quantakrypto
Loading…
Loading…
Four dimensions, twelve practices, five maturity levels. A structured way to measure where an organization stands on post-quantum migration — and to turn a scan result into a plan.
4
dimensions
12
practices
5
maturity levels
8
frameworks mapped
Each dimension has three practices. Together they span discovery, governance, data protection and deployment.
Discover, catalogue and risk-rate every cryptographic asset — the inventory everything else builds on.
Covered by · qScan (static discovery, 14 languages) · CBOM / QBOM export
Executive ownership, risk methodology and third-party posture that keep the transition funded and accountable.
Covered by · Expert review · Credential & governance dashboard
Quantum-safe encryption, key management and data handling across data at rest and in transit.
Covered by · Sieve (ML-KEM/ML-DSA/SLH-DSA conformance) · Key-management guides
Infrastructure crypto-agility, capabilities and testing that make the migration actually deployable.
Covered by · qProbe (live TLS/SSH readiness) · Migration guides
Every practice is scored 1–4; dimension and overall scores roll up to one of five levels.
Basic · 0.0–1.5
Little to no formal quantum readiness — foundations still to be established.
Developing · 1.6–2.5
Basic controls exist but need systematic improvement and a roadmap.
Established · 2.6–3.5
A solid foundation is in place; optimize controls and close remaining gaps.
Advanced · 3.6–3.9
Strong readiness across dimensions; sustain and monitor emerging threats.
Optimizing · 4.0–4.0
Continuously improving, automated, and ahead of the quantum threat curve.
Each practice maps to the controls you already report against — so a readiness gap doubles as a compliance signal. Pick a framework to see the mapping.
12 / 12 practices mapped
CVI · Cryptographic Visibility & Inventory
| Asset Discovery & Classification | ID.AM-1ID.AM-2ID.AM-3ID.AM-4ID.AM-5ID.BE-4ID.SC-1 |
| Vulnerability Scanning & Analysis | DE.CM-8ID.RA-1ID.RA-3ID.RA-5ID.SC-2 |
| Risk Prioritization & Tracking | DE.CM-1ID.RA-2ID.RA-3ID.RA-4ID.RM-1ID.RM-2ID.RM-3ID.SC-3RS.MI-3 |
SGRM · Strategic Governance & Risk Management
| Governance Structure & Leadership | GV.MT-1GV.OC-1GV.OC-2GV.OC-3GV.PO-1GV.RM-1GV.RR-1GV.SP-1 |
| Risk Management Framework | DE.CM-1ID.BE-5ID.RA-1ID.RA-3ID.RM-1ID.RM-2ID.RM-3PR.IP-2RS.AN-5 |
| Compliance & Audit | DE.CM-6GV.OC-3GV.OV-3GV.PO-2ID.GV-3PR.DS-6PR.IP-1PR.IP-7RS.MI-3 |
DPE · Data Protection Engineering
| Encryption Implementation | DE.CM-3PR.DS-1PR.DS-2PR.DS-3PR.DS-5 |
| Key Management Systems | DE.AE-3PR.AC-1PR.AC-4PR.DS-1RS.MI-3 |
| Data Classification & Handling | ID.AM-5PR.DS-3PR.DS-5PR.IP-6PR.PT-1PR.PT-2 |
ITR · Implementation & Technical Readiness
| Network Security Architecture | DE.CM-1PR.AC-3PR.AC-4PR.AC-5 |
| System Hardening & Updates | DE.CM-8PR.AC-1PR.IP-1PR.IP-12PR.IP-2PR.IP-3 |
| Incident Response & Recovery | DE.AE-1PR.IP-4RC.RP-1RS.AN-1RS.CO-3RS.IM-1RS.MI-1RS.RP-1 |
The quantakrypto Readiness Standard adapts the QRAMM — Quantum Readiness Assurance Maturity Model by CyberSecurity NonProfit (CSNP), released under the MIT License. We present it in our own voice and map it to our toolkit; the framework itself remains the work of CSNP.
A maturity model for post-quantum posture, a shared yardstick. It has four dimensions, twelve practices, and five maturity levels, and it maps to our open-source toolkit and to the compliance frameworks you already report against.
Cryptographic Visibility and Inventory, Strategic Governance and Risk Management, Data Protection Engineering, and Implementation and Technical Readiness. Each has three practices, twelve in all.
Each of the twelve practices is scored from one to four and weighted within its dimension. The dimension scores roll up to an overall level, from Basic (0.0 to 1.5) through Developing, Established, and Advanced to Optimizing (4.0).
Yes. It adapts QRAMM, the Quantum Readiness Assurance Maturity Model from CyberSecurity NonProfit (CSNP), which is MIT-licensed. We credit and link the original.
Every practice maps to representative controls in eight frameworks: NIST CSF 2.0, NIST PQC, CMMC 2.0, ISO 27001, SOC 2, FedRAMP, FISMA, and CIS v8. You report against them once and read your post-quantum posture in the same terms.
The quick assessment is twelve questions, one per practice, about five minutes. It returns your maturity level and a radar chart you can save and revisit as you improve.
Take the quick assessment for a maturity score and a prioritized plan, then let the toolkit and Education Center close the gaps.