A compact, ready-to-use starter kit to manage quantum-computing risk — aligned to the NCSC UK migration timeline (2028 · 2031 · 2035), with a living vendor tracker for IBM, Google, Microsoft and other leaders.
A feeling is: the topic has crossed your path once or twice — an article, an announcement by IBM, Google or Microsoft, a colleague who mentions it — and there is a vague sense that it may become relevant someday. A plan is: an inventory, an owner, and a date. The difference is not attitude or a sense of urgency, it is translation: as long as no one can say which systems this affects, who is responsible, and when it must be done, there is no plan — however serious the feeling is. And you cannot show a feeling to an auditor or report it to a board.
Everyone knows “quantum” is coming. Hardly anyone has translated it into an inventory, an owner, or a date. Meanwhile the clock keeps running: data encrypted and intercepted today could be decrypted in ten years once quantum computers are capable — the “harvest now, decrypt later” risk.
Waiting until the problem feels urgent means waiting until it's too late to migrate calmly.
The NCSC UK published a three-phase timeline in 2025 for migration to post-quantum cryptography. This kit translates that timeline directly into an internal step-by-step plan — so “when do we need to be done” is never a guessing question.
Map which systems and data depend on cryptography, and where the biggest exposure sits.
Migrate the highest-risk systems first, based on sensitivity and retention, not convenience.
Complete the migration for all systems, services and products — including the awkward leftovers and legacy technology.
Each document is built to work with the others — the inventory feeds the roadmap, the roadmap feeds the board slides.
Self-assessment on 5 domains — governance, discovery, vendors, risk, skills — mapped to the NCSC phases.
The heart of the kit: systems, algorithms, vendor dependency, priority and migration status in one register.
The NCSC phases translated into an internal 1/3/5-year plan with owner, target date and status per activity.
Pre-filled with IBM, Google, Microsoft, NIST, NCSC UK and others — plus room for your own core vendors.
Working risk-scoring model (retention × sensitivity × exposure) with automatic risk-level classification.
15 questions in 4 sections to assess vendors on their post-quantum roadmap.
Ready-made board presentation — threat, timeline, status, roadmap, risks and requested decisions.
Below is a fragment of the Quantum Risk Register — the risk score is calculated and coloured automatically, ready to use without further formatting.
| Risk | Retention | Sensitivity | Exposure | Score | Level |
|---|---|---|---|---|---|
| Client files — long-term storage | 5 | 5 | 4 | 100 | Critical |
This kit is reviewed regularly against changing regulation. The recent history is below; the kit version is bumped with every change.
| Date | Version | Document | What changed |
|---|---|---|---|
| 2026-08-21 | 1.0 | All 7 files (1 ZIP) | First product release. |
One-time purchase. Immediate digital delivery. Every document is yours to edit, rebrand and publish under your own name.
The complete starter pack: assessment, inventory, roadmap, vendor tracker, risk register, vendor questionnaire and board presentation.
Buy the starter pack that puts your cryptographic inventory, roadmap and board story in order in one go.
Buy the kit — €199
