[{"data":1,"prerenderedAt":698},["ShallowReactive",2],{"blog-\u002Fblog\u002Fquantum-readiness-assessment":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":639,"date":640,"description":641,"draft":642,"extension":643,"faqs":644,"findingsSource":7,"geo":654,"howto":7,"howtoTitle":7,"image":7,"industries":656,"keyFindings":7,"meta":658,"modified":659,"navigation":660,"path":661,"pullquote":7,"recommendations":7,"references":662,"related":678,"seo":683,"seoTitle":684,"signposts":7,"slug":685,"stats":686,"stem":689,"tags":690,"tldr":696,"__hash__":697},"blog\u002Fblog\u002Fquantum-readiness-assessment.md","Is Your Encryption Ready for Quantum Computers? A 10-Question Readiness Self-Assessment","ArcQubit Team",null,{"type":9,"value":10,"toc":612},"minimark",[11,16,20,26,30,33,89,93,98,115,119,145,149,157,161,174,178,186,190,201,205,216,220,232,236,248,252,267,271,301,305,308,311,314,317,348,352,358,385,388,392,398,433,437,440,443,446,450,457,560,564,569,602,605,609],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19],"p",{},"Answer 10 yes-or-no questions about ownership, inventory, data shelf life, vendors, TLS 1.3, crypto agility, and pilots. Score one point per yes. Eight or more means you are in the execution stage, four to seven means planning and pilots, and three or fewer means start discovery now. Each question cites the public guidance behind it.",[17,21,22],{},[23,24,25],"em",{},"Last verified: Sep. 30, 2026. The score bands are an ArcQubit rubric, not part of any standard.",[12,27,29],{"id":28},"how-to-score","How to score",[17,31,32],{},"Give one point for each \"yes.\" Answer \"no\" if the answer is \"partly\" or \"I think so.\" A partial answer means the work is not done.",[34,35,36,52],"table",{},[37,38,39],"thead",{},[40,41,42,46,49],"tr",{},[43,44,45],"th",{},"Score",[43,47,48],{},"Stage",[43,50,51],{},"What it means",[53,54,55,67,78],"tbody",{},[40,56,57,61,64],{},[58,59,60],"td",{},"0 to 3",[58,62,63],{},"Discovery",[58,65,66],{},"You lack the basic facts. Start with an owner and an inventory.",[40,68,69,72,75],{},[58,70,71],{},"4 to 7",[58,73,74],{},"Planning and pilots",[58,76,77],{},"You have a base. Close the gaps, then pilot.",[40,79,80,83,86],{},[58,81,82],{},"8 to 10",[58,84,85],{},"Execution",[58,87,88],{},"You are ready to migrate in priority order and verify results.",[12,90,92],{"id":91},"the-10-questions","The 10 questions",[94,95,97],"h3",{"id":96},"_1-do-you-have-a-named-owner-for-post-quantum-migration","1. Do you have a named owner for post-quantum migration?",[17,99,100,101,105,106,109,110,114],{},"Executive Order 14412 requires each agency head to identify a post-quantum migration lead within 30 days of the order (Section 4(a)) ",[102,103,104],"span",{},"1",". Canada's roadmap names a PQC Migration Executive Lead and a PQC Migration Technical Lead ",[102,107,108],{},"2",". A named owner turns a policy topic into a project. ",[111,112,113],"strong",{},"Yes looks like:"," one person with budget authority and a written mandate.",[94,116,118],{"id":117},"_2-do-you-have-an-inventory-of-where-public-key-cryptography-is-used","2. Do you have an inventory of where public-key cryptography is used?",[17,120,121,122,125,126,129,130,132,133,135,136,138,139,144],{},"Every government roadmap starts with discovery. OMB puts inventory in its first phase ",[102,123,124],{},"3",", the NCSC expects a full discovery exercise by 2028 ",[102,127,128],{},"4",", and Canada makes identification a core phase ",[102,131,108],{},". ",[111,134,113],{}," a list of systems, algorithms, and owners, even if incomplete. Canada advises starting with an initial, incomplete inventory ",[102,137,108],{},". See ",[140,141,143],"a",{"href":142},"\u002Fblog\u002Fcryptographic-inventory-cbom","How to Build a Cryptographic Inventory",".",[94,146,148],{"id":147},"_3-is-that-inventory-automated-and-kept-current","3. Is that inventory automated and kept current?",[17,150,151,152,132,154,156],{},"OMB describes automated discovery, using software composition analysis, application security testing, and network