Quantum Readiness Assessment Framework: A Practitioner's Guide for CISOs, CTOs, and Government IT Leaders

Most organisations have conducted a cybersecurity audit at some point in the last two years. Very few have conducted a quantum readiness assessment. These are not the same exercise. A cybersecurity audit evaluates controls, policies, and configurations against a known threat model. A quantum readiness assessment evaluates cryptographic architecture against a threat model that does not yet exist at full operational scale but is arriving on a documented timeline.

The NIST post-quantum cryptography standards were finalised in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). NSA CNSA 2.0 mandates algorithm replacement for national security systems by 2030 and prohibits all quantum-vulnerable algorithms by 2035.  Citi published a Quantum Readiness Survey for supply chain assessment that is cited in the NIST migration documentation itself. These are not draft guidelines. They are published standards with enforcement timelines.

The quantum readiness assessment is the first step of the migration programme. Without one, an organisation cannot know where it is exposed, what to migrate first, how long migration will take, or what it will cost. The assessment is also, in many regulated sectors, becoming a compliance document in its own right. This guide explains what a quantum readiness assessment actually measures, how the outputs are structured, and how to use those outputs to build an executable migration programme.

Why a Quantum Readiness Assessment Is Not a Standard Security Audit

A standard security audit looks for controls that are absent, configurations that are incorrect, and vulnerabilities that are exploitable today. Its threat model is the current adversary landscape: ransomware, phishing, insider threats, unpatched software.

A quantum readiness assessment has a different scope. It looks for cryptographic algorithms that are currently secure but will become insecure when a cryptographically relevant quantum computer (CRQC) is available. These algorithms are not misconfigured. They are not unpatched. They are working exactly as designed, and they are the problem.

The specific algorithms under examination are the public-key cryptography systems that underpin the entire digital security infrastructure: RSA (used for key encapsulation and digital signatures), Elliptic Curve Diffie-Hellman (ECDH, used for key exchange in TLS), Elliptic Curve Digital Signature Algorithm (ECDSA, used for certificate signing and code signing). AES-256 is quantum-resistant and does not require replacement.

Five Quantum Readiness Assessment Framework

Domain 1: Cryptographic Asset Discovery

The first output of a quantum readiness assessment is a complete cryptographic inventory. This is not the same as a certificate inventory, which most organisations already have. A cryptographic inventory maps every algorithm in use across infrastructure, applications, and vendor integrations.

What gets discovered: TLS cipher suites negotiated on every external and internal endpoint, JWT and SAML token signing algorithms, SSH key algorithms across all servers and network devices, code signing certificate algorithms, HSM algorithm support and configuration, VPN IKE configuration, certificate authority algorithm selection, and third-party and vendor API authentication mechanisms.

The discovery scope has four asset classes in order of assessment priority. Class 1 is network perimeter (TLS): the highest attack surface and the most straightforward to migrate. Class 2 is application layer (JWT, SAML, code signing). Class 3 is infrastructure (SSH, VPN, HSM). Class 4 is embedded and legacy (IoT, SCADA, operational technology firmware): the most complex and the longest migration tail.

Domain 2: Risk Scoring and Prioritisation

A raw cryptographic inventory is not a migration plan. Risk scoring converts the inventory into a prioritised queue. Three factors determine score:

• Data sensitivity: what does this cryptographic asset protect? Mission-critical communications, financial transaction records, health data, and state secrets score highest. Session cookies, ephemeral messaging, and low-value public-facing content score lowest.
• Data shelf life: how long does the protected data need to remain confidential? Data with a 25-to-50-year confidentiality requirement, such as state secrets, genome records, or long-term health records, is already exposed by the HNDL threat regardless of when a CRQC appears. The migration deadline for such data has, by Mosca's inequality, already passed.
• Migration complexity: how difficult is it to replace this cryptographic implementation? TLS configuration is a software update. HSM replacement is a hardware procurement and integration programme. IoT firmware update is a device fleet managem

Domain 3: Regulatory Gap Analysis

A quantum readiness assessment maps the cryptographic inventory against applicable regulatory requirements. For organisations operating in regulated sectors, this is not optional: it is the compliance deliverable.

Key regulatory reference points: NIST FIPS 203/204/205 (international standard for PQC algorithm selection). NSA CNSA 2.0 (2030 migration mandate for national security systems; 2035 prohibition deadline). NIST IR 8547 (RSA-2048 and ECC P-256 deprecated by 2030 under initial public draft, November 2024).

