What is a quantum readiness checklist?

A quantum readiness checklist is a structured audit instrument that measures an organization's preparedness for post-quantum cryptography migration. The QCI-QS1 checklist covers 28 control points across governance, cryptographic inventory, crypto agility, technical preparedness, vendor oversight, and operational resilience.

How is this checklist different from a generic security checklist?

Generic security checklists focus on confidentiality, integrity, and availability of current cryptographic controls. A quantum readiness checklist measures whether those controls remain valid under the threat of cryptographically-relevant quantum computers, including harvest-now-decrypt-later attacks and the obsolescence of RSA, ECC, and DH.

Which regulations require a quantum readiness checklist?

NSM-10 requires US federal agencies to maintain a cryptographic inventory and migration plan. NIST IR 8547 sets 2030–2035 deprecation timelines. CNSSP-15, BSI TR-02102, and ANSSI guidance impose parallel requirements. This checklist maps to all five frameworks.

How long does it take to complete?

A first-pass assessment by a CISO or security architect typically takes 45–60 minutes. A full audit with evidence collection takes 4–8 weeks. Organizations scoring below 60% should commission a formal Q-Risk Assessment.

Cookie Preferences

We use cookies to ensure our website functions properly and to improve your experience. Essential cookies are always active. You can choose to enable other categories below. Learn more

Self-Assessment · QCI-QS1 Aligned

Quantum Readiness Checklist: 28-Point Post-Quantum Audit

A structured, auditable checklist mapped to NIST IR 8547, NSM-10, and the QCI-QS1 standard. Use it for board reporting, vendor due diligence, and pre-audit preparation.

Take the Full Q-Risk Assessment Book a Readiness Review

Your live readiness score

0 / 29 · 0%

Quantum-Negligent

Critical exposure. Board attestation is not defensible. Commission a formal Q-Risk Assessment.

1. Governance & Accountability

Establish board-level ownership of post-quantum risk before any technical work begins.

0 / 5

Named executive sponsor accountable for PQC migration (CIO, CISO, or CTO)

QCI-QS1 §4.2

Quantum risk added to the enterprise risk register with a documented owner

QCI-QS1 §4.3

Board-level briefing on quantum risk delivered within the last 12 months

QCI-QS1 §8.1

Annual PQC budget line item approved (separate from generic security spend)

QCI-QS1 §4.4

Written PQC policy aligned to NIST IR 8547 and NSM-10 timelines

QCI-QS1 §4.5

2. Cryptographic Inventory (CBOM)

You cannot migrate what you cannot see. A complete CBOM is a hard ceiling on the Q-Risk Score.

0 / 5

Cryptographic Bill of Materials (CBOM) covers ≥90% of production systems

QCI-QS1 §5.1

Inventory captures algorithm, key length, certificate authority, and protocol per asset

QCI-QS1 §5.2

RSA, ECC, DH, and DSA usage flagged as quantum-vulnerable

QCI-QS1 §5.3

Inventory updated at least quarterly and tied to CMDB / asset management

QCI-QS1 §5.4

Vendor and SaaS cryptographic dependencies catalogued (not just internal systems)

QCI-QS1 §7.2

3. Crypto Agility

The operational capacity to swap algorithms without rebuilding infrastructure.

0 / 5

Certificate lifecycle is automated (ACME, cert-manager, or equivalent)

QCI-QS1 §5.5

TLS cipher suites are centrally configurable, not hard-coded in applications

QCI-QS1 §5.6

Documented rollback procedure for cryptographic changes (tested in last 12 months)

QCI-QS1 §5.7

Hybrid classical + PQC mode supported in at least one production protocol

QCI-QS1 §5.8

Hardware Security Modules (HSMs) firmware-upgradable to ML-KEM / ML-DSA

QCI-QS1 §5.9

4. Technical Preparedness

Alignment with NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).

0 / 5

Pilot deployment of ML-KEM or ML-DSA in a non-production environment

QCI-QS1 §6.1

Internal CA roadmap published for PQC certificate issuance

QCI-QS1 §6.2

Long-lived data (>10 years sensitivity) identified for HNDL exposure

QCI-QS1 §6.3

VPN, SSH, and code-signing migration paths documented

QCI-QS1 §6.4

Performance impact testing completed for at least one PQC algorithm

QCI-QS1 §6.5

5. Vendor & Supply Chain Oversight

Third-party cryptography is your cryptography. Contracts must enforce migration timelines.

0 / 4

Top-25 vendor PQC roadmaps collected and reviewed annually

QCI-QS1 §7.1

Standard contract clause requires PQC readiness disclosure

QCI-QS1 §7.3

Cloud provider PQC posture documented (AWS, Azure, GCP, etc.)

QCI-QS1 §7.4

Critical SaaS providers have committed PQC migration dates

QCI-QS1 §7.5

6. Operational Resilience & Incident Response

Plan for the day a cryptographic primitive is broken — not the day after.

0 / 5

Incident response runbook includes a 'broken algorithm' scenario

QCI-QS1 §8.2

Quantum crisis tabletop exercise conducted in the last 12 months

QCI-QS1 §8.3

Communications plan for disclosing a cryptographic compromise to regulators

QCI-QS1 §8.4

Cyber insurance reviewed for quantum / cryptographic failure exclusions

QCI-QS1 §8.5

Board attestation of PQC posture signed within the last 12 months

QCI-QS1 §8.6

Interpreting Your Score

80–100%

Quantum-Ready

Defensible board attestation. Continue quarterly CBOM refresh and vendor enforcement.

60–79%

Quantum-Aware

Foundational controls exist. Close CBOM and crypto-agility gaps before the next audit cycle.

40–59%

Quantum-Exposed

Material exposure. Likely audit finding under NIST IR 8547 alignment in 2025–2026.

0–39%

Quantum-Negligent

Board attestation is not defensible. Commission a formal Q-Risk Assessment immediately.

Convert this Checklist into a Board-Ready Q-Risk Report

The full Q-Risk Assessment produces a benchmarked score, a 36-month roadmap, and a board-ready attestation document mapped to QCI-QS1 Clauses 4–8.

Take the Q-Risk Assessment Read the Methodology

Continue Your Readiness Path

Q-Risk Score Methodology

The formula and hard ceilings behind every score.

Cryptographic Inventory (CBOM)

How to build the inventory that anchors every checklist item.

NIST PQC Migration Roadmap

The 2025–2035 timeline your checklist must align to.

Crypto Agility

Why agility is a hard-ceiling dimension in QCI-QS1.

QCI-QS1 Standard

The full clause-by-clause standard this checklist maps to.

Harvest Now, Decrypt Later

The threat model that makes this checklist urgent.