Signature · Institutional → Quantum Core Institute
A self-assessment against QCI-QS1. Score your organization across the five Q-Risk pillars and get a number a board can act on — held honest by the same ceiling gates a QCI assessor applies, so the score reflects evidence, not optimism.
Standard: QCI-QS1 v2.2 · Q-Risk Score (0–100) · QRAF governance · QASI inventory
Score each pillar on the 0–5 maturity scale
Plans may exist on paper. Execution is weak or absent.
ticket #, document path, or export. Level 5 requires externally validated evidence; self-attestation doesn't qualify. When in doubt, score down.FAQ
Quantum readiness is not a binary state. It's a maturity continuum across several independent dimensions, and most organizations are at very different stages on each.
The five dimensions the score assesses:
Cryptographic inventory: Do you know which systems, keys, and data stores use cryptography that quantum computers will eventually break (RSA, ECC, Diffie-Hellman)? Most organizations have never done this audit. Without an inventory, migration is impossible.
Algorithm migration: Have you moved or begun moving to NIST post-quantum standards? CRYSTALS-Kyber for key encapsulation, CRYSTALS-Dilithium and FALCON for digital signatures were standardized in 2024. These are the target.
Key management infrastructure: Can your HSMs, PKI, and certificate lifecycle tools handle post-quantum algorithms? Many cannot yet — hardware and software upgrades are required, not just configuration changes.
Supply chain and vendor assessment: Your quantum readiness is bounded by your least-ready critical vendor. If your cloud provider, payment processor, or financial infrastructure runs on classical cryptography with no PQC roadmap, your perimeter exposure remains even if your internal systems are migrated.
Governance and timeline: Does your CISO or CTO have a documented quantum risk policy? Is there a board-level understanding of the timeline and budget implications? Organizations that treat this as purely a technical problem will be caught without budget when hardware migration timelines compress.
Why the score matters now:
NIST finalized PQC standards in 2024. CISA has issued guidance recommending migration roadmaps begin immediately for critical infrastructure. For organizations holding Bitcoin or operating in financial services, quantum readiness is becoming a regulatory and fiduciary question, not just a technical one.
Methodology
Self-assessment across five Q-Risk pillars producing a 0–100 composite, with ceiling gates that cap the score when evidence is absent.
Paper plans without evidence cannot lift the ceiling. Most organizations baseline in Behind — a credible plan to reach Advancing is the realistic first objective.