October 6 – 7, 2026, The Hague, The Netherlands

PQC: Who owns cryptography? When decisions outgrow IT (by A. Neal, S. Spee, and N. Arifi)
“Most organisations lack clear ownership of cryptographic decisions. With post-quantum cryptography (PQC), this becomes an urgent risk: migration takes years, regulations are tightening, and decisions have long-term business impact. This interactive session focuses on why PQC fails when treated as a technical upgrade rather than a governance and IT operating model challenge. Participants start with an IT capability card and a live poll that reveals fragmented ownership. Using a realistic cryptographic change scenario and an IT capability map, they explore how one decision impacts architecture, development, operations, and vendors. PQC is positioned as a stress test for operating models, shifting the focus from algorithms to decision-making under uncertainty and crypto agility. Participants will leave with: – A clear mental model of cryptography as an operating model responsibility – Practical insight into governance and decision making – A clear way to explain PQC governance to boards and regulators.” More information: https://one-conference.nl/session/who-owns-cryptography-when-decisions-outgrow-it/

PQC migration in practice: learnings from 7 organizations (by M. de Vries, and G. Tillem)
“With awareness on the quantum threat to cryptography finally rising, many are looking for experience on migrating to quantum safe cryptography. In our PQC workgroup, seven wildly different companies cooperate to build this experience together. In this talk we teach you what we learned by experimenting. Specifically we talk about our inventory Proof of Concepts, where we try different tactics to get an overview of the cryptography present in our organizations. We discuss how to get information from vendors, if you can reuse certificate issuing logs, how bad or good the current scanning tools work, why TLS 1.3 became an important focus. We contemplate on the effort versus effect of different inventory goals: finding vulnerable crypto, assessing risk, or prioritizing. We reflect on why it helps to do these experiments together. Why reinventing the wheel yourself can be a waste of time, but experimenting isn’t.” Full text and more information: https://one-conference.nl/session/pqcmigration-in-practice-learnings-from-7-organizations/