What G60 means and how to satisfy it
G60 is the inventory gate in QCI-QS1 v2.3. Unless validated inventory coverage is at least 95% for critical systems and at least 95% for critical data flows, with no unresolved material population discrepancy, the final Q-Risk Score is capped at 60. The gate applies after the raw score is calculated, whatever the other pillars and gates show.
New to this? Read Pillar 2: Crypto visibility and QASI completeness first. After this, continue with What G70 means and how to satisfy it.
In one sentence: Without 95% validated coverage in both categories, the score cannot exceed 60.
Why it matters
Every later decision depends on knowing where vulnerable cryptography is. The gate stops strong scores elsewhere from hiding an incomplete inventory.
Illustrative example: an organization with a raw score of 74, 98% system coverage and 90% flow coverage receives a final score of 60, because flow coverage is below 95%.
Worked coverage calculation (hypothetical)
Coverage is calculated separately for each category as 100 × current validated critical records ÷ complete identified critical population in that category (QCI-5.1-03). Percentages keep full precision for the threshold decision (QCI-6.2-01). The figures below are invented for illustration and checked against the Clause 6.3 condition.
| Case | Systems | Flows | G60 result |
|---|---|---|---|
| A | 95 of 100 (95.0%) | 40 of 40 (100.0%) | Passes, if there is no unresolved material population discrepancy |
| B | 94 of 100 (94.0%) | 40 of 40 (100.0%) | Fails: systems below 95% |
| C | 1,899 of 2,000 (94.95%) | 60 of 60 (100.0%) | Fails: 94.95% is not rounded up to 95% |
| D | 190 of 200 (95.0%) | No critical flows; absence evidenced | Passes on systems, with absence substantiated |
Validating the denominator
- The denominator is the complete identified critical population, not the records that happen to be validated. New critical items enter it when identified, even with incomplete records (QCI-5.1-01).
- Reconcile the population at least quarterly against service, asset, architecture, data-flow, procurement and cloud records, and document unresolved discrepancies (QCI-5.1-01).
- An item may leave the denominator only when decommissioning is evidenced and the change is recorded (QCI-5.1-03).
- A zero denominator is an evidenced absent condition, not manufactured success (QCI-6.2-01).
- A critical population discrepancy that could materially change the metric prevents G60 from passing until it is resolved (QCI-6.2-01).
- Sampling by an assessor does not alter the denominator (QCI-4.8-02).
What happens when G60 fails
The final score is the lower of the raw score and every triggered cap (QCI-6.1-02). A failed gate applies regardless of other gates (QCI-6.3-01). In the standard's own worked example, pillar levels 5, 3, 5, 5, 5 give a raw score of 92; with G60 failed the final score is 60, in the Advancing band. A final score of 60 does not imply that G60 passed (QCI-6.5-01).
What organizations should do
- Reconcile the critical population at least quarterly against service, architecture, procurement and cloud records, and add new critical items to the denominator when found (QCI-5.1-01).
- Give each record a named owner and technical reviewer; records with unknown algorithm, parameters, trust dependency or key protection do not count (QCI-5.1-02).
- Calculate system and flow coverage separately and publish numerator and denominator (QCI-5.1-03).
- Keep critical evidence within 90 days and revalidate after material changes (QCI-5.1-04).
- Keep full precision for the threshold decision; 94.96% is not 95% (QCI-6.2-01).
Evidence an auditor should expect
Rows marked "QCI requirement" come from the standard. Rows marked "Editorial suggestion" are QCI's practical advice and are not requirements.
| Artifact | Scope | Owner | Currency | Verification | Basis |
|---|---|---|---|---|---|
| Coverage calculation | Critical systems and critical flows, separately | Quantum Risk Owner | Current assessment period | Recompute from numerator and denominator | QCI requirement (QCI-5.1-03) |
| Population reconciliation record | All in-scope critical items | Inventory owner | At least quarterly | Compare against service, procurement and cloud records | QCI requirement (QCI-5.1-01) |
| Validated QASI records | Each critical system and flow | Named record owner and technical reviewer | Evidence within 90 days | Sample records against current configuration | QCI requirement (QCI-5.1-04) |
| Change log of denominator additions and removals | Assessment period | Inventory owner | Since prior assessment | Trace removals to decommissioning evidence | Editorial suggestion |
How NIST or other primary authorities address it
This concept originates with QCI in QCI-QS1. NIST and other standards bodies do not define or endorse it.
How QCI-QS1 addresses it
G60 is defined in the Clause 6.3 gate table. It uses the coverage measures of Clause 5.1 and shares its 95% threshold with P2 level 4.
| Requirement | Clause | Relationship | Pillar | Gate |
|---|---|---|---|---|
| QCI-6.3-01 | 6.3 | explicit requirement | — | G60 |
| QCI-5.1-01 | 5.1 | explicit requirement | P2 | G60 |
| QCI-5.1-02 | 5.1 | explicit requirement | P2 | G60 |
| QCI-5.1-03 | 5.1 | explicit requirement | P2 | G60 |
| QCI-5.1-04 | 5.1 | explicit requirement | P2 | G60 |
| QCI-6.2-01 | 6.2 | explicit requirement | — | G60 |
| QCI-6.1-02 | 6.1 | explanatory context | — | G60 |
| QCI-6.5-01 | 6.5 | explanatory context | — | G60 |
Common mistakes
- Reading a final score of exactly 60 as a pass. It does not imply G60 has passed (QCI-6.5-01).
- Rounding 94.96% up to 95%.
- Letting stale evidence support the gate (QCI-5.1-04).
Questions for the board
- What are our current system and flow coverage figures, with numerator and denominator?
Questions
If systems coverage is 98% but flows coverage is 90%, does G60 pass?
No. Both categories must be at least 95%, so the final score is capped at 60 (QCI-6.3-01).
What if we have no critical data flows?
Where one category is absent, evidence must substantiate the absence and the other category must meet the threshold (QCI-6.3-01).
Does a score of exactly 60 mean G60 passed?
No. Scores at exactly 60, 70 or 80 do not imply that the corresponding gate has passed (QCI-6.5-01).
Sources
- QCI-QS1 Quantum Readiness and Post-Quantum Cryptography Governance Standard, Quantum Core Institute, Version 2.3, September 23, 2026, Clause 6.3. Supports: G60 pass condition and cap.
- QCI-QS1 Quantum Readiness and Post-Quantum Cryptography Governance Standard, Quantum Core Institute, Version 2.3, September 23, 2026, Clause 5.1. Supports: Coverage, reconciliation and evidence age.
- QCI-QS1 Quantum Readiness and Post-Quantum Cryptography Governance Standard, Quantum Core Institute, Version 2.3, September 23, 2026, Clauses 6.2 and 6.5. Supports: Precision and band rules.
Related learning
Where the gate's evidence comes from
Back to QCI-QS1 scoring: pillars and gates · All Knowledge Center topics
Page history
- Published
- Not yet recorded
- Standard edition
- QCI-QS1 v2.3 (September 23, 2026)
Cite this page
Quantum Core Institute. (n.d.). What G60 means and how to satisfy it. https://quantumcoreinstitute.com/learn/qci-qs1/g60-inventory-gate
Link: https://quantumcoreinstitute.com/learn/qci-qs1/g60-inventory-gate