Think Earlier.
Governance takes longer to build than cryptography takes to break.
Six engagements and a monthly retainer under the published QCI-QS1 standard. Each one is described by what you get, then the documents you receive.
Find the line that sounds like your situation.
Independent assessment by an assessor outside QCI for QCI-built work (see Independence policy).
This is not a required sequence. Start at any step that fits.
Services
2-hour facilitated session
Find out, in one day, how your team would handle a cryptographic failure, and where the response breaks.
You receive: Exercise record and response-gap report
Response teams whose auditor or board has started asking.
QCI-QS1 Clause 4.4
90-day engagement
Go from no documented position to a baseline you can show your board, built with QCI over 90 days.
You receive: Cryptographic inventory, governance record, self-assessed Q-Risk Score and board insert
Organizations without a documented baseline.
QCI-QS1 Clauses 4 to 8
60 days
Get a score you can defend to an auditor, from someone who did not build the work.
You receive: Written determination and independently assessed Q-Risk Score
Organizations with a record ready for independent review.
QCI-QS1 Clauses 1 to 8, QCI-P1
6–12 month advisory partnership
Move from an approved plan to migrations actually under way, business unit by business unit.
You receive: Migration plan, quarterly domain reports and updated governance record
Teams with an approved implementation scope.
QCI-QS1 Clauses 5 to 7, QCI-M1
One-day intensive plus 12-month governance calendar
Give your board a way to oversee quantum risk that holds up in the minutes.
You receive: Board oversight process, quarterly board insert and 12-month governance calendar
Boards and risk committees requiring a decision record.
QCI-QS1 Clause 8
Readiness and independent assessment are different decisions.
Readiness builds a self-assessed baseline with QCI over 90 days. For that boundary: independent assessment by an assessor outside QCI (see Independence policy).
Specialist service
$6,500 + $450 per critical supplier · 90 days (60-day response window plus scoring and escalation)
Your score cannot pass 70 until every critical supplier has formally confirmed their post-quantum plans. We chase those confirmations for you: requests on your letterhead, a 60-day clock, scored responses, and escalation for the ones that stall.
View specialist serviceExamples of records produced through scoped engagements. These are not public reports or standalone downloads.
One-page quarterly governing-body insert carrying every required element: boundary, edition, conformance status, pillar levels, gate outcomes, validated coverage of systems and flows, principal exposures, supplier readiness and exceptions, agility test coverage, and decisions required.
Validated cryptographic inventory as linked records for systems, uses, flows, keys and suppliers; both coverage figures with numerators and denominators; exposure flags and treatment status; the discovery source behind each record.
Supplier attestation status by supplier, adequacy scoring, exception register extract and the G70 determination.
DORA, NIS2, eIDAS 2.0, NERC CIP, HIPAA, NAIC Model Law, EO 14412 and OMB M-26-15.
Crypto agility test plan across eleven test categories, acceptance sign-off by engineering and the service owner, and a pass/fail result on the agility gate.
Talk through the boundary, evidence and work required.