What gets measured gets funded.
Boards ask a simple question: are we ready? The honest answer has several parts. You might know your cryptography well but have no owner for the program, or be moving fast on easy systems while the riskiest ones wait.
The index weights every score by the criticality of the systems behind it, so migrating low-risk systems first can’t make the picture look better than it is.
What you get
- Visibility scoreHow completely you know your cryptographic estate.
- Governance scoreOwnership, policy, budget and reporting for the transition.
- Exposure scoreHarvest-now risk across your most sensitive, longest-lived data.
- Crypto-agility scoreHow quickly systems can change algorithms.
- Momentum scoreProgress against your plan, weighted by system criticality.
- Scenario modelingWhat changes if Q-Day comes sooner, or a vendor slips.
Five scores, not one.
A single number hides the story. We score each dimension separately against your sector’s benchmark, so leaders can see where to invest.
Example: regional bank
illustrative · 0–100Bar shows the client’s score. The tick marks the sector median. Higher is better on every dimension.
The process.
A typical engagement, start to finish. We agree scope and access before any work begins.
- InterviewsStructured sessions with security, engineering, risk and procurement.
- EvidenceReview CBOM, policies, vendor responses and project plans.
- ScoreCriticality-weighted scoring across five dimensions.
- BenchmarkCompare against sector peers and the EO 14412 and OMB M-26-15 milestones.
- BriefBoard summary and an investment-ranked roadmap.
Before you ask.
How often should we re-score?
Annually for most organizations, or after a major milestone. The scores are designed to show progress over time.
Where do the benchmarks come from?
Anonymized results from our engagements, combined with the dated federal milestones in EO 14412, OMB M-26-15 and CNSA 2.0. We show sample sizes alongside every comparison.
Can the index replace an audit?
No. It measures readiness at the program level. An audit examines the implementation detail behind those scores.