Think Earlier.
The quantum problem starts before the quantum computer arrives.
What is Q-Risk Score?
Q-Risk Score is a measurable, auditable metric ranging from 0-100 that quantifies an organization's quantum vulnerability and readiness posture. It provides boards, investors, and regulators with a standardized way to assess and communicate quantum preparedness.
The Short Answer
Q-Risk Score is to quantum risk what a credit score is to financial risk, a single, understandable number that summarizes complex risk factors into actionable intelligence for decision-makers.
Why Does Q-Risk Score Exist?
As quantum computing advances toward practical cryptographic capabilities, organizations face a new category of risk: the potential for quantum computers to break the encryption protecting their most sensitive data and systems. But how do you measure preparation for a threat that hasn't fully materialized?
Q-Risk Score was developed to solve this problem. It provides a standardized framework for assessing, communicating, and improving quantum readiness, designed specifically for governance audiences who need clear metrics, not technical jargon.
The Five Dimensions of Q-Risk
QCI-QS1 v2.3 defines five weighted pillars:
Ownership, decisions and oversight
Validated critical-system and critical-flow inventory
Long-lived data and trust exposure
Migration evidence and tested algorithm replacement
Critical supplier responses and attestations
How is Q-Risk Score Calculated?
Each pillar receives an evidenced integer level from 0 to 5. The raw score is 4×P1 + 4×P2 + 4×P3 + 5×P4 + 3×P5. The final score is capped by any failed G60 inventory, G70 supplier, or G80 agility gate. The free questionnaire does not verify these requirements or produce a formal QCI-QS1 score.
Score Interpretation
- 0–19 Exposed: Limited evidence of an established readiness program.
- 20–39 Behind: Initial awareness or defined elements with substantial gaps.
- 40–59 Mobilizing: Evidence of coordinated preparation and early execution.
- 60–80 Advancing: Progress with remaining gate, coverage, or execution limitations.
- 81–100 Defensible readiness: Higher evidence-supported maturity with all score gates passed; not a security or compliance guarantee.
Bands apply only to evidenced final scores, not to the self-reported screening estimate.
Who Uses Q-Risk Score?
Organizations
Quantify baseline risk, prioritize investments, demonstrate preparedness to stakeholders
Boards & Investors
Governance reporting, due diligence, portfolio risk assessment
Regulators
Evidence for supervisory discussion; not a compliance determination
How the scoring gates work
The raw score is 4×L1 + 4×L2 + 4×L3 + 5×L4 + 3×L5, where L1 to L5 are the evidenced levels for the five pillars. The final score is the lower of the raw score and every cap triggered by a failed gate. Results are integers and are not rounded (QCI-6.1-02). A failed gate applies regardless of the other gates (QCI-6.3-01).
- G60 inventory gate: cap of 60 unless validated coverage is at least 95% for both critical systems and critical flows, with no unresolved material population discrepancy.
- G70 supplier gate: cap of 70 unless every critical supplier has a current, adequate response and authorized attestation. An approved operating exception is not a substitute.
- G80 agility gate: cap of 80 unless at least one critical trust pathway passed a representative end-to-end crypto-agility test within the previous 12 months and after any invalidating material change.
Hypothetical example. Pillar levels 5, 3, 5, 5, 5 give a raw score of 92. If G60 fails, the final score is 60, in the Advancing band. This matches a worked case in the standard. A score of exactly 60, 70 or 80 does not mean the gate above it passed (QCI-6.5-01).
The five pillars: Pillar 1: Governance and accountability, Pillar 2: Crypto visibility and QASI completeness, Pillar 3: Data longevity and exposure management, Pillar 4: PQC migration readiness and crypto agility and Pillar 5: Third-party readiness. The full method, including level criteria, is on the methodology page.
Self-reported screening versus evidenced assessment
The free screening uses your own answers. It does not check evidence, apply the gates against records, or produce a QCI-QS1 score or band. An evidenced score awards each level only where every criterion is supported, and records pillar levels, gate results and reasons, scope, conformance status and assessment date (QCI-6.1-01, QCI-6.1-02). Any claim must say whether it comes from self-assessment or independent assessment (QCI-1.2-03).
The score measures evidence-supported readiness maturity. It is not a probability of compromise, a guarantee of quantum resistance, a certificate of security or a determination of regulatory compliance (QCI-1.2-04).