The answer, up front
A one-time quantum readiness project looks efficient and usually is not. Four costs stay hidden until the project ends: restart costs, blind spots, fragmented strategy, and compliance scrambles. ArcQubit guidance for CFOs and COOs is to fund readiness as a sustained operating capability, because its returns accumulate while a project's value decays.
Last verified: Sep. 30, 2026.
The project mindset trap
Most organizations run a readiness effort like a compliance audit. They assemble a team, check the boxes, declare victory, and disband. A defined scope and a clear end date make the budget easy to approve and easy to reallocate.
Readiness does not hold still, though. Standards drafts change, mandates arrive, vendors ship new software, and teams deploy new systems. The organization that "finished" its project finds itself starting over.
Four hidden costs
This section is ArcQubit guidance based on our reasoning. We do not attach dollar figures because the amounts depend on your environment.
| Hidden cost | What happens | Where it shows up |
|---|---|---|
| Restart | Institutional knowledge disperses when the team disbands | Paying again to rebuild what you already built |
| Blind spots | A snapshot misses everything that changes after the scan | Exposure you cannot see or report |
| Fragmented strategy | Security and adoption efforts run separately | Duplicated work and no answer for the board |
| Compliance scrambles | Evidence must be rebuilt under deadline pressure | Shortcuts, overtime, and added risk |
Restart costs. Every readiness effort builds knowledge: where cryptography lives, how your risk profile compares with benchmarks, and which priorities matter. Consultants move to other clients and staff rotate. The next mandate then forces you to pay for the same discovery twice.
Blind spots. A project records your exposure on the day of the scan. It cannot show what changed after a vendor updated an SDK, a new system launched, or a third-party integration added dependencies. Government guidance points the same way: OMB calls a dynamic, continuously updated cryptographic inventory the foundation of a migration plan 2.
Fragmented strategy. The CISO sponsors a migration. The CTO sponsors a quantum exploration pilot. Neither shares data with the other. When the board asks how the efforts connect, nobody has a coherent answer.
Compliance scrambles. Teams that ran a project years ago must reconstruct what they knew, often under time pressure. That is where shortcuts and risk creep in.
What the deadlines mean for your budget
The dates below come from primary sources. They show that readiness work spans years, not one budget cycle.
| Source | Date | What it sets |
|---|---|---|
| Executive Order 14412 | Dec. 31, 2030 | Key-establishment objective in U.S. agency plans 1 |
| Executive Order 14412 | Dec. 31, 2031 | Digital-signature objective in U.S. agency plans 1 |
| Executive Order 14412 | Dec. 31, 2030 | Contractor compliance date under a proposed FAR rule, which the order directs within 180 days 1 |
| NIST IR 8547 (draft) | After 2030, after 2035 | Proposed deprecation of 112-bit-strength algorithms, then disallowance of all quantum-vulnerable algorithms 3 |
| UK NCSC | 2028, 2031, 2035 | Discovery, priority migration, and completion milestones 4 |
NIST IR 8547 is still an initial public draft as of Sep. 30, 2026, so treat its dates as proposed. The executive order and OMB memo apply to federal agencies, and the memo excludes national security systems 2. Contractors and suppliers feel these dates through procurement. Your own sector may add its own.
Three or more planning cycles fall inside those windows. A project-based budget would pay for discovery, rebuild it, and rebuild it again.
Readiness as an operating capability
This cycle is ArcQubit guidance. Sustained readiness runs on four steps that repeat.
- Observe. Keep continuous visibility into your cryptography, including code that lives in vendor and third-party software. See Cryptographic Inventory and CBOM for how to build and maintain that record.
- Orient. Turn raw findings into context. Map them against compliance requirements, score exposure, and judge feasibility for specific use cases.
- Decide. Update roadmaps from current evidence. The goal is not one big decision but the habit of making good decisions as facts change.
- Act. Execute, then feed the results back into observation. New data sharpens the next orientation.
Organizations that build this capability adapt when requirements change. They do not reconstruct. Adaptation is also the practical meaning of Crypto-Agility: you can change algorithms because you know where they live.
What this means for executives and the board
ArcQubit guidance. Ask finance and operations to model readiness over five years, not one. Compare a sustained program with repeated projects across all four hidden costs. Keep the comparison honest: a single project may cost less in year one, and the gap may close only after the first restart.
Give the board one question to track: how current is our view of cryptographic exposure, and when was it last refreshed? An answer measured in years is a blind spot.
Decisions to make in the next 90 days
- Name one accountable owner who survives the end of any project.
- Move the cryptographic inventory from a deliverable to a recurring process with a refresh schedule.
- Put security and adoption work under one shared set of data and one roadmap.
- Write readiness evidence into your normal audit and reporting cycle.
- Check which deadlines reach you directly or through customers. See Global Mandates and Deadlines.
Questions to ask your team this week
- When did we last refresh our view of cryptography in vendor and third-party code?
- If our readiness lead left tomorrow, what knowledge would leave with them?
- Do our security and quantum adoption teams share data?
- Which mandate would force us to rebuild evidence fastest?
For a related view of what "ready" means, read Quantum Readiness vs. Quantum Maturity.
Common mistakes
- Declaring victory at the status report. A completed project is a snapshot, not a capability.
- Disbanding the team. Institutional knowledge leaves with it.
- Funding security and adoption separately. Each side holds insight the other needs.
- Comparing year-one cost only. That view ignores restarts and exposure during gaps.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the guidance above.
ArcQubit builds for sustained capability. QuCode is enterprise discovery and inventory, sold directly by ArcQubit, and it can rescan as new cryptography is introduced. QuTrust is the migration system of record, a living roadmap with continuous analysis, prioritization, and reporting. The AI & Quantum Consulting team provides expert-led advisory for the adoption side of readiness.