Our Assessment Approach
Our Assessment Approach
A structured, evidence-led methodology — from cryptographic discovery through to a prioritised migration programme. No assumptions. No sampling. Complete coverage.
Methodology
Six stages. One continuous programme.
Every Qontomcrypt engagement follows the same structured lifecycle — from initial scoping through to ongoing quantum readiness monitoring.
Scope
Define the assessment boundary: systems, environments, data classifications and regulatory obligations in scope.
Discover
Build the Cryptographic Bill of Materials through active scanning, passive observation, configuration review and stakeholder interviews.
Assess
Apply the five-factor risk model to every asset in the CBOM. Score each asset and produce a defensible Priority Score.
Prioritise
Assign P1–P4 migration tiers. Apply overrides for long-lived high-value data. Produce the migration sequence.
Migrate
Execute the wave-based migration programme. Implement NIST-standardised PQC algorithms. Validate and document each migration.
Monitor
Maintain ongoing visibility into the cryptographic estate. Track remediation progress, vendor readiness and evolving quantum risk.
01
Scope
Define the assessment boundary: systems, environments, data classifications and regulatory obligations in scope.
02
Discover
Build the Cryptographic Bill of Materials through active scanning, passive observation, configuration review and stakeholder interviews.
03
Assess
Apply the five-factor risk model to every asset in the CBOM. Score each asset and produce a defensible Priority Score.
04
Prioritise
Assign P1–P4 migration tiers. Apply overrides for long-lived high-value data. Produce the migration sequence.
05
Migrate
Execute the wave-based migration programme. Implement NIST-standardised PQC algorithms. Validate and document each migration.
06
Monitor
Maintain ongoing visibility into the cryptographic estate. Track remediation progress, vendor readiness and evolving quantum risk.
Cryptographic Bill of Materials
The CBOM: the foundation of quantum-safe migration
Before you can migrate to post-quantum cryptography, you need to know exactly what cryptographic assets you have, where they are, and what they protect. The Cryptographic Bill of Materials is that inventory.
What the CBOM contains
Algorithm inventory
Every cryptographic algorithm in use — RSA, ECC, AES, SHA, and others — with key lengths, modes and implementation details.
Certificate and key records
All certificates and keys: issuing CA, subject, key length, expiry date, algorithm, and the systems that depend on each.
Protocol configurations
TLS versions, cipher suites, protocol configurations and negotiation behaviour across all network-facing services.
System and data associations
Which systems use which cryptographic assets, and what data each asset protects — including data classification and retention period.
Ownership and accountability
Named system owner, team and vendor for each asset — establishing clear accountability for migration actions.
Third-party dependencies
Vendor-managed cryptography, API integrations, SaaS dependencies and supply-chain cryptographic exposure.
Why the CBOM matters
Without a CBOM, PQC migration is guesswork. Organisations that attempt to migrate without a complete cryptographic inventory risk missing high-priority assets, breaking cryptographic dependencies, and duplicating effort across teams. The CBOM is the single source of truth that makes migration planning possible.
How the CBOM supports migration planning
The CBOM feeds directly into the risk assessment — every asset in the inventory is scored using the five-factor model. It also drives dependency mapping, ownership validation and wave sequencing. As migration progresses, the CBOM is updated to reflect the current state of the cryptographic estate, providing an ongoing record of quantum readiness.
Five-Factor Risk Model
Five factors. One Priority Score.
The Qontomcrypt risk model scores every cryptographic asset on five factors — producing a weighted Priority Score from 0–100 that determines migration urgency. The model is transparent, auditable and defensible.
How long does the data protected by this asset need to remain confidential? Long-lived data — medical records, legal contracts, financial archives — scores highest. Data with a short retention period scores lower.
A 30-year financial archive scores 5. A session token with a 24-hour lifetime scores 1.
How vulnerable is the algorithm to a cryptographically relevant quantum computer? RSA and ECC — the foundations of today's PKI — are broken by Shor's algorithm and score highest. Symmetric algorithms with sufficient key length score lower.
RSA-2048 scores 5. AES-256 scores 1.
How accessible is the encrypted data to an adversary today? Publicly accessible TLS traffic on the open internet scores highest. Air-gapped archive storage with no external connectivity scores lowest.
A public-facing HTTPS endpoint scores 5. An offline encrypted backup tape scores 1.
What is the business impact of a breach of this asset? Payment systems, customer PII, regulated data and national security information score highest. Internal tooling and low-sensitivity data score lower.
