Think Earlier.
Spending early is not the same as spending well. Evidence decides the order.
Quantum Risk Governance: Structured, Scored, Auditable
Every engagement produces artifacts defined by QCI-QS1: scored posture, crypto dependency inventory, vendor oversight documentation, and board-ready governance reporting.
Think earlier. Act when the evidence says to act.
All engagements reference QCI-QS1
QCI-QS1 is a free, published standard. Each tier below covers specific clauses of the standard, so you know exactly what governance artifacts you'll receive and which compliance requirements they satisfy. Read the standard →
The standard is free. Here is what an engagement adds.
QCI-QS1 is published and free. You can adopt it and score yourself. What you cannot do alone is make that score count for someone else. Diagnosis is free. Judgment is the engagement.
Adopt the standard (free)
A method you can self-assess against. Your own Q-Risk Score, your own inventory, your own board insert. Enough to know where you stand.
Engage QCI (paid)
An externally validated Q-Risk Score an auditor, insurer, or counterparty will accept. The timing call on what to defer and what to accelerate. The certificate estate and machine credentials a self-scan misses. Evidence someone else will rely on.
A self-assessed 74 and an externally validated 74 are not the same number. One is a claim you make. The other is a claim someone else can rely on.
Quantum Crisis Simulation
You receive
One entry engagement, not a catalogue. A facilitated two-hour tabletop runs your own people through a quantum-era cryptographic failure and produces a scored QCI-QS1 Clause 6 response-gap report. Everything the old diagnostics covered: Q-Risk scoring, crypto inventory, vendor attestation, board briefings, regulatory mapping, is now delivered at full scope inside the three programs below.
What it changes
your own people find where the response plan breaks before an incident does; you leave with a scored gap report you can act on.
Quantum Readiness Program
Enterprise Assessment: QCI-QS1 Clauses 4–8
From inventory to scored posture in 90 days.
What it changes
a scored posture you can defend to a board, a regulator, or an insurer; a roadmap your teams can execute; the exposures a self-inventory misses, surfaced.
You receive
- Independently assessed Q-Risk Score (five-pillar breakdown)
- QASI inventory of crypto dependencies
- Vendor Roadmap Request Pack with attestation templates
- Board Briefing Insert template (per Clause 8)
- + 4 more → See details
Quantum Safe Transformation
Full-Scope Advisory: QCI-QS1 Clauses 4–8 + Sector Supplements
End-to-end implementation with timing intelligence.
What it changes
a defensible defer-or-accelerate decision per system, so you spend on what is late and wait on what is not; documentation every stakeholder accepts.
You receive
- Q-Risk Score with quarterly reassessment and delta tracking
- Complete QASI inventory across all business units
- Vendor oversight program with attestation tracking
- Architecture review and crypto agility roadmap
- + 5 more → See details
Quantum Governance for Boards
Director Advisory: QCI-QS1 Clause 8
Governance alignment before regulators require it.
What it changes
directors who can demonstrate oversight rather than just receive a briefing; a documented decision trail that stands up when regulators ask.
You receive
- Board-level Q-Risk Score dashboard
- Governance oversight framework with committee structures
- Crisis response playbook
- 12-month governance calendar
- + 4 more → See details
One-page engagement briefs
A single page per engagement: what you receive, who it is built for, and exactly how it differs from the other three options. Built to forward to a colleague or a board member.
Follow-on engagements
Two programs continue after delivery. These are optional continuations, not prerequisites, each one keeps the standard alive inside your organization once the initial work is signed off.
QCI-QS1 Conformance Review
$24,500 · 60 days, beginning after roadmap sign-off
An independent review of the remediation work completed against the published QCI-QS1 standard, producing a dated conformance statement your auditors, insurers, and clients can rely on.
- Reassessed Q-Risk Score with delta against the original baseline
- Clause-by-clause conformance statement across QCI-QS1 Clauses 4–8
- Evidence pack referenced directly in audit and insurance responses
Continuous Assurance Retainer
$8,500 / month · 12-month renewable term
Ongoing custody of the standard inside your organization: quarterly Q-Risk reassessment, vendor attestation tracking, and timing guidance as NIST and regulatory deadlines move.
- Quarterly reassessment with trended Q-Risk Score and board insert
- Live vendor attestation register maintained against QCI-QS1 expectations
- Standing advisory access for sequencing and defer/accelerate decisions
Sector Supplement Extension
$45,000 per supplement · 90 days per supplement
Extends the transformation into an additional regulated sector or jurisdiction by applying a further QCI-QS1 sector supplement (S1–S7) to a newly acquired or newly regulated part of the estate.
- Supplement-specific control mapping and gap findings
- Regulator-ready alignment memo for the added regime
- Integrated roadmap update so sequencing stays a single plan
Not sure which engagement fits?
Start with a scoping conversation. We'll identify which clauses of QCI-QS1 are most relevant to your risk profile and recommend the right engagement.
The cost is in the timing, not the technology.
Scheduled vs forced
Plan the migration now and it is a project. Wait until an exam finding or a mandate forces it and it is an emergency, at emergency cost.
Early spend vs right-time spend
Buy PQC hardware or re-issue credentials before you need to and you pay twice. The standard tells you what can wait.
Finding vs commendation
Walk into the exam with an inventory, an owner, and a timeline, and the finding becomes a commendation. Walk in without them and it becomes a remediation order.
Client outcome figures land here as engagements complete.
Evidence, as it accrues
We publish what we measure, and only what we measure. As engagements complete, this is where the outcome data lands: Q-Risk Score movement, exposures surfaced that internal inventories missed, and exams cleared. No invented numbers. That is the point of a standards body.
Q-Risk Score distribution across the cohort — coming
Exposures surfaced that self-inventories missed — coming
Exams and audits cleared — coming
The Standard Exists. The Question Is Whether You'll Adopt It.
QCI-QS1 is free and published. Organizations that implement it now will be the ones peers point to when the timeline compresses.