First 100 Days + Quantum

New CISOs get asked about quantum earlier than they expect, and usually before the inventory exists to answer with.

The First 100 Days Kit — the assessment, the stakeholder map, the engagement letter, the personal-liability considerations and the first board deck: what to do, in what order, when the job is new and everything is urgent.

Post-Quantum Migration Kit — one row per cryptographic use rather than per system, the Mosca check that tells you whether you are already late, four migration waves that start with long-lived data and the trust anchors, a vendor questionnaire with hard stops, and the deadline calendar behind it.

Why the pair. "What are we doing about quantum?" is a board question with a bad default answer, because the honest one — we don't know what we're using — sounds worse than it is and better than saying nothing. The migration kit turns it into a first-quarter deliverable: an inventory in progress, a Mosca result, four waves and a date. That is a far stronger first board deck than a reassurance, and it is the kind of answer a new CISO gets exactly one chance to give well.

Two tiers, because the First 100 Days Kit is sold as a practitioner or an MSSP licence rather than an organisation one.