A shared yardstick for quantum readiness.
Four dimensions, twelve practices, five maturity levels. A structured way to measure where an organization stands on post-quantum migration — and to turn a scan result into a plan.
4
dimensions
12
practices
5
maturity levels
8
frameworks mapped
Four dimensions
Each dimension has three practices. Together they span discovery, governance, data protection and deployment.
Cryptographic Visibility & Inventory
Discover, catalogue and risk-rate every cryptographic asset — the inventory everything else builds on.
- CVI.1Asset Discovery & Classification
- CVI.2Vulnerability Scanning & Analysis
- CVI.3Risk Prioritization & Tracking
Covered by · qScan (static discovery, 14 languages) · CBOM / QBOM export
Strategic Governance & Risk Management
Executive ownership, risk methodology and third-party posture that keep the transition funded and accountable.
- SGRM.1Governance Structure & Leadership
- SGRM.2Risk Management Framework
- SGRM.3Compliance & Audit
Covered by · Expert review · Credential & governance dashboard
Data Protection Engineering
Quantum-safe encryption, key management and data handling across data at rest and in transit.
- DPE.1Encryption Implementation
- DPE.2Key Management Systems
- DPE.3Data Classification & Handling
Covered by · Sieve (ML-KEM/ML-DSA/SLH-DSA conformance) · Key-management guides
Implementation & Technical Readiness
Infrastructure crypto-agility, capabilities and testing that make the migration actually deployable.
- ITR.1Network Security Architecture
- ITR.2System Hardening & Updates
- ITR.3Incident Response & Recovery
Covered by · qProbe (live TLS/SSH readiness) · Migration guides
Five maturity levels
Every practice is scored 1–4; dimension and overall scores roll up to one of five levels.
Basic · 0.0–1.5
Little to no formal quantum readiness — foundations still to be established.
Developing · 1.6–2.5
Basic controls exist but need systematic improvement and a roadmap.
Established · 2.6–3.5
A solid foundation is in place; optimize controls and close remaining gaps.
Advanced · 3.6–3.9
Strong readiness across dimensions; sustain and monitor emerging threats.
Optimizing · 4.0–4.0
Continuously improving, automated, and ahead of the quantum threat curve.
One posture, every framework
Each practice maps to the controls you already report against — so a readiness gap doubles as a compliance signal. Pick a framework to see the mapping.
12 / 12 practices mapped
CVI · Cryptographic Visibility & Inventory
| Asset Discovery & Classification | ID.AM-1ID.AM-2ID.AM-3ID.AM-4ID.AM-5ID.BE-4ID.SC-1 |
| Vulnerability Scanning & Analysis | DE.CM-8ID.RA-1ID.RA-3ID.RA-5ID.SC-2 |
| Risk Prioritization & Tracking | DE.CM-1ID.RA-2ID.RA-3ID.RA-4ID.RM-1ID.RM-2ID.RM-3ID.SC-3RS.MI-3 |
SGRM · Strategic Governance & Risk Management
| Governance Structure & Leadership | GV.MT-1GV.OC-1GV.OC-2GV.OC-3GV.PO-1GV.RM-1GV.RR-1GV.SP-1 |
| Risk Management Framework | DE.CM-1ID.BE-5ID.RA-1ID.RA-3ID.RM-1ID.RM-2ID.RM-3PR.IP-2RS.AN-5 |
| Compliance & Audit | DE.CM-6GV.OC-3GV.OV-3GV.PO-2ID.GV-3PR.DS-6PR.IP-1PR.IP-7RS.MI-3 |
DPE · Data Protection Engineering
| Encryption Implementation | DE.CM-3PR.DS-1PR.DS-2PR.DS-3PR.DS-5 |
| Key Management Systems | DE.AE-3PR.AC-1PR.AC-4PR.DS-1RS.MI-3 |
| Data Classification & Handling | ID.AM-5PR.DS-3PR.DS-5PR.IP-6PR.PT-1PR.PT-2 |
ITR · Implementation & Technical Readiness
| Network Security Architecture | DE.CM-1PR.AC-3PR.AC-4PR.AC-5 |
| System Hardening & Updates | DE.CM-8PR.AC-1PR.IP-1PR.IP-12PR.IP-2PR.IP-3 |
| Incident Response & Recovery | DE.AE-1PR.IP-4RC.RP-1RS.AN-1RS.CO-3RS.IM-1RS.MI-1RS.RP-1 |
The quantakrypto Readiness Standard adapts the QRAMM — Quantum Readiness Assurance Maturity Model by CyberSecurity NonProfit (CSNP), released under the MIT License. We present it in our own voice and map it to our toolkit; the framework itself remains the work of CSNP.
See where you stand in five minutes
Take the quick assessment for a maturity score and a prioritized plan, then let the toolkit and Education Center close the gaps.