then QCI-P1, Independent Assessment
Open PDF
· March 10, 2027A business decision system for quantum risk
Know Which Quantum Risks Can Wait, and Which Are Already Late.
Quantum Core Institute gives regulated organizations a defensible way to score quantum exposure, prioritize spend, and produce audit-ready evidence without vendor hype.
Built for banks, payment providers, critical infrastructure, and regulated enterprises.
Q-Risk posture
Decision surface
Evidence current
61
Current score
3
Priority actions
82%
Evidence ready
Data
Act now
Long-lived data is already exposed
Identity
Act now
Migration lead time exceeded
Payments
Prioritize
Signature integrity at risk
Scored
Prioritized
Defensible
Most vendors sell urgency. We publish the standard.
23 documents. Free. No form.
The standard, its annexes, sector supplements and guides. Pick the one for your role, or take the lot.
Start here
One document for your role. The rest can wait.
The 90-day establishment sequence
Open PDFWhat drives migration cost and sequence
Open PDFthen QCI-QS1-C2, Remediation and Migration Providers
Open PDFthen QCI-T1, Discovery Evidence Acceptance Checklist
Open PDF23 documents, 2.4 MB. No form required.
Where do I start?
Find the line that sounds like your situation.
- 01 · FreeFree standard"You want to know what good looks like."Go
- 02 · FreeFree screening"You want a rough idea of where you stand."Go
- 03 · $5,500Crisis Simulation"Your auditor asked a quantum question."Go
- 04 · $69,000Readiness Program"You have no documented baseline yet."Go
- 05 · $24,500Independent Assessment"You need a number you can defend."Go
Independent assessment by an assessor outside QCI for QCI-built work (see Independence policy).
- 06 · $8,500 / monthRetainer"You need the record kept current each quarter."Go
This is not a required sequence. Start at any step that fits.
The decision problem
Quantum Risk Isn’t One Problem. It’s Three Exposures.
Quantum risk is not a single deadline. It is three separate surfaces, each with a different business consequence and a different wait/act decision.
Act now
Data gets read.
Harvest-now-decrypt-later attacks target data with a long secrecy shelf life. If your data must stay confidential for 10+ years, waiting is already late.
RegulatoryIPPrivacy
Already late
Identities get forged.
Digital signatures and certificates rely on quantum-vulnerable cryptography. Identity trust breaks before encryption does.
FraudAccess controlAudit failure
Needs a plan
Payments lose proof.
Settlement, transaction signatures, and non-repudiation depend on cryptography quantum computers can forge.
DisputesSettlement riskCompliance
The organizing principle
Trust must survive the transition.
Quantum readiness is not ultimately about replacing algorithms. It is about preserving the mechanisms organizations rely on to prove:
- Who sent it.
- Who approved it.
- Whether it changed.
- Whether it remains confidential.
- Whether the evidence can still be trusted.
Select an exposure to see which proofs it must preserve.
Trust proofs identity must preserve
- Who sent it.Authenticity of origin: the signature, certificate, or credential behind a message or action.
- Who approved it.Attributable authority, a decision on the record, tied to someone who can be held to it.
- Whether it changed.
- Whether it remains confidential.
- Whether the evidence can still be trusted.Verifiable assurance, the records and anchors you rely on to prove any of the above.
What must survive
The ability to prove who or what is acting.
Certificates, signing keys, customer authentication, machine credentials, and AI-agent credentials all prove who did what. What must survive is attribution: origin, authority, and the evidence behind both.
Quantum threatens authenticity here. The algorithm change is the mechanism; the proof is what you are actually defending.
This is why QCI-QS1 exists. Not as PQC consulting, but as continuity of institutional trust through the cryptographic transition. Asymmetric cryptography is what proves who did what: certificates, signing keys, customer authentication, machine credentials, and AI-agent credentials. That is not merely a cryptography problem. It is a trust infrastructure problem.
Think earlier. Act when the evidence says to act.
Quantum vendors want to sell you solutions you do not need yet. We measure where you actually stand, tell you when to act, and tell you when to wait. Knowing when not to spend is part of the service. Separate real exposure from vendor-driven urgency. Every call is recorded as evidence you can defend later. And because the three surfaces move on different clocks, "wait" on one is fully compatible with "you are late" on another.
A standard regulators and auditors can cite.
QCI-QS1 is the free, citeable standard for quantum risk governance. Published in full. Download it, cite it, adopt it. No form wall and no license fee. Mapped to DORA, NIS2, NCUA, HIPAA, and FFIEC.
Version 2.3, published September 23, 2026, defines five evidenced Q-Risk pillars and three scoring gates: G60 for inventory coverage, G70 for critical supplier attestations, and G80 for a representative crypto-agility test.
Download QCI-QS1 v2.3What a scoping conversation looks like.
01
Adopt the standard.
Download QCI-QS1 and use it as your governance baseline. It is free, citeable, and built for boards and auditors.
02
We map your cryptographic footprint.
We review your cryptography inventory against the QASI framework, including the certificate estates and machine credentials most inventories miss. You get a clear list of what is protected and what is exposed.
03
We score your posture and explain the number.
You get a 0–100 Q-Risk Score and a plain explanation of it: what counts toward the score, where evidence was missing, and which of three checks (inventory coverage, supplier attestations, crypto agility) held the score down. Identity and trust-chain dependencies belong in the inventory; the report identifies the evidence and priorities for each exposure.
04
You leave with evidence.
You receive a board-ready insert, a prioritized roadmap, and the evidence trail behind every recommendation. Nothing stays in the room.
Why it matters now
Harvest now, decrypt later is already happening.
Adversaries collect encrypted data today to decrypt it once quantum capability arrives. Any data that must stay confidential for ten years or more is already exposed. When your board asks, the question is not whether you saw it coming. It is whether you measured it.
Measure your posture.
Get a scored Q-Risk posture and a board-ready report mapped to your regulators.
Schedule Scoping ConversationQ-Risk intelligence, no hype.
Governance-grade updates on PQC compliance, vendor readiness, and regulatory movement. The credit union and community bank PQC briefing leads, twice a week.
Stay Updated
Get the latest insights on quantum risk governance delivered to your inbox