The mechanism the Virginia Tech researchers name deserves more attention than their headline finding. A board without its own expertise depends on the chief information security officer to explain the concepts, the risks, the program objectives and, eventually, the oversight process itself, so the supervised executive ends up setting the benchmarks and deciding which risks are in scope [7]. The result follows from the structure itself, not from any particular director's weakness or any executive's overreach. Convert the proxy percentage and the asymmetry gets concrete: 14.7% of 1,000 is 147, which leaves 853 companies that disclosed a financial expert and no director with cybersecurity skills [1]. The comparison is between a mandatory disclosure and a voluntary one [9], and the mandatory one carries teeth of a specific kind, since after Sarbanes-Oxley a company had to state whether its audit committee held a financial expert and explain itself if it did not [10]. Those proxies are from 2019, which predates the current rules, so the record supplied here does not tell us what the disclosure rate is now [9]. The Commission's own logic cuts against a single fix: boards oversee rather than operate, and a lone named specialist can become the director everyone else defers to, a new dependency rather than a cure. The comment file added a practical objection, that mandated disclosure would push companies to compete for a small pool of specialists [2], and the Commission's own reasoning was that directors with broad risk and strategy experience can often oversee sophisticated technical matters [3]. The study does not retire that view. Its authors interviewed 38 people in total, flag possible self-serving bias among participants, and decline to say what the right mix of expertise is [4][6]. What it does support is narrower and more usable: the deficiency sits in who supplies the frame, not in the titles on the roster. The board-deck answer is a technology or risk committee with a standing cyber item. It is incomplete for a specific reason. Ader, whose account of the agenda slot comes from presenting in it, describes cyber landing after the items that carry a vote, with nearly all the questions covering the last 90 days [16]. Ninety-day questions are the ones the reporting function has already prepared for. The remedies that need no rule change are structural: a committee that commissions its own assessment instead of receiving one, and a named director accountable for reading the technical material. Both cost something. A board seat spent on a specialist is a seat not spent on someone who knows the company's markets, and an independently procured review is a line item plus a strained relationship with an executive who did not choose it. One caveat on provenance. The argument as published is a contributed Forbes council column by J Nathaniel Ader, co-founder of a quantum computing firm and author of a quantum almanac [15], so the post-quantum framing arrives with an interest attached; the Commission's stated reasoning and the study he cites stand on their own. The calendar is where this quarter's structure meets next decade's bill. Executive Order 14412, signed in June 2026, sets end-2030 for post-quantum key establishment and end-2031 for digital signatures on federal high-value and high-impact systems [11], directs the Federal Acquisition Regulatory Council to propose a contractor compliance rule by the end of 2030 [12], and the Department of War strategy runs to the same pair of years [13]. Ahead of all of that, CISA and NIST owe guidance on the minimum elements of a cryptographic bill of materials, due March 19, 2027, specified to support automated assessment of the cryptographic assets inside a product [14].
