What are the Steps for Conducting a Quantum-Safe Payments Risk Assessment?
Author
Payment applications are categorized as critical because they generally operate 24/7/365. Today, most if not all, payment stakeholders regularly perform risk assessments. The quantum risk assessment, specific to your cryptographic infrastructure and that of your providers, can identify vulnerabilities that quantum computing could exploit.
Your organization’s risk management plan should be updated to incorporate the quantum threat, addressing solutions for all external-facing applications, and their connectivity to internal applications (e.g., online or mobile banking).
Robust evaluation of your third-party processors and vendors who enable or provide your current payment and cryptographic infrastructures is essential, as is conducting a thorough vendor risk assessment before choosing quantum-safe solution vendor partners.
The last step of any risk assessment process should always be providing regularly scheduled reporting to your board of directors and senior leadership addressing the likelihood and impact of identified inherent risks, and controls designed to mitigate risk to an acceptable residual level.
Learn more about quantum-safe payments in the paper, "Protecting Payments
in the Quantum Era: Setting a Course for Action," published by the Nacha Payments Innovation Alliance Quantum Payments Project Team.