Services · Advisory
A defensible PQC migration plan in six weeks.
A fixed-scope engagement that produces the cryptographic inventory, the risk register, and the sequenced plan you need to start migrating — or to answer a regulator or customer questionnaire.
The problem
Why this exists.
Most teams know they need to act on post-quantum cryptography and cannot answer the first question: what are we actually running? A stalled inventory becomes a stalled program, and the deadlines do not move.
What changes
- A complete cryptographic inventory across agreed scope
- A prioritized migration roadmap tied to specific deadlines
- A board memo that explains exposure in business terms
- An agreed algorithm policy to prevent new drift
Delivery
How the engagement runs.
A sequence you can plan around, with a decision or a working artifact at the end of every phase.
- 01
Week 1 — Scope
Agree the systems in scope, the data-lifespan classes, and the decision the sponsor needs to make.
- 02
Weeks 2–3 — Discover
Run discovery across cloud, build pipelines, and agreed data-center scope; resolve ownership gaps.
- 03
Weeks 4–5 — Prioritize
Score by HNDL exposure, obligation, criticality, and migration cost; sequence the roadmap.
- 04
Week 6 — Decide
Present the plan, brief the board, and leave behind the policy and the first 90 days.
Deliverables
What you keep.
- Cryptographic bill of materials (CycloneDX)
- Quantum-vulnerable asset register with owners
- Risk-scored remediation roadmap
- Board and executive briefing pack
- Draft algorithm policy and migration standards
- 90-day execution plan with cost estimate
Fit
Who this is for.
- Federal contractors facing the FAR PQC rule
- Financial institutions with long-lived customer data
- Software vendors whose customers now send PQC questionnaires
- Security leaders who need a plan before they can request budget
Typical duration
6 weeks
Scope and elapsed time depend on access, estate size, and change control. We confirm both in writing before work starts.
Not sure which engagement fits? Start with the ten-minute assessment, or ask us directly.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.