then QCI-P1, Independent Assessment
Open PDF
· March 10, 2027For credit unions and community banks
Your quantum risk is in your vendor list.
You inherit your cryptography from your core processor, card processor and digital banking vendors. In 30 days we find out which of yours are ready, check what they send against a free public standard, and give your board a one-page answer.
From $5,000 for up to 10 critical suppliers. Built on QCI-QS1, the free standard also used by banks, insurers, healthcare and critical infrastructure.
Supplier readiness
Evidence-gap report
Illustrative · synthetic data
3
Evidenced
4
Incomplete
3
Not evidenced
Core banking processor
IncompleteRoadmap published; no product or version dates
Card processor
EvidencedDated roadmap and test results for deployed version
Wire and ACH gateway
Not evidencedResponse says 'monitoring NIST'; no plan
Asked
Checked
Board-ready
Most vendors sell urgency. We publish the standard.
23 documents. Free. No form.
The standard, its annexes, sector supplements and guides. Pick the one for your role, or take the lot.
Start here
One document for your role. The rest can wait.
The 90-day establishment sequence
Open PDFWhat drives migration cost and sequence
Open PDFthen QCI-QS1-C2, Remediation and Migration Providers
Open PDFthen QCI-T1, Discovery Evidence Acceptance Checklist
Open PDF23 documents, 2.4 MB. No form required.
Where do I start?
Find the line that sounds like your situation.
- 01 · FreeFree standard"You want to know what good looks like."Go
- 02 · FreeFree screening"You want a rough idea of where you stand."Go
- 03 · From $5,000Supplier Readiness Pilot"Your board asked what your vendors are doing about quantum risk."Go
- 04 · $69,000Readiness Program"You need a documented baseline across your own systems."Go
- 05 · $40,000Board Governance"Your directors need an oversight record the minutes can show."Go
- 06 · $8,500 / monthRetainer"You need the record kept current each quarter."Go
This is not a required sequence. Start at any step that fits. Independent assessment is listed separately because it must come from someone who did not build the work (Independence policy).
Step 03, in detail
How the pilot works.
From $5,000 for up to 10 critical suppliers, $10,000 for up to 25. 30 days from the scoping call to your board briefing.
- 01
Start free.
Read the QCI-QS1 standard or take the 26-question screening. No form, no fee.
- 02
A 30-minute scoping call.
We agree your 10 or 25 critical suppliers: core processor, card processor, digital banking, managed services. You decide whether to go ahead.
- 03
We ask your suppliers. Weeks 1 to 3.
Requests go out on your letterhead, answers are checked against QCI-QS1 Annex C, and we follow up on the ones that stall.
- 04
You get the answer. Week 4.
An evidence-gap report, a remediation register and a one-page board briefing. If you need more, the full Supplier Attestation Round or the Readiness Program comes next.
Scope a pilot
The pilot doesn't issue a Q-Risk Score or a G70 determination. See what it includes.
The decision problem
Quantum Risk Isn’t One Problem. It’s Three Exposures.
Quantum risk is not a single deadline. It is three separate surfaces, each with a different business consequence and a different wait/act decision.
Act now
Data gets read.
Harvest-now-decrypt-later attacks target data with a long secrecy shelf life. If your data must stay confidential for 10+ years, waiting is already late.
RegulatoryIPPrivacy
Already late
Identities get forged.
Digital signatures and certificates rely on quantum-vulnerable cryptography. Identity trust breaks before encryption does.
FraudAccess controlAudit failure
Needs a plan
Payments lose proof.
Settlement, transaction signatures, and non-repudiation depend on cryptography quantum computers can forge.
DisputesSettlement riskCompliance
The organizing principle
Trust must survive the transition.
Quantum readiness is not ultimately about replacing algorithms. It is about preserving the mechanisms organizations rely on to prove:
- Who sent it.
- Who approved it.
- Whether it changed.
- Whether it remains confidential.
- Whether the evidence can still be trusted.
Select an exposure to see which proofs it must preserve.
Trust proofs identity must preserve
- Who sent it.Authenticity of origin: the signature, certificate, or credential behind a message or action.
- Who approved it.Attributable authority, a decision on the record, tied to someone who can be held to it.
- Whether it changed.
- Whether it remains confidential.
- Whether the evidence can still be trusted.Verifiable assurance, the records and anchors you rely on to prove any of the above.
What must survive
The ability to prove who or what is acting.
Certificates, signing keys, customer authentication, machine credentials, and AI-agent credentials all prove who did what. What must survive is attribution: origin, authority, and the evidence behind both.
Quantum threatens authenticity here. The algorithm change is the mechanism; the proof is what you are actually defending.
This is why QCI-QS1 exists. Not as PQC consulting, but as continuity of institutional trust through the cryptographic transition. Asymmetric cryptography is what proves who did what: certificates, signing keys, customer authentication, machine credentials, and AI-agent credentials. That is not merely a cryptography problem. It is a trust infrastructure problem.
Think earlier. Act when the evidence says to act.
Quantum vendors want to sell you solutions you do not need yet. We measure where you actually stand, tell you when to act, and tell you when to wait. Knowing when not to spend is part of the service. Separate real exposure from vendor-driven urgency. Every call is recorded as evidence you can defend later. And because the three surfaces move on different clocks, "wait" on one is fully compatible with "you are late" on another.
A standard regulators and auditors can cite.
QCI-QS1 is the free, citeable standard for quantum risk governance. Published in full. Download it, cite it, adopt it. No form wall and no license fee. Mapped to DORA, NIS2, NCUA, HIPAA, and FFIEC.
Version 2.3, published September 23, 2026, defines five evidenced Q-Risk pillars and three scoring gates: G60 for inventory coverage, G70 for critical supplier attestations, and G80 for a representative crypto-agility test.
Download QCI-QS1 v2.3Why it matters now
Harvest now, decrypt later is already happening.
Adversaries collect encrypted data today to decrypt it once quantum capability arrives. Any data that must stay confidential for ten years or more is already exposed. When your board asks, the question is not whether you saw it coming. It is whether you measured it.
Check your vendors.
Find out in 30 days which of your critical suppliers are ready, and what your board should decide.
Scope a supplier readiness pilotQ-Risk intelligence, no hype.
Governance-grade updates on PQC compliance, vendor readiness, and regulatory movement. The credit union and community bank PQC briefing leads, twice a week.
Stay Updated
Get the latest insights on quantum risk governance delivered to your inbox