Think Earlier.
Data can outlive its encryption. The score tells you which exposure is already late.
The Q-Risk Score
A measurable, auditable metric that quantifies your organization's quantum vulnerability and readiness posture
Other providers offer awareness training. We deliver measurable Q-Risk posture: the only governance-ready quantum risk metric designed for boards, investors, and regulators.
Think earlier. Act when the evidence says to act.
Q-Risk Self-Assessment
Answer 26 questions for a self-reported screening estimate across the five QCI-QS1 v2.3 pillars. A formal score requires evidence review.
Quantum Readiness Tools
Work through the assessment, simulation, and roadmap tools in sequence to build your due diligence record
Q-Risk Screening
Establish Your Baseline
Answer 26 questions for a self-reported screening estimate across the five QCI-QS1 v2.3 pillars. The result does not apply the standard's evidence gates or constitute an independent assessment.
What You'll Get
- Self-reported screening estimate across five QCI-QS1 v2.3 pillars
- Pillar breakdown based on your answers
- Priority areas for evidence review
- Recommendations based on the answers provided
PQC Migration Cost Drivers
See What Will Drive the Effort
Nine questions about your organization show which factors will drive the effort of moving to post-quantum cryptography, what you can't size yet, what is already late, and where to start. A planning worksheet: it produces no dollar figure.
What You'll Get
- Seven cost drivers rated High, Medium or Low, each with its rule
- What you can't size yet, and how to find out
- What can wait and what is already late
- A suggested first step and a downloadable worksheet for your board
Board Question Simulation
Test Under Pressure
Experience a realistic quantum crisis scenario designed by cybersecurity experts and quantum computing researchers. This immersive simulation places you in a high-pressure environment where quantum computing developments threaten your organization's security, operations, or competitive position.
What You'll Get
- Performance scoring across decision quality, speed, and stakeholder management
- Detailed analysis of cognitive biases and decision-making patterns under pressure
- Gap analysis comparing simulated performance to industry best practices
- Personalized crisis response playbook with role-specific action items
What Q-Risk Measures
Five weighted domains defined by QCI-QS1, each one scored against the trust proof it must preserve through the transition
Pillar Weight Distribution, 100 Points Total
Score Interpretation Bands
| Score | Label | What it means |
|---|---|---|
| 0–19 | Exposed | No credible readiness posture |
| 20–39 | Behind | Plans exist, execution weak |
| 40–59 | Mobilizing | Execution started, uneven progress |
| 60–80 | Advancing | Progress with remaining gate, coverage, or execution limitations |
| 81–100 | Defensible readiness | Evidence-supported maturity with all score gates passed |
Governance and Accountability
Board oversight, policy frameworks, named roles, decision rights, escalation triggers, and executive accountability for quantum risk management.
Trust proof preserved
Who approved it.
The ability to show that someone with authority decided, on the record, and can be held to it.
Crypto Visibility and QASI Completeness
Cryptographic inventory coverage, QASI field completeness, risk flag accuracy, and visibility into quantum-vulnerable systems and dependencies.
Trust proof preserved
Whether the evidence can still be trusted.
The ability to state, with evidence, where trust is currently anchored across systems and dependencies.
Data Longevity and Exposure Management
Identification and classification of long-lived data assets, HNDL exposure assessment, and data retention alignment with quantum threat timelines.
Trust proof preserved
Whether it remains confidential.
The ability to keep protected information protected for as long as its obligations run.
PQC Migration Readiness and Crypto Agility
Post-quantum cryptography migration planning, crypto-agility architecture, vendor PQC roadmap alignment, and implementation sequencing.
Trust proof preserved
Who sent it. Whether it changed.
The ability to prove authenticity and integrity through and after the algorithm transition.
Third-Party Readiness
Vendor quantum readiness attestation, supply chain cryptographic dependency mapping, and third-party risk oversight requirements.
Trust proof preserved
Whether it changed. Whether the evidence can still be trusted.
The ability to rely on trust you did not build yourself, across vendors, processors, and machine-to-machine credentials.
What Each Domain Must Keep Alive
Quantum readiness is not ultimately about replacing algorithms. It is about preserving the mechanisms your organization relies on to prove who sent it, who approved it, whether it changed, whether it remains confidential, and whether the evidence can still be trusted. Each Q-Risk domain scores one of those proofs.
Select a risk domain to highlight the trust proofs it must preserve.
Governance and Accountability
The ability to show that someone with authority decided, on the record, and can be held to it.
Trust proofs this domain must preserve
- Who sent it.
- Who approved it.Attributable authority, a decision on the record, tied to someone who can be held to it.
- Whether it changed.
- Whether it remains confidential.
- Whether the evidence can still be trusted.
If this proof fails
Decisions cannot be attributed, so no migration choice is defensible after the fact.
| Risk domain | Trust proof it preserves | What breaks if it fails |
|---|---|---|
Governance and Accountability | Who approved it. | Decisions cannot be attributed, so no migration choice is defensible after the fact. |
Crypto Visibility and QASI Completeness | Whether the evidence can still be trusted. | Any assurance about cryptographic posture is assertion, not evidence. |
Data Longevity and Exposure Management | Whether it remains confidential. | Data harvested today is read later, and the confidentiality promise is retroactively broken. |
PQC Migration Readiness and Crypto Agility | Who sent it. Whether it changed. | Signatures, certificates, and credentials stop proving anything, and identity is the exposure where waiting is already late. |
Third-Party Readiness | Whether it changed. Whether the evidence can still be trusted. | Your posture is only as durable as the weakest cryptographic dependency you do not control. |
This is why the score exists: not as a PQC checklist, but as a measure of whether institutional trust survives the cryptographic transition. Think earlier. Act when the evidence says to act. Read QCI-QS1 for the clause-level requirements behind each domain.
