Think Earlier.
Governance takes longer to build than cryptography takes to break.
Start with the Supplier Readiness Pilot. Readiness, Board Governance and Independent Assessment are there when you need more. Each is described by what you get, then the documents you receive.
Find the line that sounds like your situation.
This is not a required sequence. Start at any step that fits. Independent assessment is listed separately because it must come from someone who did not build the work (Independence policy).
Start here
$5,000 for up to 10 critical suppliers · $10,000 for up to 25 · 30 days
Find out in 30 days which of your critical vendors are ready for post-quantum cryptography, and what your board should decide. Scaling up to every critical supplier and the G70 determination is the Supplier Attestation Round.
When you need more
90-day engagement
Go from no documented position to a baseline you can show your board, built with QCI over 90 days.
You receive: Cryptographic inventory, governance record, self-assessed Q-Risk Score and board insert
Organizations without a documented baseline.
QCI-QS1 Clauses 4 to 8
One-day intensive plus 12-month governance calendar
Give your board a way to oversee quantum risk that holds up in the minutes.
You receive: Board oversight process, quarterly board insert and 12-month governance calendar
Boards and risk committees requiring a decision record.
QCI-QS1 Clause 8
60 days
Get a score you can defend to an auditor, from someone who did not build the work.
You receive: Written determination and independently assessed Q-Risk Score
Organizations QCI has not advised on that boundary. QCI-built work goes to a licensed outside assessor.
QCI-QS1 Clauses 1 to 8, QCI-P1
Add-on
Quantum Crisis Simulation · $5,500
Find out, in one day, how your team would handle a cryptographic failure, and where the response breaks. Often run alongside a board session.
By referral
Multi-unit migration programs
Migration across several business units is scoped by referral, usually after a Readiness baseline.
Ask about a referralReadiness and independent assessment are different decisions.
Readiness builds a self-assessed baseline with QCI over 90 days. For that boundary: independent assessment by an assessor outside QCI (see Independence policy).
Questions about scope, the score gates or independence? See the Governance FAQ and published pricing.
Examples of records produced through scoped engagements. These are not public reports or standalone downloads.
One-page quarterly governing-body insert carrying every required element: boundary, edition, conformance status, pillar levels, gate outcomes, validated coverage of systems and flows, principal exposures, supplier readiness and exceptions, agility test coverage, and decisions required.
Validated cryptographic inventory as linked records for systems, uses, flows, keys and suppliers; both coverage figures with numerators and denominators; exposure flags and treatment status; the discovery source behind each record.
Supplier attestation status by supplier, adequacy scoring, exception register extract and the G70 determination.
DORA, NIS2, eIDAS 2.0, NERC CIP, HIPAA, NAIC Model Law, EO 14412 and OMB M-26-15.
Crypto agility test plan across eleven test categories, acceptance sign-off by engineering and the service owner, and a pass/fail result on the agility gate.
Talk through the boundary, evidence and work required.