Think Earlier.

    Governance takes longer to build than cryptography takes to break.

    Quantum Risk Governance Services

    Six engagements and a monthly retainer under the published QCI-QS1 standard. Each one is described by what you get, then the documents you receive.

    What you get

    Go from no documented position to a baseline you can show your board, built with QCI over 90 days.

    Documents you receive

    Cryptographic inventory, governance record, self-assessed Q-Risk Score and board insert

    Clause coverage

    QCI-QS1 Clauses 4 to 8

    $69,000 · 90-day engagement

    Quantum Readiness Program

    Enterprise Assessment & Roadmap — QCI-QS1 Clauses 4–8

    From inventory to scored posture in 90 days
    Enterprise Tier

    Full organizational assessment against QCI-QS1. Produces a self-assessed Q-Risk Score baseline, built with QCI, with five-pillar breakdown and all three gate results (G60, G70, G80), QASI inventory of crypto dependencies, supplier attestation round, and a 90-day implementation roadmap with board-ready documentation. Independent assessment of this QCI-built baseline must be by an assessor outside QCI (see Independence policy). Every score is reported with its three gate results: G60 requires 95 percent validated coverage of critical systems and critical data flows; G70 requires a current attestation from every critical supplier, with no exception route; G80 requires a representative end-to-end agility test within twelve months.

    Clause coverage

    QCI-QS1 Clauses 4–8: QRAF (Clause 4), QASI Inventory (Clause 5), Q-Risk Scoring (Clause 6), Vendor Oversight (Clause 7), Board Reporting (Clause 8)

    Duration

    90-day engagement

    Engagement Scope

    Executive team + key stakeholders

    Delivery

    Hybrid (on-site kickoff + virtual sessions)

    Format

    Assessment, advisory workshops, implementation support

    Engagement Scope

    • Phase 1: QASI Inventory — Map cryptographic dependencies across critical systems (Clause 5)
    • Phase 2: Q-Risk Scoring — Five-pillar assessment producing a comparable, auditable score (Clause 6)
    • Phase 3: Vendor Attestation — Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination (Clause 7)
    • Phase 4: Board Documentation — Quarterly insert and governance reporting package (Clause 8)

    Deliverables

    • Self-assessed Q-Risk Score baseline, built with QCI, with five-pillar breakdown and all three gate results (G60, G70, G80)
    • QASI inventory report covering critical systems
    • Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
    • Board Briefing Insert (quarterly, per QCI-QS1 Clause 8)
    • Independent assessment of this QCI-built baseline must be by an assessor outside QCI (see Independence policy).

    Ideal For

    • CISOs and CTOs who need a scored, auditable quantum risk posture
    • Risk officers addressing fiduciary accountability for emerging threats
    • Compliance teams aligning to post-quantum governance requirements
    • Organizations preparing for regulatory or board scrutiny on quantum risk

    For this QCI-built work: independent assessment by an assessor outside QCI (see Independence policy).

    Ready to Assess Your Organization Against QCI-QS1?

    Start with a scoping conversation. We'll identify which clauses of the standard are most relevant to your risk profile and recommend the right engagement.

    30 minutes. No obligation. We'll tell you what you need, and what you don't.

    Where do I start?

    Find the line that sounds like your situation.

    1. 01 · FreeFree standard"You want to know what good looks like."Go
    2. 02 · FreeFree screening"You want a rough idea of where you stand."Go
    3. 03 · $5,500Crisis Simulation"Your auditor asked a quantum question."Go
    4. 04 · $69,000Readiness Program"You have no documented baseline yet."Go
    5. 05 · $24,500Independent Assessment"You need a number you can defend."Go

      Independent assessment by an assessor outside QCI for QCI-built work (see Independence policy).

    6. 06 · $8,500 / monthRetainer"You need the record kept current each quarter."Go

    This is not a required sequence. Start at any step that fits.