Evidencing migration progress for auditors, regulators and risk committees
•    Translating a technical migration into operational-risk taxonomy and incident-classification language