Who it is for
Technology and risk owners who need to decide what to investigate, budget, sequence, or defer before selecting post-quantum implementations.
Quantum-safe readiness assessment
Turn cryptographic findings into business decisions
Evaluate data longevity, system criticality, vendor readiness, technical dependencies, and migration constraints to create a practical, evidence-labelled roadmap.
Readiness assessment — prioritization, not compliance certification
What we need to begin
- A cryptographic inventory or enough evidence to establish a bounded baseline
- Business owners for critical systems and sensitive data
- Known retention, confidentiality, availability, and interoperability requirements
- Relevant vendor roadmaps, contracts, and platform constraints where available
What we assess
- Data confidentiality lifetime and harvest-now, decrypt-later exposure
- Business criticality, change windows, dependencies, and recovery constraints
- Vendor and platform readiness, including uncertain or unsupported migration paths
- Crypto-agility capabilities across software, protocols, infrastructure, and operations
- Priority based on evidence, impact, urgency, feasibility, and unresolved unknowns
What you receive
- An evidence-labelled readiness summary and decision register
- A prioritized risk and dependency map
- A phased crypto-agility and migration roadmap
- Vendor questions, proof-of-concept candidates, and explicit decision gates
How the engagement works
- 01
Baseline
Confirm inventory coverage, business objectives, decision owners, and material unknowns.
- 02
Evaluate
Assess data lifetime, system exposure, vendor support, agility, and operational constraints.
- 03
Prioritize
Score candidate actions using evidence strength, business impact, urgency, and feasibility.
- 04
Roadmap
Define phases, owners, dependencies, decision gates, and suitable prototype candidates.
Standards and evidence basis
Recommendations are tied to the client's environment and the status of each reference. Final standards, final guidance, and draft transition material are labelled separately.
Standards and guidance last reviewed: 5 August 2026.
Final standards
NIST FIPS 203, 204, and 205
Provide current standardized PQC targets without implying that every application is ready to adopt them.
Final guidanceNIST CSWP 39upd1 — Crypto Agility
Frames environment-specific strategies for replacing algorithms while preserving operations.
Initial public draftNIST IR 8547 — PQC Transition
Informs transition discussion while remaining explicitly labelled as draft guidance.
Important limitations
- The assessment does not certify regulatory compliance or declare an organization quantum-safe.
- Priorities may change as standards, protocols, products, vendor support, and business systems evolve.
- Recommendations are limited by the accuracy and completeness of the supplied inventory and stakeholder evidence.