Resources

Every edition, its status and the change log are on the QCI-QS1 standards index.

• S1 Financial Institutions

  Credit unions, community and state-chartered banks.

• S2 Healthcare

  Medical practices and HIPAA-covered entities.

• S3 State and Local Government

  State agencies, counties and municipal authorities.

• S4 Critical Infrastructure

  Utilities and energy, with IT and OT as two boundaries.

• S5 Insurance Carriers

  Regional and specialty carriers and their reinsurers.

• S6 EU Financial Entities (DORA)

  Entities subject to DORA.

• S7 NIS2

  Entities subject to the NIS2 directive.

• S8 EU Digital Identity Wallet

  EUDI Wallet providers and relying parties under eIDAS 2.0.

• T1 Discovery Evidence Acceptance Checklist

  Whether a discovery tool's output can count as inventory evidence.

• T2 Crypto Agility Test and Acceptance Protocol

  How to run and accept the test behind gate G80.

• T3 Exception Register Template

  Record exceptions with owners and review dates.

• T4 Decision Record Template

  Document act-or-wait decisions for the board.

• Fundamentals1 article

  The core ideas behind quantum risk: what is exposed, why timing matters and which cryptography is affected.

• QCI-QS1 scoring: pillars and gates10 articles

  How the five Q-Risk pillars are levelled and how the G60, G70 and G80 gates cap the final score under QCI-QS1 v2.3.

• Cryptographic inventory1 article

  How organizations find, record and keep current the cryptography their critical systems and data flows rely on.

• Migration and crypto agility7 articles

  How organizations plan, test and accept the move to post-quantum cryptography, and prove they can change cryptography again.

• Suppliers and procurement5 articles

  How to assess supplier post-quantum readiness, what to ask vendors and what a supplier attestation should contain.

• Governance and assurance5 articles

  What boards should ask, what a board report contains and what evidence auditors should expect.

• Standards and regulation3 articles

  Post-quantum cryptography standards, NIST transition guidance and how QCI-QS1 relates to legal obligations.

• Q-Risk screening

  26 questions, a self-reported estimate across the five pillars, and a board insert preview you can download.

• Quantum readiness checklist

  A 29-point self-audit mapped to NIST IR 8547, NSM-10 and QCI-QS1.

• PQC migration cost drivers

  Nine questions show what will drive your migration effort and where to start. A planning worksheet, no dollar estimate.

• Sample cost-drivers worksheet (PDF)

  What the worksheet produces, from synthetic answers for a vendor-heavy organization.

• Sample supplier evidence-gap report (PDF)

  What the Supplier Readiness Pilot delivers, with synthetic data and no supplier named.

• Free crisis simulation

  A self-guided decision exercise for a quantum-era cryptographic failure.

• What is harvest now, decrypt later?

  Why data captured today is exposed before a quantum computer exists.

• What is post-quantum cryptography?

  The NIST algorithms and what migrating to them involves.

• What is the Q-Risk Score?

  Pillars, gates and bands, and what a score does and does not prove.

• Cryptographic inventory

  What a CBOM must contain and how it maps to QASI.

• Crypto agility

  Swapping algorithms without downtime, and how gate G80 tests it.

• Credit union PQC guide

  Vendor-driven readiness for NCUA-regulated institutions.

• Regulatory Radar

  Statutes, directives and guidance that shape quantum risk obligations.

• PQC migration timeline

  Dated milestones across the US, EU, UK and international bodies.

• NIST PQC migration roadmap

  QCI's suggested four phases against the NIST transition timeline.

• QCI-QS1 and DORA

  How the standard maps to DORA's ICT risk requirements.

• Glossary

  Quantum risk and post-quantum terms, defined.

• FAQ and governance FAQ

  Common questions about quantum risk, the standard and assessment.

• Newsletter archive

  Every published issue of the daily Q-Risk Intelligence newsletter.

• Blog

  Longer analysis on regulation, migration and scoring.

• Briefing series and events

  Briefing topics, the executive roundtable and the summit.