scanners, that feeds a cryptographic bill of materials ",[102,153,124],{},[111,155,113],{}," scheduled scans, plus a rule that new systems enter the inventory before launch.",[94,158,160],{"id":159},"_4-do-you-know-which-data-must-stay-confidential-beyond-2030-or-for-10-years-or-more","4. Do you know which data must stay confidential beyond 2030, or for 10 years or more?",[17,162,163,164,166,167,169,170,144],{},"OMB tells agencies to prioritize systems holding data that will stay mission-sensitive in 2030 ",[102,165,124],{},". The 10-year threshold is our rule of thumb. ",[111,168,113],{}," a list of data sets with a retention and confidentiality period for each. See ",[140,171,173],{"href":172},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later",[94,175,177],{"id":176},"_5-have-you-ranked-systems-by-risk-and-exposure-to-harvest-now-decrypt-later-collection","5. Have you ranked systems by risk and exposure to harvest-now, decrypt-later collection?",[17,179,180,181,132,183,185],{},"Canada tells departments to treat systems that protect confidentiality in transit over public network zones as high priority ",[102,182,108],{},[111,184,113],{}," a ranked list that shows why each system sits where it does.",[94,187,189],{"id":188},"_6-have-you-asked-your-top-vendors-and-cloud-providers-for-post-quantum-roadmaps","6. Have you asked your top vendors and cloud providers for post-quantum roadmaps?",[17,191,192,193,195,196,132,198,200],{},"The NCSC advises telling suppliers what you need and considering a statement of intent for your migration ",[102,194,128],{},". OMB requires agency plans to include a third-party coordination plan ",[102,197,124],{},[111,199,113],{}," written answers from your top 10 suppliers, with dates.",[94,202,204],{"id":203},"_7-do-your-procurement-clauses-require-post-quantum-support-and-crypto-agility","7. Do your procurement clauses require post-quantum support and crypto agility?",[17,206,207,208,210,211,132,213,215],{},"Canada recommends contract clauses that ensure vendors will support post-quantum cryptography that follows Cyber Centre recommendations ",[102,209,108],{},". OMB assigns program offices to include readiness and agility in vendor requirements ",[102,212,124],{},[111,214,113],{}," standard clauses in every new contract and renewal.",[94,217,219],{"id":218},"_8-does-every-system-that-needs-it-support-tls-13","8. Does every system that needs it support TLS 1.3?",[17,221,222,223,225,226,132,229,231],{},"OMB requires agencies to support TLS 1.3 by Jan. 2, 2030 ",[102,224,124],{},". Post-quantum hybrid key exchange in TLS builds on TLS 1.3 ",[102,227,228],{},"5",[111,230,113],{}," a list of endpoints that cannot yet negotiate TLS 1.3, each with a fix date.",[94,233,235],{"id":234},"_9-can-you-change-algorithms-through-configuration-without-a-code-release","9. Can you change algorithms through configuration, without a code release?",[17,237,238,239,132,241,243,244,144],{},"OMB says algorithm and hybrid-scheme choices belong in external configuration, not compiled code ",[102,240,124],{},[111,242,113],{}," you can name a system, change its algorithm setting, and test the result in a staging environment. See ",[140,245,247],{"href":246},"\u002Fblog\u002Fcrypto-agility","Crypto-Agility",[94,249,251],{"id":250},"_10-have-you-piloted-hybrid-key-exchange-or-ml-kem-anywhere","10. Have you piloted hybrid key exchange or ML-KEM anywhere?",[17,253,254,255,257,258,132,260,262,263,144],{},"OMB sets pilots in 2027 to 2028 ",[102,256,124],{},". RFC 10024 defines the hybrid groups for TLS 1.3 ",[102,259,228],{},[111,261,113],{}," a written pilot result that covers latency, handshake size, and rollback. See ",[140,264,266],{"href":265},"\u002Fblog\u002Fhybrid-vs-pure-post-quantum","Hybrid vs. Pure Post-Quantum Key Exchange",[12,268,270],{"id":269},"your-next-step-by-score","Your next step by score",[272,273,274,285,291],"ul",{},[275,276,277,280,281,144],"li",{},[111,278,279],{},"0 to 3:"," Name an owner (question 1), then start an initial inventory (question 2). Read the ",[140,282,284],{"href":283},"\u002Fblog\u002Fpqc-migration-roadmap","Migration Roadmap",[275,286,287,290],{},[111,288,289],{},"4 to 7:"," Automate the inventory (question 3), rank systems (question 5), and choose one low-risk pilot (question 10).",[275,292,293,296,297,144],{},[111,294,295],{},"8 to 10:"," Move to the migration phase, then verify. Check dates in ",[140,298,300],{"href":299},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines",[12,302,304],{"id":303},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,306,307],{},"You do not need to answer the technical questions yourself. You need to know who answers them and whether the answers are written down.",[17,309,310],{},"Questions 1, 6, and 7 are management questions. They ask who owns the work, what your suppliers have told you, and what your contracts require. Your CEO or COO settles ownership. Your procurement lead and general counsel settle the clauses. Your CFO decides whether the work has a budget line. Questions 2, 3, 5, 8, 9, and 10 are technical, and your CISO or CTO owns them.",[17,312,313],{},"Question 4 is a business question that IT cannot answer alone. Your data owners, legal team, and records managers know how long each data set must stay confidential. Ask them. Your security team can then rank systems by that answer.",[17,315,316],{},"Three points help frame the risk for a board:",[272,318,319,328,342],{},[275,320,321,324,325,327],{},[111,322,323],{},"Ownership comes first."," EO 14412 requires a migration lead at each federal agency, and Canada's roadmap names an executive lead and a technical lead [1]",[102,326,108],{},". Boards should expect the same clarity.",[275,329,330,333,334,336,337,336,339,341],{},[111,331,332],{},"Discovery is the first phase everywhere."," OMB, the NCSC, and Canada all begin with finding what you use ",[102,335,108],{},", ",[102,338,124],{},[102,340,128],{},". An organization without an inventory has not started.",[275,343,344,347],{},[111,345,346],{},"Partial answers count as no."," The rubric asks for evidence, not confidence. That rule protects you from a comfortable score that hides gaps.",[12,349,351],{"id":350},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[17,353,354,355],{},"Bring the ten questions to your next security review. Then ask these follow-ups. ",[111,356,357],{},"ArcQubit guidance:",[359,360,361,364,367,370,373,376,379,382],"ol",{},[275,362,363],{},"Who scored this assessment, and who checked their answers?",[275,365,366],{},"Which \"yes\" answers rest on a document, and which rest on someone's memory?",[275,368,369],{},"Which systems hold data that must stay confidential beyond 2030?",[275,371,372],{},"Which of our top suppliers have replied in writing about their post-quantum plans?",[275,374,375],{},"Which endpoints cannot yet negotiate TLS 1.3, and when will each one be fixed?",[275,377,378],{},"Which of our systems could change an algorithm through configuration, and which need a code release?",[275,380,381],{},"Which single low-risk system will we pilot first, and who signs off on the result?",[275,383,384],{},"When did we last update the inventory, and what triggers the next update?",[17,386,387],{},"Write down the answers. A vague answer to any of these tells you which question to score as \"no.\"",[12,389,391],{"id":390},"common-mistakes-and-how-to-avoid-them","Common mistakes and how to avoid them",[17,393,394,397],{},[111,395,396],{},"ArcQubit guidance."," Self-assessments tend to fail in the same ways.",[272,399,400,406,412,418,427],{},[275,401,402,405],{},[111,403,404],{},"Rounding up."," Teams score a \"partly\" as a \"yes.