QS05: add governance, ownership and measurability controls

[goubach]

Addresses #35

What changes

• Description: frames crypto-agility as a governed, owned and measurable capability.
• How to Prevent: adds two controls (ownership and governing policy; agility measurability), with a one-line pointer to the inventory in QS04.
• Example Attack Scenarios: adds Scenario 3, a governance failure where agility cannot be exercised in time.

What changed after review

• Scenario 3 right now names the trigger-detection gap. Not the execution gap alone, following feedback in QS05 Crypto-Agility Failures: Adding Governance and Control Ownership, Plus Governance-Failure Scenario #35.
• Standards and Regulatory Mapping and Reference Links carry NIST CSWP 39upd1, responding to the open question I have raised in QS05 Crypto-Agility Failures: Adding Governance and Control Ownership, Plus Governance-Failure Scenario #35. Offered subject to the leads' URL verification process.
• No overlap introduced with QS04 (inventory) nor QS06 (hybrid).

[nmcitra]

As promised in the channel. The substance is right and I support all three additions — the ownership control fills the gap #35 named, the measurability control is what makes it auditable rather than aspirational, and Scenario 3 is the missing failure mode: the technology worked and the organisation couldn't exercise it. Keeping the references and standards mapping untouched for the leads was the right call.

My notes are all at the wording level, five of them:

1. "it must have named owner, governed by policy, and measurable" — the parallelism breaks. Suggest: "it must have a named owner, a governing policy, and a measurable definition of agility."
2. "share systems behind the abstraction layer" and "share protocols that negotiate" — both want "of": "share of systems…", "share of protocols…".
3. "since we can only utilise agile what the inventory (QS04) reveals" — suggest: "since agility can only be exercised over what the inventory (QS04) reveals."
4. Scenario 3 opens on a fragment ("An organisation that is technically agile, with crypto abstraction layer and negotiable protocols."). Folding it into the next sentence fixes it.
5. The scenario's close — "yielding the exposure a governance problem rather than a technical concern" — suggest: "leaving the exposure as a governance problem rather than a technical one."

All five are paste-ready if useful. Substance-wise this is ready; happy to re-read after the wording pass.

[goubach]

Grateful for the feedback. All wording fixes applied. Commit pushed.

[goubach]

Scenario 3 has been updated. It now focuses on the trigger-detection gap rather than the execution gap alone, following the point raised in #35. The failure now begins with no one assigned to watch the triggers, which is usually what starts in practice. The rewrite also resolves the opening fragment you've flagged in note 4.