Think Earlier.

    Governance takes longer to build than cryptography takes to break.

    Quantum Risk Governance Services

    Six engagements and a monthly retainer under the published QCI-QS1 standard. Each one is described by what you get, then the documents you receive.

    What you get

    Move from an approved plan to migrations actually under way, business unit by business unit.

    Documents you receive

    Migration plan, quarterly domain reports and updated governance record

    Clause coverage

    QCI-QS1 Clauses 5 to 7, QCI-M1

    $150,000 – $300,000 · 6–12 month advisory partnership

    Quantum Safe Transformation

    Full-Scope Advisory — QCI-QS1 Clauses 4–8 + Sector Supplements

    End-to-end implementation with timing intelligence
    Transformation Advisory Tier

    Multi-department advisory engagement for enterprises moving from assessment to implementation. Covers the full QCI-QS1 scope including QASI inventory, Q-Risk scoring, supplier oversight, board reporting, and applicable sector supplements. Includes architecture review, migration planning, and ongoing timing intelligence to prevent premature or misdirected investment. Every score is reported with its three gate results: G60 requires 95 percent validated coverage of critical systems and critical data flows; G70 requires a current attestation from every critical supplier, with no exception route; G80 requires a representative end-to-end agility test within twelve months.

    Clause coverage

    QCI-QS1 Clauses 4–8 + applicable Sector Supplement (Financial, Healthcare, Government, Infrastructure, Insurance)

    Duration

    6–12 month advisory engagement

    Engagement Scope

    Custom to organization

    Delivery

    Hybrid (on-site + virtual)

    Format

    Risk advisory, technical assessment, change management

    Engagement Scope

    • Phase 1: Full QASI Inventory — Complete cryptographic dependency mapping across all business units (Clause 5)
    • Phase 2: Q-Risk Scoring with Quarterly Reassessment — Ongoing posture tracking and delta reporting (Clause 6)
    • Phase 3: Vendor Oversight Program — Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
    • Phase 4: Timing Intelligence — Decision framework for when to act vs. when to wait
    • Phase 5: Migration Planning — Architecture review, crypto agility roadmap, and regulatory alignment workstream mapping DORA, NIS2, eIDAS 2.0, NERC CIP, HIPAA, NAIC Model Law, Executive Order 14412 and OMB M-26-15, as mapped in the QCI-QS1 sector supplements
    • Phase 6: Ongoing Advisory — Quarterly reviews, score updates, and board insert preparation (Clause 8)

    Deliverables

    • Quarterly self-assessed Q-Risk Score updates with delta tracking and gate status. Any independent assessment of this QCI-supported work must be performed by an assessor outside QCI (see Independence policy)
    • Complete QASI inventory across all critical systems and business units
    • Supplier attestation round: Annex C requests issued to every critical supplier with a 60-day response deadline, responses scored for adequacy, officer-signed attestations collected, exceptions registered, and the gate G70 determination
    • Multi-year roadmap with timing intelligence and decision triggers

    Ideal For

    • Enterprises with complex cryptographic infrastructure requiring phased migration
    • Organizations in regulated sectors needing sector supplement alignment
    • Critical infrastructure operators requiring timing intelligence before investment
    • M&A teams needing quantum risk due diligence for target assessment

    For this QCI-built work: independent assessment by an assessor outside QCI (see Independence policy).

    What moves the price within $150,000 to $300,000

    • Number of business units in scope
    • Number of critical systems
    • Number of critical suppliers
    • Sector supplements that apply
    • Term: 6 or 12 months

    Two sample configurations (illustrative, not client engagements)

    • Regional bank, 2 business units, about 40 critical systems, up to 20 critical suppliers, 1 sector supplement, 6 months: about $150,000
    • Multi-country insurer, 6 business units, about 200 critical systems, up to 80 critical suppliers, 3 sector supplements, 12 months: about $300,000

    Ready to Assess Your Organization Against QCI-QS1?

    Start with a scoping conversation. We'll identify which clauses of the standard are most relevant to your risk profile and recommend the right engagement.

    30 minutes. No obligation. We'll tell you what you need, and what you don't.

    Where do I start?

    Find the line that sounds like your situation.

    1. 01 · FreeFree standard"You want to know what good looks like."Go
    2. 02 · FreeFree screening"You want a rough idea of where you stand."Go
    3. 03 · $5,500Crisis Simulation"Your auditor asked a quantum question."Go
    4. 04 · $69,000Readiness Program"You have no documented baseline yet."Go
    5. 05 · $24,500Independent Assessment"You need a number you can defend."Go

      Independent assessment by an assessor outside QCI for QCI-built work (see Independence policy).

    6. 06 · $8,500 / monthRetainer"You need the record kept current each quarter."Go

    This is not a required sequence. Start at any step that fits.