\" The rubric says otherwise. Score honestly, and you will get a plan you can use.",[275,407,408,411],{},[111,409,410],{},"Letting one team answer alone."," Security cannot answer questions 4, 6, and 7 without legal, procurement, and data owners. Put those people in the room.",[275,413,414,417],{},[111,415,416],{},"Treating the score as a grade."," The bands are an ArcQubit rubric, not part of any standard. Use the score to pick your next step, not to report success.",[275,419,420,423,424,426],{},[111,421,422],{},"Skipping the inventory."," Some teams jump to a pilot because a pilot feels like progress. Canada advises starting with an initial, incomplete inventory rather than waiting for a perfect one ",[102,425,108],{},". Start small, but start there.",[275,428,429,432],{},[111,430,431],{},"Scoring once and filing it."," Repeat the assessment on a set schedule. Your score should rise as the work moves forward.",[12,434,436],{"id":435},"a-worked-example","A worked example",[17,438,439],{},"Consider a generic mid-sized organization that provides online services to customers. Its security team sits down with legal, procurement, and two data owners and runs the assessment.",[17,441,442],{},"The group answers yes to question 8, because its main web endpoints already support TLS 1.3. It answers yes to question 6, because procurement has already sent supplier letters and filed the replies. It answers no to the other eight. Someone thinks an inventory exists, but nobody can find it, so question 2 scores no. The total is 2, which is the discovery stage.",[17,444,445],{},"The next step follows from the rubric. The CEO names an owner with a written mandate. The owner starts an initial, incomplete inventory. Legal and the data owners list the data sets that must stay confidential for 10 years or more, using the rule of thumb from question 4. The team reruns the assessment after the inventory exists. The score has no claim to precision. It shows the team where to start and gives the board a baseline to compare against.",[12,447,449],{"id":448},"owner-and-timeline-table","Owner and timeline table",[17,451,452,453,456],{},"This table shows who should act on each stage. It is ",[111,454,455],{},"ArcQubit guidance",", not part of any standard or government roadmap.",[34,458,459,472],{},[37,460,461],{},[40,462,463,466,469],{},[43,464,465],{},"Action",[43,467,468],{},"Suggested owner",[43,470,471],{},"When",[53,473,474,485,496,507,518,528,539,550],{},[40,475,476,479,482],{},[58,477,478],{},"Name a migration owner with a written mandate",[58,480,481],{},"CEO or COO",[58,483,484],{},"This week",[40,486,487,490,493],{},[58,488,489],{},"Score the assessment with legal, procurement, and data owners",[58,491,492],{},"CISO",[58,494,495],{},"Within 30 days",[40,497,498,501,504],{},[58,499,500],{},"Start or refresh the initial inventory",[58,502,503],{},"CISO and CTO",[58,505,506],{},"Start now, then review on a schedule",[40,508,509,512,515],{},[58,510,511],{},"List data that must stay confidential beyond 2030",[58,513,514],{},"Data owners and general counsel",[58,516,517],{},"Within 60 days",[40,519,520,523,526],{},[58,521,522],{},"Send suppliers written questions about post-quantum plans",[58,524,525],{},"Procurement lead",[58,527,517],{},[40,529,530,533,536],{},[58,531,532],{},"Add post-quantum and crypto agility clauses to new contracts and renewals",[58,534,535],{},"General counsel",[58,537,538],{},"At each renewal",[40,540,541,544,547],{},[58,542,543],{},"Choose one low-risk pilot and define success",[58,545,546],{},"CTO",[58,548,549],{},"Within 90 days",[40,551,552,555,557],{},[58,553,554],{},"Rescore and report the result to the board",[58,556,492],{},[58,558,559],{},"Each quarter",[12,561,563],{"id":562},"how-to-brief-your-board","How to brief your board",[17,565,566,567],{},"Use this short script. ",[111,568,357],{},[359,570,571,585,588,599],{},[275,572,573,574,336,576,336,578,580,581,584],{},"\"We scored ourselves on ten questions drawn from OMB, NCSC, and Canadian Cyber Centre guidance ",[102,575,108],{},[102,577,124],{},[102,579,128],{},". Our score is X, which puts us in the ",[102,582,583],{},"stage"," stage of an ArcQubit rubric.\"",[275,586,587],{},"\"The lowest-scoring questions are A, B, and C. Each has a named owner and a date.\"",[275,589,590,591,594,595,598],{},"\"We need a decision on ",[102,592,593],{},"owner, budget, or contract clause"," by ",[102,596,597],{},"date",".\"",[275,600,601],{},"\"We will rescore next quarter and show the change.