For defence-adjacent organisations, the parameter set matters. NSS-grade environments require ML-KEM-1024 and ML-DSA-87. Civilian migration defaults to ML-KEM-768 and ML-DSA-65. Planning with the wrong parameter set creates rework when the system is deployed into a defence interoperability requirement.

Domain 4: Migration Sequencing and Cost Modelling

The output of a well-structured quantum readiness assessment is a migration sequence, not a flat list of vulnerabilities. The sequence is determined by combining the risk score with migration complexity:

• Phase 1 (immediate): TLS key exchange migration to hybrid ML-KEM. This protects all external communications and addresses the most accessible HNDL target. Hybrid classical + PQC is already deployed in production browsers and global CDNs.
• Phase 2 (3 to 6 months): Token and signature migration. JWT and SAML signing migrated to ML-DSA. Code signing updated to NIST SP 800-208 (LMS/XMSS hash-based signatures for firmware and software signing, per NSA guidance).
• Phase 3 (6 to 18 months): HSM migration. Verify ML-KEM and ML-DSA support in existing HSMs; SEALSQ and other vendors are targeting 2025 to 2026 for NIST-approved PQC integration. Replace or upgrade HSMs that do not support PQC natively.
• Phase 4 (18 months to 5 years): Embedded and legacy systems. IoT, SCADA, and operational technology firmware. This phase has the longest tail and the highest per-unit cost because it often requires physical device access.

Domain 5: Vendor and Supply Chain Quantum Exposure

An organisation's quantum migration is only as complete as its vendor ecosystem's migration. Every API integration, SaaS application, and third-party data processor that uses RSA or ECC in its communications with the assessed organisation is a residual exposure point even after the organisation's own infrastructure is migrated.

Citi's Quantum Readiness Survey, referenced in NIST's own migration documentation, is a model for organisations to adapt for supply chain assessment. [Source: NIST migration FAQ : Citi Quantum Readiness Survey] A complete quantum readiness assessment includes a tier-1 vendor assessment (all critical vendors) and a framework for ongoing supply chain monitoring as the migration programme progresses.

What the Assessment Output Looks Like

A well-structured quantum readiness assessment produces five deliverables:

• Cryptographic inventory dashboard: a complete map of all cryptographic assets by algorithm, location, asset class, and current quantum vulnerability status.
• Risk matrix: all assets scored by data sensitivity, shelf life, and migration complexity, presented as a prioritised migration queue.
• Regulatory gap report: documented gaps against NIST FIPS 203/204/205, NSA CNSA 2.0, and any sector-specific regulatory mandates. This is the compliance deliverable for audit and board reporting.
• Migration roadmap: phased plan by asset class, with estimated timeline and cost for each phase. The roadmap should explicitly model the cost of inaction (regulatory penalty, breach liability) against the cost of migration.
• Vendor exposure summary: tier-1 vendor quantum readiness status and recommended supply chain assessment framework.

Common Errors That Make Assessments Incomplete

Four errors account for most quantum readiness assessments that fail to support an executable migration programme:

• Scanning only the perimeter: most critical cryptographic assets are internal, service-to-service authentication, database encryption keys, backup signing infrastructure, and internal PKI. External-only scanning misses the majority of the cryptographic estate.
• Treating certificate inventory as cryptographic inventory: a valid, unexpired certificate can still use a vulnerable algorithm. The assessment must examine algorithm selection, not just certificate validity status.
• No re-scan plan: cryptographic assets change continuously as new services, applications, and vendor integrations are added. A point-in-time assessment without a continuous monitoring and re-scan schedule is stale within months.
• Ignoring third-party exposure: a migrated internal system that communicates with a non-migrated vendor system is not fully migrated. Vendor exposure must be assessed and tracked as part of the same programme.

Final Thoughts

A quantum readiness assessment is the document that turns a board-level concern about quantum computing into an executable migration programme with a budget, a sequence, and a compliance deliverable. The organisations that have completed assessments know what to do next. The organisations that have not are accumulating undocumented regulatory exposure with every day that their RSA and ECC infrastructure transmits data.

Contact QNu Labs to book your quantum readiness assessment.

Ready to take the next step?

Book a Quantum Readiness Risk Assessment: https://www.qnulabs.com/request-a-demo

Download: The QNu Migration Theorem (Survival of Equality): https://www.qnulabs.com/whitepaper

Contact QNu Labs: https://www.qnulabs.com/contact-us

Related: QShield Platform: https://www.qnulabs.com/quantum-security-platform

Related: QKD Complete Guide: https://www.qnulabs.com/blog/quantum-key-distribution-qkd-complete-guide