A payment processing HSM scores 5. An internal development certificate scores 1.
How complex is the migration for this asset? Legacy systems with embedded cryptography, third-party dependencies and long vendor lead times score highest. Modern, well-documented systems with active vendor support score lower.
A legacy mainframe with embedded RSA scores 5. A cloud-managed TLS certificate scores 1.
Priority Score & Migration Tiers
Priority Score: 0–100
The five factor scores are combined into a single weighted Priority Score from 0–100. The score determines which migration tier each asset is assigned to — and therefore which wave of the migration programme it falls into.
Priority Score scale
Migrate first
75–100
Immediate action required. High-value, long-lived data with significant quantum exposure and high capturability. These assets are the primary harvest-now-decrypt-later targets.
Plan in the first wave
60–74
High priority. Include in the first planned migration programme. Typically high-priority application cryptography, identity infrastructure and key management systems.
Schedule in later waves
40–59
Moderate priority. Plan for migration in subsequent waves. Monitor for changes in the quantum threat timeline that may increase urgency.
Monitor and reassess
Below 40
Lower priority. Monitor and reassess periodically as the quantum threat timeline evolves and migration capacity becomes available.
The model supports manual overrides for assets where business context requires a different priority — for example, long-lived high-value data subject to specific regulatory or contractual obligations that the model does not fully capture.
Five-Phase Methodology
From discovery to ongoing resilience
Discover
Map your entire cryptographic estate
We begin with a comprehensive discovery of every cryptographic asset in your organisation — algorithms, keys, certificates, protocols, and the systems that depend on them. No assumptions. No sampling. Complete coverage.
- Automated scanning of infrastructure and applications
- Manual review of custom cryptographic implementations
- Certificate and key inventory compilation
- Data classification and retention period mapping
Assess
Score and classify every vulnerability
Each cryptographic asset is assessed against quantum-vulnerability criteria, data sensitivity, and regulatory requirements. We produce a scored, classified inventory that forms the foundation for all subsequent decisions.
- Five-factor quantum risk scoring per asset
- Regulatory alignment mapping (NESA, SAMA, RBI, DPDP Act)
- Cryptographic dependency analysis
- Executive risk summary
Prioritise
Sequence the migration with confidence
The Priority Score drives a clear P1–P4 migration sequence. We validate ownership, map dependencies and apply overrides where business context requires — producing a defensible migration plan.
- P1–P4 tier assignment for every CBOM asset
- Override review and documentation
- System ownership and accountability mapping
- Wave sequencing and dependency management
Migrate
Execute the migration programme
Wave-based migration execution using only NIST-standardised post-quantum algorithms. Each migration is validated, documented and reflected in the updated CBOM.
- NIST PQC algorithm implementation (ML-KEM, ML-DSA, SLH-DSA, FN-DSA)
- Crypto-agility architecture implementation
- Migration validation and testing
- Updated CBOM and executive progress reporting
Monitor
Maintain ongoing quantum readiness
Quantum risk is not static. Ongoing monitoring tracks CBOM changes, vendor readiness, remediation progress and the evolving quantum threat timeline.
- Continuous CBOM change monitoring
- Vendor and supply-chain readiness tracking
- Quarterly quantum readiness reporting
- Priority Score re-assessment on material changes
Core Principles
How we work
Evidence-led, not assumption-led
Every finding is backed by evidence from the discovery process. We do not estimate or sample — we build a complete, verified inventory.
NIST standards only
We implement only NIST-standardised post-quantum algorithms. No experimental schemes. No proprietary cryptography. No vendor lock-in.
Customer-controlled keys
Your encryption keys never leave your environment. Qontomcrypt has no access to your keys or your encrypted data at any stage of the engagement.
Designed for regulated industries
Every engagement is conducted under a comprehensive NDA. Our methodology is aligned with NESA, SAMA, RBI, DPDP Act and ISO 27001 frameworks.
Deployment Models
Flexible deployment for every environment
On-premises
Full deployment within your own infrastructure. No data leaves your perimeter. Suitable for regulated and classified environments.
Air-gapped
Fully isolated deployment with no external network connectivity. Designed for critical national infrastructure, defence and classified environments.
Hybrid
Flexible deployment across on-premises and cloud environments, with customer-controlled key management and data residency controls.
Frequently Asked Questions
Common questions about the assessment
Get Started
Ready to assess your quantum exposure?
We can walk you through the full assessment methodology, the CBOM format, the risk model and what a typical engagement looks like for your sector.