Question

A financial services firm currently protects customer data at rest and in transit using RSA-2048 and ECC-based encryption. During a technology horizon-scanning exercise, the risk practitioner learns that advances in quantum computing may eventually render these asymmetric algorithms breakable. The firm retains encrypted customer records for a legally mandated retention period of 15 years. What should the risk practitioner emphasize FIRST when advising leadership on this emerging risk?

Accepted Answer

That long-retention encrypted data harvested today could be decrypted in the future, so cryptographic agility and post-quantum migration planning should begin now

Answer

That the firm should immediately replace all existing encryption with proprietary algorithms to avoid the quantum threat

Answer

That because practical quantum computers do not yet exist, no action is warranted until a working machine is publicly demonstrated

Answer

That the risk can be fully transferred by purchasing a cyber insurance policy covering future decryption events