Think Earlier.
Spending early is not the same as spending well. Evidence decides the order.
Quantum Risk Governance: Structured, Scored, Auditable
Five main engagements and one specialist supplier service. Readiness builds a self-assessed baseline; independent assessment of QCI-built work must be by an assessor outside QCI.
Think earlier. Act when the evidence says to act.
All engagements reference QCI-QS1
QCI-QS1 is a free, published standard. Each engagement below identifies its scope and relevant clauses; the work and records delivered depend on that scope. Read the standard →
The standard is free. Here is what an engagement adds.
QCI-QS1 is published and free. You can adopt it and score yourself. What you cannot do alone is independently assess that score. After QCI-supported Readiness, independent assessment must be by an assessor outside QCI (see Independence policy).
Adopt the standard (free)
A method you can self-assess against. Your own Q-Risk Score, your own inventory, your own board insert. Enough to know where you stand.
Engage QCI (paid)
Readiness builds an inventory and self-assessed baseline with QCI. For that boundary, independent assessment must be by an assessor outside QCI (see Independence policy).
A self-assessed score and an independently assessed score are not the same determination. The standard requires every reported score to say which it is.
Five main engagements
Quantum Crisis Simulation
You receive
One entry engagement, not a catalogue. A facilitated two-hour tabletop runs your own people through a quantum-era cryptographic failure and produces a QCI-QS1 Clause 4.4 response-gap report scored against the incident scenarios and annual exercise requirement of Clause 4.4. Other engagements cover Q-Risk scoring, cryptographic inventory, supplier attestations, board governance, and regulatory mapping.
What it changes
your own people find where the response plan breaks before an incident does; you leave with a scored gap report you can act on.
Quantum Readiness Program
Enterprise Assessment: QCI-QS1 Clauses 4–8
What you get
Go from no documented position to a baseline you can show your board, built with QCI over 90 days.
Documents you receive
- Self-assessed Q-Risk Score baseline, built with QCI, with five-pillar breakdown and all three gate results (G60, G70, G80)
- QASI inventory of crypto dependencies
- Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
- Board Briefing Insert template (per Clause 8)
- + 5 more → See details
Clause coverage
QCI-QS1 Clauses 4–8
Independent Assessment
QCI-QS1 Clauses 1 to 8: a written determination on a declared boundary · 60 days
What you get
Get a score you can defend to an auditor, from someone who did not build the work.
Review an existing conformance record and evidence over 60 days where QCI has no firm-level self-review conflict. A separate QCI assessor alone does not make QCI's own work independently assessable.
Documents you receive
- Assessment-type letter and declared boundary
- Conformance record review across every requirement in Clauses 1 to 8
- Evidence sampling, including all unresolved high-impact exceptions
- Gate determinations for G60, G70 and G80
- Independently assessed Q-Risk Score with band and conformance status reported side by side
- Findings register with owners and due dates
- Dated written determination
Clause coverage
QCI-QS1 Clauses 1 to 8
Quantum Safe Transformation
Full-Scope Advisory: QCI-QS1 Clauses 4–8 + Sector Supplements
What you get
Move from an approved plan to migrations actually under way, business unit by business unit.
Documents you receive
- Quarterly self-assessed Q-Risk Score updates with delta tracking and gate status. Any independent assessment of this QCI-supported work must be performed by an assessor outside QCI (see Independence policy)
- Complete QASI inventory across all business units
- Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
- Architecture review and crypto agility roadmap
- + 5 more → See details
Clause coverage
QCI-QS1 Clauses 4–8 + Sector Supplements
Quantum Governance for Boards
Director Advisory: QCI-QS1 Clause 8
What you get
Give your board a way to oversee quantum risk that holds up in the minutes.
Documents you receive
- Board-level Q-Risk Score dashboard
- Governance oversight framework with committee structures
- Crisis response playbook
- 12-month governance calendar
- + 5 more → See details
Clause coverage
QCI-QS1 Clause 8
Readiness builds; an outside assessor reviews. The Readiness Program builds a self-assessed baseline with QCI over 90 days. For that boundary: independent assessment by an assessor outside QCI (see Independence policy).
