Reporting cryptographic exposure to the board means turning a technical cryptographic inventory into a small number of business-level measures directors can track: how exposed the organisation is, where that exposure sits in the business, and whether the position is improving over time. Boards need that answer now because DORA, NIS2 and the SEC’s disclosure rules all place cyber-risk oversight on the board or management body, and the 2026 edition of the NACD-ISA Director’s Handbook on Cyber-Risk Oversight tells directors to ensure management has assessed the organisation’s risk exposure from quantum computing.
That is a lot of accountability sitting with people who are, by design, not cryptography specialists. And a meaningful share of what they are accountable for – weak or ageing cryptography inside applications, certificates, keys and third-party integrations – rarely gets translated into anything a board can act on.
What the rules already ask of boards
- DORA (EU financial entities, applicable from 17 January 2025). Article 5 requires the management body to “define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework”, and to “bear the ultimate responsibility for managing the financial entity’s ICT risk”. Its members must keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis. Article 6 requires the framework itself to be documented and reviewed at least once a year.
- NIS2 (EU essential and important entities). Article 20 requires Member States to ensure that management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Members of management bodies must follow training so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices.
- US SEC (public companies, rules effective 5 September 2023). Regulation S-K Item 106(c) requires a description of the board’s oversight of risks from cybersecurity threats and, where applicable, identification of any board committee responsible and the processes by which the board or committee is informed about those risks. Form 8-K Item 1.05 requires a material cybersecurity incident to be disclosed, generally within four business days of determining that it is material.
None of these texts mentions cryptography by name. They do not need to. A board that must approve and oversee the ICT or cybersecurity risk framework, and must understand it well enough to assess it, is overseeing the cryptography that framework depends on, whether or not anyone has shown it that cryptography.
What most boards are shown, and why it does not work
Cryptographic discovery, done properly, produces a lot of granular, technically true output: certificates nearing expiry, cipher suites still enabled, RSA keys below today’s recommended length. Handed to a board unfiltered, that list does two things badly. It buries the few items that matter under many that do not, and it asks non-specialists to make a judgement – is this bad, and how bad? – that the document itself does not answer.
The 2026 Director’s Handbook on Cyber-Risk Oversight, published by the National Association of Corporate Directors (NACD) and the Internet Security Alliance (ISA), describes the same problem in general terms. Under its fifth principle, “Guide Cybersecurity Risk Measurement and Reporting”, it observes that “Many boards still receive cybersecurity updates that are overly technical, inconsistent across business units, or disconnected from business objectives.” Its stated aim for board dashboards is equally direct: “The objective is not to drown the board in data, but to elevate insights for strategic oversight.”
What the 2026 handbook says about quantum
The handbook, now in its fifth edition, includes a Board Discussion Guide on Quantum Computing as one of its tools. Mapped against the principles, it asks boards to:
- “Integrate quantum risk into the enterprise risk register and strategic technology roadmap” (Principle 1).
- “Require quantification of the potential impact of quantum-enabled decryption on sensitive data” and “Assess the cost-benefit trade-offs of early adoption of PQC versus delayed transition” (Principle 4).
- “Ensure management has assessed risk exposure to the organization arising from quantum computing technologies” and “Assess and receive updates on management’s progress in migrating to PQC” (Principle 5).
Elsewhere the handbook states that “Emerging technologies such as AI and quantum computing further amplify systemic vulnerabilities.” Post-quantum migration is no longer a topic the board can leave entirely to the security team. The guidance written for directors now names it.
What a board-ready answer looks like
Closing the gap does not mean putting a cryptography bill of materials (CBOM) in front of the board. A full inventory is the right artefact for the security team, not for a quarterly governance conversation. The handbook’s own questions for boards point to what is needed instead, including: “Are our cyber dashboards tied directly to the board-approved risk appetite and prioritized by business impact?” and “Does our reporting include trendlines across quarters and years to identify emerging patterns, not just point-in-time snapshots?”
For cryptography, that suggests three things a board report should carry:
- Exposure in business terms. Findings weighed against the business systems they sit inside, so a high exposure rating means something a director can act on, rather than a raw technical severity.
- Direction of travel. A small number of measures tracked over time, so the board can ask whether the organisation is moving in the right direction, and fast enough, instead of asking for the list.
- Progress against the plan. Where the organisation stands against its own post-quantum migration plan and against any regulatory milestones that apply to it.
The inventory underneath does not go away. It is what makes the summary defensible when a director, an auditor or a regulator asks how a number was reached.
Where this sits in the ECEM lifecycle
Enterprise Cryptographic Exposure Management (ECEM) treats post-quantum readiness as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. Board reporting draws on all of them but belongs to Monitor. Discover and Inventory establish what exists. Assess and Prioritise decide what matters and what to fix first. Transition does the work. Monitor keeps the board’s answer current, so it is not a one-off exercise presented once and never revisited.
Where Quantum Sentinel fits
Quantum Sentinel builds a living Enterprise CBOM and scores exposure with business context rather than as raw findings. The Cryptographic Exposure Score measures the organisation’s overall cryptographic exposure. The Quantum Readiness Score is a continuous measure of cryptographic posture, tracked over time rather than assessed once. Reports export in PDF, Word, Excel and CSV. The exposure assessment and posture monitoring pages explain how each works.
Frequently asked questions
Does DORA make the board responsible for cryptographic risk?
DORA does not mention cryptography in Article 5, but it makes the management body of a financial entity bear the ultimate responsibility for managing the entity’s ICT risk, and requires it to define, approve and oversee the ICT risk management framework. Cryptographic protection is part of the ICT risk that framework covers.
What does NIS2 require of management bodies?
Article 20 of NIS2 requires management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and be capable of being held liable for infringements. Their members must follow training so that they can identify risks and assess cybersecurity risk-management practices.
What do the SEC cybersecurity rules require boards to disclose?
Regulation S-K Item 106(c) requires public companies to describe the board’s oversight of risks from cybersecurity threats and, where applicable, identify any board committee responsible and how the board or committee is informed about those risks. Material cybersecurity incidents must be disclosed on Form 8-K, generally within four business days of determining that they are material.
What does the NACD-ISA 2026 handbook say about quantum computing?
Its Board Discussion Guide on Quantum Computing asks boards to integrate quantum risk into the enterprise risk register, require quantification of the potential impact of quantum-enabled decryption on sensitive data, ensure management has assessed the organisation’s risk exposure from quantum computing, and receive updates on progress in migrating to post-quantum cryptography.
Should the board see the full cryptographic inventory?
Usually not. The full inventory is the security team’s working artefact. The board needs a small number of measures drawn from it: exposure in business terms, the trend over time, and progress against the migration plan, with the inventory available to support how each figure was reached.
Sources: Regulation (EU) 2022/2554 (DORA), Articles 5, 6 and 64; Directive (EU) 2022/2555 (NIS2), Article 20; US Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216 (26 July 2023) and fact sheet; NACD and Internet Security Alliance, 2026 Director’s Handbook on Cyber-Risk Oversight, including Tool D, Board Discussion Guide on Quantum Computing.
Further reading: how to talk to your board about quantum risk, what Enterprise Cryptographic Exposure Management is and compliance and regulatory readiness.