Post-Quantum Cryptography for Government: From ASD Mandate to Action Plan

• Plain-language definitions and analogy sheet: qubits, superposition, entanglement, CRQC and PQC
• What quantum changes — and what it does not change
• CRQC explained through impact, not physics: from “billions of years” to “hours or days”
• Australia’s National Quantum Strategy and why agencies need credible, not vendor-led, understanding
• Link back to ASD / cyber.gov.au: why cryptography guidance is the operational anchor for the rest of the course
• Quick poll: what does your agency currently believe about quantum risk?

• How traditional asymmetric cryptography works — RSA, DH, ECDH and ECDSA at a glance
​• Why a CRQC breaks it: Shor’s algorithm in one slide
​• Harvest now, decrypt later: why long-lived, classified and sensitive data is already exposed
​• What stays safe: symmetric crypto, hashing and why AES-256 remains strong
​• NIST-standardised PQC algorithms — ML-KEM, ML-DSA, SLH-DSA — with a simple decision table mapping use cases to algorithm families
​• ASD / cyber.gov.au Guidelines for cryptography: what agencies should stop using, what remains acceptable, and why the 2026 / 2028 / 2030 milestones matter
​• ASD positions on QKD and PQ / traditional hybrid schemes
​• Public sector examples: TLS, VPNs, code signing, PKI, identity, cloud services, shared platforms, OT / SCADA and vendor-managed systems

Practical Application — Exposure Reflection and Day 2 Handoff

Participants identify long-lived data beyond 2030, high-sensitivity systems, vendor dependencies, shared-platform dependencies, upcoming procurements and likely cryptography blind spots.
​Output: a scoped system or service to use as the seed for Day 2 CBOM and LATICE planning.

Group Discussion — What Leaders Need to Do Differently
​• Translate strategic concepts into decisions leaders can own or influence
​• How CIOs, CISOs, ICT infrastructure leaders, enterprise architects, procurement teams and operational leaders engage each other
​• How to avoid panic, complacency and solution confusion

Reflections and Closing Remarks
​• Key takeaways from Day 1
​• What changes tomorrow: CBOM, LATICE, vendor dependencies and transition planning

Targeted Playbook — Building the Transition Pathway

• LATICE: Locate · Assess · Triage · Implement · Communicate & Educate
​• ASD / cyber.gov.au Guidelines for cryptography as the reference point for each LATICE stage
​• What good looks like by end of 2026 — and what to do this quarter

​• Conducting a discovery exercise to locate asymmetric cryptography across a defined system scope
​• Where cryptography hides: cloud, applications, hardware, certificates, PKI, identity, TLS, VPNs, code signing, machine identities, OT / SCADA, embedded devices, shared platforms and vendor SaaS
​• Introducing the CBOM: what it is, why it matters and how it supports ASD-aligned readiness
​• Quality standard and public-sector example: what a usable CBOM should include for a common critical system
​• Exercise: Produce a first-cut CBOM for one critical system or service

• Link to ASD guidance: assessing whether current cryptography and data exposure create transition risk
​• Valuing systems and data: confidentiality, integrity, regulatory and legal exposure
​• Long-lived data: what has a confidentiality requirement beyond 2030?
​• Sector lenses: government services, health, justice, finance, councils, utilities and national critical infrastructure
​• Exercise: Rate systems from Module 3.1 against a value / sensitivity matrix

​• Link to ASD milestones: sequencing work for plan-by-2026, commence-by-2028 and complete-by-2030
​• Prioritisation factors: sensitivity, external interactions, ease of transition, legacy interoperability, bespoke vs commodity systems, lifecycle / refresh cadence and shared-platform dependency
​• Exercise: Build a triage table — which systems move first, which can wait, what decisions are needed and who needs to act

​• Link to ASD recommendations: choosing practical, standards-aligned transition paths without running ahead of guidance

• Vendor-led, service-provider-led and in-house pathways
​• Patching vs library swaps vs procurement-led replacement
​• PQ / traditional hybrid schemes and crypto-agility as transition principles
​• Procurement and vendor obligations: contract clauses, vendor assurance questions, whole-of-government platforms, shared services and supply-chain pressure beyond a questionnaire
​• OT / ICS / SCADA case study: embedded and hard-to-replace environments
​• Exercise: Identify one system from the triage table and outline its implementation and procurement pathway

​• Link to ASD guidance: building a credible internal narrative around risk, milestones and responsibilities
​• Bringing executives, boards, ministers and senior operational leaders along
​• Talking to vendors: what to ask now and how to avoid buying the wrong solution
​• Exercise: Draft a five-bullet executive briefing for a CIO / Secretary / senior leadership team
​• Participants finalise a one-page PQC Transition Plan mapped to LATICE, ASD Guidelines for cryptography and the 2026 / 2028 / 2030 milestones
​• Group share-back and Q&A