Skip to content
Try the scanner

A BETTER TEAM CONVERSATION

Six questions.
A clearer starting point.

What should you check before a post-quantum migration? Start with your inventory, system context, dependencies, owners, pilot checks and rollout decisions.

Six questions for your team

A self-reported planning exercise, not a repository scan or security assessment. Answers stay in this browser unless you copy or share a result link. That link contains your six yes/no answers—no account or repository details.
01 Have you documented where your systems use cryptography?
02 Have owners confirmed what each cryptographic operation protects?
03 Have you mapped vendor, library and protocol dependencies?
04 Does each migration workstream have an accountable owner?
05 Have you agreed a representative pilot and its acceptance checks?
06 Have you documented technical approval, rollout and verification steps?

What should you do next?

Start with any unanswered question. Record the missing evidence, the person who can confirm it, and a practical next action. A source-level observation is a starting point for investigation; it does not establish production use or certify security.

Where this fits.

These are QCAI’s planning prompts, informed by NIST NCCoE’s migration and discovery work. They are not an official NIST assessment or certification.

Explore source-level discovery →