Think Earlier.
The quantum problem starts before the quantum computer arrives.
A structured, auditable checklist mapped to NIST IR 8547, NSM-10, and the QCI-QS1 standard. Use it for board reporting, vendor due diligence, and pre-audit preparation.
Establish board-level ownership of post-quantum risk before any technical work begins.
You cannot migrate what you cannot see. A complete CBOM is a hard ceiling on the Q-Risk Score.
The operational capacity to swap algorithms without rebuilding infrastructure.
Alignment with NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).
Third-party cryptography is your cryptography. Contracts must enforce migration timelines.
Plan for the day a cryptographic primitive is broken, not the day after.
Defensible board attestation. Continue quarterly CBOM refresh and vendor enforcement.
Foundational controls exist. Close CBOM and crypto-agility gaps before the next audit cycle.
Material exposure. Likely audit finding under NIST IR 8547 alignment in 2025–2026.
Board attestation is not defensible. Commission a formal Q-Risk Assessment immediately.
A structured self-assessment of how prepared an organization is to migrate to post-quantum cryptography. This one has 29 control points in six areas: governance and accountability, cryptographic inventory (CBOM), crypto agility, technical preparedness, vendor and supply-chain oversight, and operational resilience. Each item cites the QCI-QS1 clause it comes from.
Generic security checklists focus on confidentiality, integrity, and availability of current cryptographic controls. A quantum readiness checklist measures whether those controls remain valid under the threat of cryptographically-relevant quantum computers, including harvest-now-decrypt-later attacks and the obsolescence of RSA, ECC, and DH.
None requires this particular checklist. It helps evidence expectations that do exist. NSM-10, OMB M-23-02 and OMB M-26-15 require US federal agencies to inventory their cryptography and plan the migration, and Executive Order 14412 sets 2030 and 2031 deadlines for high-value and high-impact federal systems. NIST IR 8547, still a draft, proposes deprecating quantum-vulnerable algorithms after 2030 and disallowing them after 2035. In Europe, the EU coordinated PQC roadmap and the UK NCSC migration timelines set similar milestones. The Regulatory Radar tracks each one with its current status.
A first pass by a CISO or security architect typically takes 45 to 60 minutes. Collecting the evidence behind each item takes longer and depends on the size of the estate. The checklist is a self-assessment: a formal Q-Risk Score needs that evidence reviewed under QCI-QS1 Clause 6.
The full Q-Risk Assessment produces a benchmarked score, a 36-month roadmap, and a board-ready attestation document mapped to QCI-QS1 Clauses 4–8.
The formula and hard ceilings behind every score.
How to build the inventory that anchors every checklist item.
The 2025–2035 timeline your checklist must align to.
Why agility is a hard-ceiling dimension in QCI-QS1.
The full clause-by-clause standard this checklist maps to.
The threat model that makes this checklist urgent.