A shared yardstick for quantum readiness.
Four dimensions, twelve practices, five maturity levels. A structured way to measure where an organization stands on post-quantum migration, and to turn a scan result into a plan.
4
dimensions
12
practices
5
maturity levels
8
frameworks mapped
Four dimensions
Each dimension has three practices. Together they span discovery, governance, data protection and deployment.
Cryptographic Visibility & Inventory
Discover, catalogue and risk-rate every cryptographic asset: the inventory everything else builds on.
- CVI.1Asset Discovery & Classification
- CVI.2Vulnerability Scanning & Analysis
- CVI.3Risk Prioritization & Tracking
Covered by · qScan (static discovery, 14 languages) · CBOM / QBOM export
Strategic Governance & Risk Management
Executive ownership, risk methodology and third-party posture that keep the transition funded and accountable.
- SGRM.1Governance Structure & Leadership
- SGRM.2Risk Management Framework
- SGRM.3Compliance & Audit
Covered by · Expert review · Credential & governance dashboard
Data Protection Engineering
Quantum-safe encryption, key management and data handling across data at rest and in transit.
- DPE.1Encryption Implementation
- DPE.2Key Management Systems
- DPE.3Data Classification & Handling
Covered by · Sieve (ML-KEM/ML-DSA/SLH-DSA conformance) · Key-management guides
Implementation & Technical Readiness
Infrastructure crypto-agility, capabilities and testing that make the migration actually deployable.
- ITR.1Network Security Architecture
- ITR.2System Hardening & Updates
- ITR.3Incident Response & Recovery
Covered by · qProbe (live TLS/SSH readiness) · Migration guides
Five maturity levels
Every practice is scored 1–4; dimension and overall scores roll up to one of five levels.
Basic · 0.0–1.5
Little to no formal quantum readiness; foundations still to be established.
Developing · 1.6–2.5
Basic controls exist but need systematic improvement and a roadmap.
Established · 2.6–3.5
A solid foundation is in place; optimize controls and close remaining gaps.
Advanced · 3.6–3.9
Strong readiness across dimensions; sustain and monitor emerging threats.
Optimizing · 4.0–4.0
Continuously improving, automated, and ahead of the quantum threat curve.
One posture, every framework
Each practice maps to the controls you already report against, so a readiness gap doubles as a compliance signal. Pick a framework to see the mapping.
12 / 12 practices mapped
CVI · Cryptographic Visibility & Inventory
| Asset Discovery & Classification | ID.AM-1ID.AM-2ID.AM-3ID.AM-4ID.AM-5ID.BE-4ID.SC-1 |
| Vulnerability Scanning & Analysis | DE.CM-8ID.RA-1ID.RA-3ID.RA-5ID.SC-2 |
| Risk Prioritization & Tracking | DE.CM-1ID.RA-2ID.RA-3ID.RA-4ID.RM-1ID.RM-2ID.RM-3ID.SC-3RS.MI-3 |
SGRM · Strategic Governance & Risk Management
| Governance Structure & Leadership | GV.MT-1GV.OC-1GV.OC-2GV.OC-3GV.PO-1GV.RM-1GV.RR-1GV.SP-1 |
| Risk Management Framework | DE.CM-1ID.BE-5ID.RA-1ID.RA-3ID.RM-1ID.RM-2ID.RM-3PR.IP-2RS.AN-5 |
| Compliance & Audit | DE.CM-6GV.OC-3GV.OV-3GV.PO-2ID.GV-3PR.DS-6PR.IP-1PR.IP-7RS.MI-3 |
DPE · Data Protection Engineering
| Encryption Implementation | DE.CM-3PR.DS-1PR.DS-2PR.DS-3PR.DS-5 |
| Key Management Systems | DE.AE-3PR.AC-1PR.AC-4PR.DS-1RS.MI-3 |
| Data Classification & Handling | ID.AM-5PR.DS-3PR.DS-5PR.IP-6PR.PT-1PR.PT-2 |
ITR · Implementation & Technical Readiness
| Network Security Architecture | DE.CM-1PR.AC-3PR.AC-4PR.AC-5 |
| System Hardening & Updates | DE.CM-8PR.AC-1PR.IP-1PR.IP-12PR.IP-2PR.IP-3 |
| Incident Response & Recovery | DE.AE-1PR.IP-4RC.RP-1RS.AN-1RS.CO-3RS.IM-1RS.MI-1RS.RP-1 |
The quantakrypto Readiness Standard adapts the QRAMM: Quantum Readiness Assurance Maturity Model by CyberSecurity NonProfit (CSNP), released under the MIT License. We present it in our own voice and map it to our toolkit; the framework itself remains the work of CSNP.
Frequently asked questions
What is the quantakrypto Readiness Standard?
A maturity model for post-quantum posture, a shared yardstick. It has four dimensions, twelve practices, and five maturity levels, and it maps to our open-source toolkit and to the compliance frameworks you already report against.
What are the four dimensions?
Cryptographic Visibility and Inventory, Strategic Governance and Risk Management, Data Protection Engineering, and Implementation and Technical Readiness. Each has three practices, twelve in all.
How is a maturity score calculated?
Each of the twelve practices is scored from one to four and weighted within its dimension. The dimension scores roll up to an overall level, from Basic (0.0 to 1.5) through Developing, Established, and Advanced to Optimizing (4.0).
Is the standard based on existing work?
Yes. It adapts QRAMM, the Quantum Readiness Assurance Maturity Model from CyberSecurity NonProfit (CSNP), which is MIT-licensed. We credit and link the original.
How does it line up with compliance frameworks?
Every practice maps to representative controls in eight frameworks: NIST CSF 2.0, NIST PQC, CMMC 2.0, ISO 27001, SOC 2, FedRAMP, FISMA, and CIS v8. You report against them once and read your post-quantum posture in the same terms.
How long does the assessment take?
The quick assessment is twelve questions, one per practice, about five minutes. It returns your maturity level and a radar chart you can save and revisit as you improve.
See where you stand in five minutes
Take the quick assessment for a maturity score and a prioritized plan, then let the toolkit and Education Center close the gaps.