Specialist service
Supplier Attestation Round
QCI-QS1 Clause 7: clearing gate G70 · 90 days (60-day response window plus scoring and escalation)
Under QCI-QS1 v2.3 no score can exceed 70 until every critical supplier has provided an adequate response and an officer-signed attestation. A documented exception does not count toward it. QCI runs the round: Annex C requests on your letterhead citing your sector obligation, the 60-day deadline, responses scored for adequacy, attestations collected on the authorized form, non-responses entered on the exception register with escalation, and coordinated requests through sector ISACs or Member State channels where a supplier serves many customers.
Price formula: $6,500 round setup + $450 per critical supplier in the declared boundary. Example: 25 critical suppliers = $6,500 + (25 × $450) = $17,750. Invoiced Net 30.
Ideal for
- Any organization capped at 70
- Operators of SCADA, DCS or medical devices
- Carriers with reinsurers on critical flows
- Wallet providers on native keystores
You receive
- Critical supplier register
- Issued requests with dates
- Scored responses
- Officer-signed attestations
- Exception register entries with escalation letters
- Contract-clause recommendations for the next renewal
- The G70 determination
After QCI-supported Readiness: independent assessment by an assessor outside QCI (see Independence policy).
One-page engagement briefs
A single page per engagement: what you receive, who it is built for, and exactly how it differs from the other options. Built to forward to a colleague or a board member.
Follow-on engagements
Optional continuations keep the standard active inside your organization once the initial work is signed off.
Independent assessment by an assessor outside QCI
$24,500 · 60 days
Independent assessment of QCI-supported Readiness work must be performed and signed by an assessor outside QCI (see Independence policy). QCI does not provide that outside assessment.
- Reassessed Q-Risk Score with delta against the original baseline
- Conformance record and written determination across every requirement in QCI-QS1 Clauses 1 to 8, with the three gate results
- Evidence pack referenced directly in audit and insurance responses
Continuous Assurance Retainer
$8,500 / month · 12-month renewable term
Ongoing custody of the standard inside your organization: quarterly Q-Risk reassessment, vendor attestation tracking, and timing guidance as NIST and regulatory deadlines move. Delivered under the QCI-M1 Migration Governance Method: each of the thirteen Annex G cryptographic domains reported by stage and gate status each quarter, with the obligations register reviewed quarterly and supplier attestations refreshed annually.
- Quarterly reassessment with trended Q-Risk Score and board insert
- Live vendor attestation register maintained against QCI-QS1 expectations
- Standing advisory access for sequencing and defer/accelerate decisions
Sector Supplement Extension
$45,000 per supplement · 90 days per supplement
Extends the transformation into an additional regulated sector or jurisdiction by applying a further QCI-QS1 sector supplement (S1 to S8) to a newly acquired or newly regulated part of the estate, including the two-boundary IT/OT model of S4 and the EU DORA, NIS2 and EUDI Wallet supplements S6 to S8.
- Supplement-specific control mapping and gap findings
- Regulator-ready alignment memo for the added regime
- Integrated roadmap update so sequencing stays a single plan
Not sure which engagement fits?
Start with a scoping conversation. We'll identify which clauses of QCI-QS1 are most relevant to your risk profile and recommend the right engagement.
The cost is in the timing, not the technology.
Scheduled vs forced
Plan the migration now and it is a project. Wait until an exam finding or a mandate forces it and it is an emergency, at emergency cost.
Early spend vs right-time spend
Buy PQC hardware or re-issue credentials before you need to and you pay twice. The standard tells you what can wait.
Finding vs commendation
Walk into the exam with an inventory, an owner, and a timeline, and the finding becomes a commendation. Walk in without them and it becomes a remediation order.
The Standard Exists. The Question Is Whether You'll Adopt It.
QCI-QS1 is free and published. Organizations that implement it now will be the ones peers point to when the timeline compresses.