How to Assess Quantum Readiness

Quantum readiness assessment is the process of evaluating how prepared your organisation is for the arrival of cryptographically relevant quantum computers. It's the first step in any post-quantum cryptography (PQC) migration project.

Step 1: Inventory quantum-vulnerable assets

Every RSA and ECC key in your infrastructure is vulnerable to Shor's algorithm. The first step is to find them all:

• Scan your public surface for TLS certificates (RSA, ECC keys)
• Identify SSH keys (RSA, ECDSA)
• Find code-signing certificates and internal PKI
• Document every algorithm and key length

Step 2: Score quantum risk

For each asset, calculate:

• Shor's risk (asymmetric): RSA and ECC keys are fully broken — assign highest risk
• Grover's risk (symmetric): AES and SHA get a quadratic speedup — AES-128 drops to 64-bit security
• Exposure factor: internet-facing = highest, internal = medium, offline = lowest
• Business impact: what happens if this key is broken? (data exposure, impersonation, fraud)

Step 3: Build a PQC migration roadmap

Prioritise migration based on risk × impact:

• Phase 1 (immediate): Replace RSA-1024 and expired certificates on public-facing servers
• Phase 2 (6–12 months): Migrate critical infrastructure to hybrid classical+PQC (TLS 1.3 with ML-KEM)
• Phase 3 (1–2 years): Full PQC migration for all assets

Step 4: Monitor and maintain

Quantum readiness is not a one-time project. New servers are deployed, new certificates are issued, and the quantum threat landscape evolves. QROS continuously scans your cryptographic risk surface and alerts you to new exposures.

FAQ