How Q-Risk Assessment Works
A rigorous, standardized process that delivers actionable results
Discovery Assessment
Comprehensive data gathering across cryptographic inventory, governance structures, and strategic priorities.
Gap Analysis
Mapping current state against QCI-QS1 v2.3 with evidenced pillar scoring per Clause 6.
Score Calculation
Evidenced integer levels across five pillars, the fixed Core formula, and G60/G70/G80 gate determinations.
Roadmap Development
90-day prioritized action plan with milestones, accountability metrics, and governance integration.
Value for Every Stakeholder
Q-Risk Score delivers targeted value for each audience that matters
For Organizations
Strategic Clarity
- Quantified baseline for quantum risk exposure
- Prioritized roadmap based on measurable gaps
- Competitive advantage through demonstrated preparedness
- Budget justification with auditable metrics
For Boards
Fiduciary Confidence
- Governance-ready reporting framework
- Clear oversight metrics and dashboards
- Demonstrable due diligence for quantum risk
- Defensible position for shareholder inquiries
For Investors
Due Diligence Assurance
- Standardized assessment across portfolio companies
- Risk-adjusted valuation insights
- M&A quantum due diligence framework
- Portfolio quantum exposure benchmarking
For Regulators
Compliance Alignment
- Auditable quantum readiness documentation
- Standards-based assessment methodology
- Progress tracking and milestone verification
- Cross-industry benchmark comparisons
What You Receive
Every Q-Risk engagement delivers these governance-ready outputs
Independently assessed Q-Risk Score
Evidence-supported result with pillar levels and gate determinations
Governance Documentation
Board-ready reports, audit trails, and compliance frameworks
90-Day Roadmap
Prioritized action plan with milestones and accountability metrics
Stakeholder Briefings
Presentation decks for boards, investors, and regulators
Why the score cannot be gamed
Hard ceiling rules from QCI-QS1 that enforce comparability
Ceiling at 60: Validated inventory coverage required
G60 caps the formal score at 60 unless at least 95 percent of both critical systems and critical data flows have validated coverage, with no unresolved material population discrepancy.
Ceiling at 70: Supplier evidence required
G70 caps the formal score at 70 unless every critical supplier has a current, adequate product/deployment-specific roadmap response and authorized attestation. An operating exception is not a substitute.
Ceiling at 80: Demonstrated crypto agility required
G80 caps the formal score at 80 unless at least one critical trust pathway passes a representative end-to-end crypto-agility test within the last 12 months and after any invalidating material change.
These controls exist because a comparable score only has value if it means the same thing across every organization that uses it.
Pillar Maturity Scale
Each Q-Risk pillar is awarded a cumulative evidenced level from 0 to 5 under QCI-QS1 v2.3. The free screening does not award these levels.
| Level | Label | Reality check |
|---|---|---|
| 0 | Unaware | No owner, no inventory, no roadmap |
| 1 | Aware | Conversation exists, evidence does not |
| 2 | Defined | Roadmap exists, execution uneven |
| 3 | Implementing | Migration underway, metrics tracked |
| 4 | Managed | Crypto agility exists, vendors controlled |
| 5 | Assured | Tested, audited, repeatable, board-ready |
Compliance Framework Alignment
Q-Risk dimensions map directly to the regulatory frameworks your organization already follows
SOC 2
Q-Risk governance evidence can inform review of SOC 2 Trust Services Criteria for encryption controls
ISO 27001
P4 migration evidence can inform ISO 27001 cryptographic control reviews
HIPAA
P3 exposure evidence can identify PHI encryption dependencies
CMMC
P2 visibility evidence can identify CUI cryptographic dependencies
FedRAMP
P4 migration evidence can inform cryptographic control reviews
PCI DSS
P2 visibility evidence can inform PCI DSS cryptographic reviews
GDPR/CCPA
P1 governance decisions can inform data-protection control reviews
SWIFT CSP
P4 migration evidence can inform encryption-control reviews
DORA
Q-Risk Crypto Visibility and QASI Completeness supports DORA ICT risk management and digital operational resilience testing for EU financial entities
NIS2
Q-Risk Governance and Accountability aligns with NIS2 cybersecurity risk management measures and incident reporting obligations for essential and important entities
EU AI Act
Q-Risk PQC Migration Readiness addresses cryptographic integrity requirements for high-risk AI systems under the EU AI Act's security and accuracy mandates
eIDAS 2.0
Q-Risk Third-Party Readiness maps to eIDAS 2.0 requirements for quantum-resistant electronic signatures, seals, and trust service provider obligations
Everything You Need to Know
Get answers to common questions about Q-Risk Score and our assessment tools.
Still Have Questions?
Our quantum readiness experts are here to help guide you through the process.
Get Expert GuidanceReady to Quantify Your Quantum Risk?
Take the free screening. Your results name the next step that fits your score, or talk to us about scope.