\"",[17,603,604],{},"Keep the message short. Boards need a baseline, an owner, and a date, not a lecture on cryptography.",[12,606,608],{"id":607},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,610,611],{},"QuCode runs read-only scans and ingests the results from scanners you already own. It produces a ranked Quantum Exposure Report with an owner for every finding, so you can answer questions 2, 3, and 5 with evidence. We sell it directly as a fixed-scope discovery. QuTrust then turns the findings into a living migration roadmap and keeps the evidence current.",{"title":613,"searchDepth":614,"depth":614,"links":615},"",2,[616,617,618,631,632,633,634,635,636,637,638],{"id":14,"depth":614,"text":15},{"id":28,"depth":614,"text":29},{"id":91,"depth":614,"text":92,"children":619},[620,622,623,624,625,626,627,628,629,630],{"id":96,"depth":621,"text":97},3,{"id":117,"depth":621,"text":118},{"id":147,"depth":621,"text":148},{"id":159,"depth":621,"text":160},{"id":176,"depth":621,"text":177},{"id":188,"depth":621,"text":189},{"id":203,"depth":621,"text":204},{"id":218,"depth":621,"text":219},{"id":234,"depth":621,"text":235},{"id":250,"depth":621,"text":251},{"id":269,"depth":614,"text":270},{"id":303,"depth":614,"text":304},{"id":350,"depth":614,"text":351},{"id":390,"depth":614,"text":391},{"id":435,"depth":614,"text":436},{"id":448,"depth":614,"text":449},{"id":562,"depth":614,"text":563},{"id":607,"depth":614,"text":608},"Security","2026-08-13","A 10-question self-assessment to check whether your encryption is ready for quantum computers, with a scoring rubric and next steps for each stage.",false,"md",[645,648,651],{"q":646,"a":647},"How do I score the assessment?","Give one point for each yes. Eight to 10 points means execution stage, four to seven means planning and pilots, and zero to three means discovery. The bands are an ArcQubit rubric.",{"q":649,"a":650},"Is this assessment based on a standard?","The questions draw on public guidance from OMB, the NCSC, and Canada's Cyber Centre [2], [3], [4]. The scoring bands are our own.",{"q":652,"a":653},"What should I fix first?","Fix ownership and inventory first. Every government roadmap starts with discovery, and you cannot rank or migrate what you cannot see [2], [3], [4].",[655],"global",[657],"Cross-Sector",{},"2026-09-30",true,"\u002Fblog\u002Fquantum-readiness-assessment",[663,666,669,672,675],{"label":664,"url":665},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":667,"url":668},"Canadian Centre for Cyber Security, \"Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),\" Communications Security Establishment Canada, Jun. 2025","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Froadmap-migration-post-quantum-cryptography-government-canada-itsm40001",{"label":670,"url":671},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":673,"url":674},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":676,"url":677},"K. Kwiatkowski, P. Kampanakis, B. E. Westerbaan, and D. Stebila, \"Post-Quantum Traditional (PQ\u002FT) Hybrid Key Agreement Mechanisms for TLS 1.3,\" RFC 10024, Aug. 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc10024",[679,680,682],{"label":284,"url":283},{"label":681,"url":142},"Cryptographic Inventory and CBOM",{"label":300,"url":299},{"title":5,"description":641},"Quantum Readiness Self-Assessment (10 Questions)","quantum-readiness-assessment",[687,688],"Executive Order 14412 requires each agency head to identify a post-quantum migration lead within 30 days of the order (Executive Office of the President, 2026).","The UK NCSC expects organizations to complete a full discovery exercise by 2028 (National Cyber Security Centre, 2025).","blog\u002Fquantum-readiness-assessment",[691,692,693,694,695],"quantum readiness","PQC migration","for CISOs","how-to","cryptographic inventory","Answer ten yes-or-no questions about ownership, inventory, data shelf life, vendors, TLS 1.3, crypto agility and pilots, and score one point per yes to find your stage: discovery, planning and pilots, or execution.","9jJlvuDYfT7WPxkfqSWtGERNMWbXwuu8CZTnMTdDP9s",1792182884016]