Think Earlier.
Spending early is not the same as spending well. Evidence decides the order.
Quantum Risk Governance: Structured, Scored, Auditable
Start with the Supplier Readiness Pilot. Readiness and Board Governance follow when you need more; independent assessment of QCI-built work must be by an assessor outside QCI.
Think earlier. Act when the evidence says to act.
All engagements reference QCI-QS1
QCI-QS1 is a free, published standard. Each engagement below identifies its scope and relevant clauses; the work and records delivered depend on that scope. Read the standard →
The standard is free. Here is what an engagement adds.
QCI-QS1 is published and free. You can adopt it and score yourself. What you cannot do alone is independently assess that score. After QCI-supported Readiness, independent assessment must be by an assessor outside QCI (see Independence policy).
Adopt the standard (free)
A method you can self-assess against. Your own Q-Risk Score, your own inventory, your own board insert. Enough to know where you stand.
Engage QCI (paid)
Readiness builds an inventory and self-assessed baseline with QCI. For that boundary, independent assessment must be by an assessor outside QCI (see Independence policy).
A self-assessed score and an independently assessed score are not the same determination. The standard requires every reported score to say which it is.
Start here
Supplier Readiness Pilot · 30 days
Find out in 30 days which of your critical vendors are ready for post-quantum cryptography, and what your board should decide.
You receive: Supplier evidence-gap report, remediation register and a one-page board briefing. The fee is credited toward the full round or Readiness within six months.
Advanced engagements
Quantum Readiness Program
Enterprise Assessment: QCI-QS1 Clauses 4–8
What you get
Go from no documented position to a baseline you can show your board, built with QCI over 90 days.
Documents you receive
- Self-assessed Q-Risk Score baseline, built with QCI, with five-pillar breakdown and all three gate results (G60, G70, G80)
- QASI inventory of crypto dependencies
- Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
- Board Briefing Insert template (per Clause 8)
- + 5 more → See details
Clause coverage
QCI-QS1 Clauses 4–8
Quantum Governance for Boards
Director Advisory: QCI-QS1 Clause 8
What you get
Give your board a way to oversee quantum risk that holds up in the minutes.
Documents you receive
- Board-level Q-Risk Score dashboard
- Governance oversight framework with committee structures
- Crisis response playbook
- 12-month governance calendar
- + 5 more → See details
Clause coverage
QCI-QS1 Clause 8
Independent Assessment
QCI-QS1 Clauses 1 to 8: a written determination on a declared boundary · 60 days
What you get
Get a score you can defend to an auditor, from someone who did not build the work.
Review an existing conformance record and evidence over 60 days where QCI has no firm-level self-review conflict. A separate QCI assessor alone does not make QCI's own work independently assessable.
Documents you receive
- Assessment-type letter and declared boundary
- Conformance record review across every requirement in Clauses 1 to 8
- Evidence sampling, including all unresolved high-impact exceptions
- Gate determinations for G60, G70 and G80
- Independently assessed Q-Risk Score with band and conformance status reported side by side
- Findings register with owners and due dates
- Dated written determination
Clause coverage
QCI-QS1 Clauses 1 to 8
Readiness builds; an outside assessor reviews. The Readiness Program builds a self-assessed baseline with QCI over 90 days. For that boundary: independent assessment by an assessor outside QCI (see Independence policy).
Scaling up: every critical supplier
Supplier Attestation Round
QCI-QS1 Clause 7: clearing gate G70 · 90 days (60-day response window plus scoring and escalation)
Under QCI-QS1 v2.3 no score can exceed 70 until every critical supplier has provided an adequate response and an officer-signed attestation. A documented exception does not count toward it. QCI runs the round: Annex C requests on your letterhead citing your sector obligation, the 60-day deadline, responses scored for adequacy, attestations collected on the authorized form, non-responses entered on the exception register with escalation, and coordinated requests through sector ISACs or Member State channels where a supplier serves many customers.
Price formula: $6,500 round setup + $450 per critical supplier in the declared boundary. Example: 25 critical suppliers = $6,500 + (25 × $450) = $17,750. Invoiced Net 30.
Ideal for
- Any organization capped at 70
- Operators of SCADA, DCS or medical devices
- Carriers with reinsurers on critical flows
- Wallet providers on native keystores
You receive
- Critical supplier register
- Issued requests with dates
- Scored responses
- Officer-signed attestations
- Exception register entries with escalation letters
- Contract-clause recommendations for the next renewal
- The G70 determination
Add-on
Quantum Crisis Simulation
You receive
A facilitated two-hour tabletop, often run alongside a board session. It runs your own people through a quantum-era cryptographic failure and produces a QCI-QS1 Clause 4.4 response-gap report scored against the incident scenarios and annual exercise requirement of Clause 4.4.
What it changes
your own people find where the response plan breaks before an incident does; you leave with a scored gap report you can act on.
Multi-unit migration programs are scoped by referral, usually after a Readiness baseline. Ask about a referral.
After QCI-supported Readiness: independent assessment by an assessor outside QCI (see Independence policy).
One-page engagement briefs
A single page per engagement: what you receive, who it is built for, and exactly how it differs from the other options. Built to forward to a colleague or a board member.
Ongoing: Continuous Assurance Retainer
$8,500 / month · 12-month renewable term
For organizations that already have a QCI-QS1 record and need it kept current each quarter.
- Quarterly reassessment with trended Q-Risk Score and board insert
- Live vendor attestation register maintained against QCI-QS1 expectations
- Standing advisory access for sequencing and defer/accelerate decisions
Not sure which engagement fits?
Start with a scoping conversation. We'll identify which clauses of QCI-QS1 are most relevant to your risk profile and recommend the right engagement.
Pricing questions
How much does quantum risk governance cost?
The Supplier Readiness Pilot is $5,000 for up to 10 critical suppliers or $10,000 for up to 25. The Readiness Program is $69,000, Board Governance $40,000 and Independent Assessment $24,500. The full Supplier Attestation Round is $6,500 plus $450 per critical supplier, and the Crisis Simulation add-on is $5,500. Multi-unit migration programs are scoped by referral.
Which QCI engagement is right for my organization?
Most organizations start with the Supplier Readiness Pilot, because most of their cryptography sits with vendors. Readiness builds the inventory, governance record and self-assessed baseline with QCI; Board Governance establishes oversight; Independent Assessment reviews an existing record where QCI has no firm-level conflict.
Does the Supplier Readiness Pilot clear gate G70?
No. The pilot shows where each critical supplier stands in 30 days. Gate G70 needs a 60-day response window and an officer-signed attestation from every critical supplier, which the Supplier Attestation Round collects.
Can QCI independently assess work it helped build?
No. QCI offers Independent Assessment only for boundaries it never advised on. Work QCI helped build or operate must be assessed by a licensed outside assessor or another unaffiliated, qualified assessor.
Questions about scope, the score gates or independence are answered in the Governance FAQ. Not ready to scope? The free PQC cost drivers worksheet rates what will drive your migration effort.
The cost is in the timing, not the technology.
Scheduled vs forced
Plan the migration now and it is a project. Wait until an exam finding or a mandate forces it and it is an emergency, at emergency cost.
Early spend vs right-time spend
Buy PQC hardware or re-issue credentials before you need to and you pay twice. The standard tells you what can wait.
Finding vs commendation
Walk into the exam with an inventory, an owner, and a timeline, and the finding becomes a commendation. Walk in without them and it becomes a remediation order.
The Standard Exists. The Question Is Whether You'll Adopt It.
QCI-QS1 is free and published. Organizations that implement it now will be the ones peers point to when the timeline compresses.