Quantum Risk Governance
Structured. Scored. Auditable.
Every engagement is structured around QCI-QS1 — the free, published standard for quantum risk management. You get scored posture, documented governance, and artifacts your auditors can reference.
Quantum Readiness Program
Enterprise Assessment & Roadmap — QCI-QS1 Clauses 4–8
Full organizational assessment against QCI-QS1. Produces a certified Q-Risk Score, QASI inventory of crypto dependencies, vendor attestation pack, and a 90-day implementation roadmap with board-ready documentation. One-time 90-day engagement that converts uncertainty into a scored, auditable posture.
Standard Coverage
QCI-QS1 Clauses 4–8: QRAF (Clause 4), QASI Inventory (Clause 5), Q-Risk Scoring (Clause 6), Vendor Oversight (Clause 7), Board Reporting (Clause 8)
Duration
90-day engagement
Engagement Scope
Executive team + key stakeholders
Delivery
Hybrid (on-site kickoff + virtual sessions)
Format
Assessment, advisory workshops, implementation support
Engagement Scope
- Phase 1: QASI Inventory — Map cryptographic dependencies across critical systems (Clause 5)
- Phase 2: Q-Risk Scoring — Five-pillar assessment producing a comparable, auditable score (Clause 6)
- Phase 3: Vendor Attestation — Roadmap request pack for critical suppliers (Clause 7)
- Phase 4: Board Documentation — Quarterly insert and governance reporting package (Clause 8)
Deliverables
- Certified Q-Risk Score with five-pillar breakdown
- QASI inventory report covering critical systems
- Vendor Roadmap Request Pack with attestation templates
- Board Briefing Insert (quarterly, per QCI-QS1 Clause 8)
Ideal For
- CISOs and CTOs who need a scored, auditable quantum risk posture
- Risk officers addressing fiduciary accountability for emerging threats
- Compliance teams aligning to post-quantum governance requirements
- Organizations preparing for regulatory or board scrutiny on quantum risk
Ready to Assess Your Organization Against QCI-QS1?
Start with a scoping conversation. We'll identify which clauses of the standard are most relevant to your risk profile and recommend the right engagement.
30 minutes. No obligation. We'll tell you what you need — and what you don't.