Is Your Encryption Ready for Quantum Computers? A 10-Question Readiness Self-Assessment

The answer, up front

Answer 10 yes-or-no questions about ownership, inventory, data shelf life, vendors, TLS 1.3, crypto agility, and pilots. Score one point per yes. Eight or more means you are in the execution stage, four to seven means planning and pilots, and three or fewer means start discovery now. Each question cites the public guidance behind it.

Last verified: Sep. 30, 2026. The score bands are an ArcQubit rubric, not part of any standard.

How to score

Give one point for each "yes." Answer "no" if the answer is "partly" or "I think so." A partial answer means the work is not done.

The 10 questions

1. Do you have a named owner for post-quantum migration?

Executive Order 14412 requires each agency head to identify a post-quantum migration lead within 30 days of the order (Section 4(a)) 1. Canada's roadmap names a PQC Migration Executive Lead and a PQC Migration Technical Lead 2. A named owner turns a policy topic into a project. Yes looks like: one person with budget authority and a written mandate.

2. Do you have an inventory of where public-key cryptography is used?

Every government roadmap starts with discovery. OMB puts inventory in its first phase 3, the NCSC expects a full discovery exercise by 2028 4, and Canada makes identification a core phase 2. Yes looks like: a list of systems, algorithms, and owners, even if incomplete. Canada advises starting with an initial, incomplete inventory 2. See How to Build a Cryptographic Inventory.

3. Is that inventory automated and kept current?

OMB describes automated discovery, using software composition analysis, application security testing, and network scanners, that feeds a cryptographic bill of materials 3. Yes looks like: scheduled scans, plus a rule that new systems enter the inventory before launch.

4. Do you know which data must stay confidential beyond 2030, or for 10 years or more?

OMB tells agencies to prioritize systems holding data that will stay mission-sensitive in 2030 3. The 10-year threshold is our rule of thumb. Yes looks like: a list of data sets with a retention and confidentiality period for each. See Harvest Now, Decrypt Later.

5. Have you ranked systems by risk and exposure to harvest-now, decrypt-later collection?

Canada tells departments to treat systems that protect confidentiality in transit over public network zones as high priority 2. Yes looks like: a ranked list that shows why each system sits where it does.

6. Have you asked your top vendors and cloud providers for post-quantum roadmaps?

The NCSC advises telling suppliers what you need and considering a statement of intent for your migration 4. OMB requires agency plans to include a third-party coordination plan 3. Yes looks like: written answers from your top 10 suppliers, with dates.

7. Do your procurement clauses require post-quantum support and crypto agility?

Canada recommends contract clauses that ensure vendors will support post-quantum cryptography that follows Cyber Centre recommendations 2. OMB assigns program offices to include readiness and agility in vendor requirements 3. Yes looks like: standard clauses in every new contract and renewal.

8. Does every system that needs it support TLS 1.3?

OMB requires agencies to support TLS 1.3 by Jan. 2, 2030 3. Post-quantum hybrid key exchange in TLS builds on TLS 1.3 5. Yes looks like: a list of endpoints that cannot yet negotiate TLS 1.3, each with a fix date.

9. Can you change algorithms through configuration, without a code release?

OMB says algorithm and hybrid-scheme choices belong in external configuration, not compiled code 3. Yes looks like: you can name a system, change its algorithm setting, and test the result in a staging environment. See Crypto-Agility.

10. Have you piloted hybrid key exchange or ML-KEM anywhere?

OMB sets pilots in 2027 to 2028 3. RFC 10024 defines the hybrid groups for TLS 1.3 5. Yes looks like: a written pilot result that covers latency, handshake size, and rollback. See Hybrid vs. Pure Post-Quantum Key Exchange.

Your next step by score

• 0 to 3: Name an owner (question 1), then start an initial inventory (question 2). Read the Migration Roadmap.
• 4 to 7: Automate the inventory (question 3), rank systems (question 5), and choose one low-risk pilot (question 10).
• 8 to 10: Move to the migration phase, then verify. Check dates in Global Mandates and Deadlines.

What this means for executives and the board

You do not need to answer the technical questions yourself. You need to know who answers them and whether the answers are written down.

