Think Earlier.

    Governance takes longer to build than cryptography takes to break.

    Quantum Risk Governance Services

    Start with the Supplier Readiness Pilot. Readiness, Board Governance and Independent Assessment are there when you need more. Each is described by what you get, then the documents you receive.

    What you get

    Find out in 30 days which of your critical vendors are ready for post-quantum cryptography, and what your board should decide.

    Documents you receive

    Supplier evidence-gap report, remediation register and a one-page board briefing

    Clause coverage

    QCI-QS1 Clause 7, Annex C

    $5,000 for up to 10 critical suppliers · $10,000 for up to 25 · 30 days

    Supplier Readiness Pilot

    Which of your vendors are ready for post-quantum cryptography, and what your board should decide

    Your quantum risk sits mostly with vendors you don't control: your core processor, card processor, digital banking platform and managed service providers. In 30 days we ask your critical suppliers for their post-quantum plans on your letterhead, check what they send against QCI-QS1 Annex C, and give you an evidence-gap report your board and examiner can read. The fee is credited in full toward the Supplier Attestation Round or the Readiness Program if you continue within six months.

    Scope a pilot

    The sample uses synthetic data and names no supplier.

    You receive

    • Supplier evidence-gap report: each supplier marked evidenced, incomplete or not evidenced, with what is missing
    • Remediation register: the follow-up for each gap, an owner and a due date
    • Board briefing: one page your board or supervisory committee can minute
    • The requests we sent and every response received, for your files

    We need from you

    • Your list of critical vendors (we help you narrow it to 10 or 25)
    • One named contact who can answer questions within two business days
    • Permission to send requests on your letterhead

    How the 30 days run

    1. Week 1

      Supplier list and requests

      Agree the critical suppliers; send Annex C requests on your letterhead.

    2. Weeks 2–3

      Responses and follow-up

      We chase non-responses and check each answer against what Annex C asks for.

    3. Week 4

      Report and briefing

      Evidence-gap report, remediation register and board briefing, walked through with you.

    Built for

    • Credit unions and community banks that inherit their cryptography from vendors
    • Teams asked by a board, examiner or insurer what their vendors are doing about quantum risk
    • Vendor-management teams with no one to chase post-quantum answers

    What the pilot does not do, and what comes next

    The pilot does not issue a G70 determination or a Q-Risk Score. Gate G70 needs a 60-day response window and officer-signed attestations from every critical supplier; the Supplier Attestation Round does that.

    Supplier Attestation Round: $6,500 round setup + $450 per critical supplier in the declared boundary. Example: 25 critical suppliers = $6,500 + (25 × $450) = $17,750. Invoiced Net 30. 90 days (60-day response window plus scoring and escalation).

    Scope a pilot Read Annex C

    Where do I start?

    Find the line that sounds like your situation.

    1. 01 · FreeFree standard"You want to know what good looks like."Go
    2. 02 · FreeFree screening"You want a rough idea of where you stand."Go
    3. 03 · From $5,000Supplier Readiness Pilot"Your board asked what your vendors are doing about quantum risk."Go
    4. 04 · $69,000Readiness Program"You need a documented baseline across your own systems."Go
    5. 05 · $40,000Board Governance"Your directors need an oversight record the minutes can show."Go
    6. 06 · $8,500 / monthRetainer"You need the record kept current each quarter."Go

    This is not a required sequence. Start at any step that fits. Independent assessment is listed separately because it must come from someone who did not build the work (Independence policy).