The answer, up front
Quantum readiness is a continuum with four positions: compliance, security posture, strategic positioning, and competitive advantage. Most organizations start at compliance because regulators and auditors ask for it. ArcQubit guidance is to treat compliance as the foundation and to fund the capability that continues after the migration project ends.
Last verified: Sep. 30, 2026.
Why compliance is the right place to start
Compliance is a legitimate first step, and the pressure behind it is real. NIST finalized its first three post-quantum encryption standards, FIPS 203, 204 and 205, on Aug. 13, 2024 1. NSM-10 set a goal of mitigating as much quantum risk as is feasible by 2035 and directed federal agencies to inventory vulnerable systems 2. OMB's memorandum M-26-15 turns that direction into phased agency work, starting with inventory 3.
Other governments publish timelines too. The UK NCSC expects discovery and planning by 2028, priority migration by 2031, and completion by 2035 4. For a full comparison, read Global Mandates and Deadlines.
These dates are the floor. They tell you what to finish. They do not tell you what to build next.
The compliance ceiling
The risk in a compliance-first approach is what happens after the first response. A team migrates the systems it was told to migrate, produces evidence, and declares the work done. Budget, attention, and staff then move elsewhere.
That outcome meets the mandate. It also leaves the organization with no standing capability and no view of where quantum technology could help the business. ArcQubit calls this the compliance ceiling.
The four positions on the continuum
This is ArcQubit's framework and guidance, not an industry standard.
| Position | What the organization does | What it gains |
|---|---|---|
| 1. Compliance | Inventories cryptography, ranks systems by risk, and migrates to NIST-approved algorithms | Meets mandates and audit requests |
| 2. Security posture | Builds crypto agility and treats migration as an ongoing capability | Faster response when standards change |
| 3. Strategic positioning | Identifies quantum computing, sensing, and communications use cases and builds skills through pilots and partnerships | Readiness to capture value, not only avoid loss |
| 4. Competitive advantage | Uses quantum technology for operational gains in areas such as optimization, simulation, and materials | Returns from the quantum era as it arrives |
Position one is often urgent and larger than first estimated, especially with legacy infrastructure. Position two depends on the agility work described in Crypto-Agility. Positions three and four are where strategy replaces checklists.
Most organizations sit at position one or two today. That is normal. The question is which way they are moving.
What this means for executives and the board
ArcQubit guidance for leaders:
- Fund beyond the deadline. Ask what happens to the team, the executive sponsor, and the budget when migration ends. If all three disappear, you are optimizing for compliance alone.
- Separate the two exposures. Security risk and strategic risk need different owners and different measures.
- Ask for a position, not a percentage. "Where are we on the continuum?" gives the board more to act on than "how quantum safe are we?"
Decisions to make in the next 90 days
- Name one executive accountable for both migration and quantum strategy.
- Confirm which mandates and contractual timelines apply to you.
- Agree on what capability remains after migration, such as an agility practice or a small quantum pilot group.
- Pick one or two business areas where quantum technology might eventually matter, and assign someone to watch them.
Questions to ask your team this week
- Which position on the continuum do we occupy, and what evidence supports that answer?
- Which systems have we inventoried, and who owns the rest?
- Who in the business has looked at quantum use cases, and what did they find?
- What would we lose if the migration team disbanded next year?
A worked generic example
Consider a mid-sized services company that begins a migration because a regulator and two large customers ask about it. In year one, it inventories cryptography and fixes the highest-risk systems. That is position one.
In year two, it keeps the team, adds agility requirements to procurement, and tracks supplier roadmaps. That is position two.
In year three, it funds a small pilot group to test where quantum optimization could help logistics planning. That is position three. The company has not yet reached position four, but it has the people and relationships to move when a use case proves out.
Common mistakes
- Treating the last mandate date as the end of the program. Standards and timelines keep evolving.
- Running migration and strategy as unrelated projects. Shared inventory, skills, and vendor relationships serve both.
- Waiting for a perfect roadmap. Start at your current position and move one step.
- Assuming competitive advantage is only for large firms. Early learning costs little compared with late, rushed adoption.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the guidance above.
ArcQubit frames this as Dual Quantum Technology Risk Exposure: the security risk to today's cryptography and the strategic risk of adopting quantum technology too slowly. QuCode, sold directly as enterprise discovery, inventories quantum-vulnerable cryptography, and QuTrust keeps the migration on a living roadmap with evidence for boards and auditors. The AI & Quantum Consulting team supports the strategic side. For more, read Quantum Readiness vs. Quantum Maturity and A Unified Quantum Readiness Strategy.