Questions 1, 6, and 7 are management questions. They ask who owns the work, what your suppliers have told you, and what your contracts require. Your CEO or COO settles ownership. Your procurement lead and general counsel settle the clauses. Your CFO decides whether the work has a budget line. Questions 2, 3, 5, 8, 9, and 10 are technical, and your CISO or CTO owns them.

Question 4 is a business question that IT cannot answer alone. Your data owners, legal team, and records managers know how long each data set must stay confidential. Ask them. Your security team can then rank systems by that answer.

Three points help frame the risk for a board:

• Ownership comes first. EO 14412 requires a migration lead at each federal agency, and Canada's roadmap names an executive lead and a technical lead [1]2. Boards should expect the same clarity.
• Discovery is the first phase everywhere. OMB, the NCSC, and Canada all begin with finding what you use 2, 3, 4. An organization without an inventory has not started.
• Partial answers count as no. The rubric asks for evidence, not confidence. That rule protects you from a comfortable score that hides gaps.

Questions to ask your team this week

Bring the ten questions to your next security review. Then ask these follow-ups. ArcQubit guidance:

1. Who scored this assessment, and who checked their answers?
2. Which "yes" answers rest on a document, and which rest on someone's memory?
3. Which systems hold data that must stay confidential beyond 2030?
4. Which of our top suppliers have replied in writing about their post-quantum plans?
5. Which endpoints cannot yet negotiate TLS 1.3, and when will each one be fixed?
6. Which of our systems could change an algorithm through configuration, and which need a code release?
7. Which single low-risk system will we pilot first, and who signs off on the result?
8. When did we last update the inventory, and what triggers the next update?

Write down the answers. A vague answer to any of these tells you which question to score as "no."

Common mistakes and how to avoid them

ArcQubit guidance. Self-assessments tend to fail in the same ways.

• Rounding up. Teams score a "partly" as a "yes." The rubric says otherwise. Score honestly, and you will get a plan you can use.
• Letting one team answer alone. Security cannot answer questions 4, 6, and 7 without legal, procurement, and data owners. Put those people in the room.
• Treating the score as a grade. The bands are an ArcQubit rubric, not part of any standard. Use the score to pick your next step, not to report success.
• Skipping the inventory. Some teams jump to a pilot because a pilot feels like progress. Canada advises starting with an initial, incomplete inventory rather than waiting for a perfect one 2. Start small, but start there.
• Scoring once and filing it. Repeat the assessment on a set schedule. Your score should rise as the work moves forward.

A worked example

Consider a generic mid-sized organization that provides online services to customers. Its security team sits down with legal, procurement, and two data owners and runs the assessment.

The group answers yes to question 8, because its main web endpoints already support TLS 1.3. It answers yes to question 6, because procurement has already sent supplier letters and filed the replies. It answers no to the other eight. Someone thinks an inventory exists, but nobody can find it, so question 2 scores no. The total is 2, which is the discovery stage.

The next step follows from the rubric. The CEO names an owner with a written mandate. The owner starts an initial, incomplete inventory. Legal and the data owners list the data sets that must stay confidential for 10 years or more, using the rule of thumb from question 4. The team reruns the assessment after the inventory exists. The score has no claim to precision. It shows the team where to start and gives the board a baseline to compare against.

Owner and timeline table

This table shows who should act on each stage. It is ArcQubit guidance, not part of any standard or government roadmap.

How to brief your board

Use this short script. ArcQubit guidance:

1. "We scored ourselves on ten questions drawn from OMB, NCSC, and Canadian Cyber Centre guidance 2, 3, 4. Our score is X, which puts us in the stage stage of an ArcQubit rubric."
2. "The lowest-scoring questions are A, B, and C. Each has a named owner and a date."
3. "We need a decision on owner, budget, or contract clause by date."
4. "We will rescore next quarter and show the change."

Keep the message short. Boards need a baseline, an owner, and a date, not a lecture on cryptography.

How ArcQubit approaches it

QuCode runs read-only scans and ingests the results from scanners you already own. It produces a ranked Quantum Exposure Report with an owner for every finding, so you can answer questions 2, 3, and 5 with evidence. We sell it directly as a fixed-scope discovery. QuTrust then turns the findings into a living migration roadmap and keeps the evidence current.