I Rebuilt My Free PQC Readiness Assessment on the PQC Migration Framework v3.0
Table of Contents
G-Cloud 15 is the framework UK public-sector bodies use to buy cloud hosting, software and support services. One supplier on it, Axis12, publishes what it charges to assess an organization’s cryptography for post-quantum risk. According to its pricing document, a one-time assessment costs £6,000 to £28,000 before VAT, depending on headcount and coverage. A year of continuous assessment costs £35,000 to £115,000 before VAT. Other PQC suppliers on G-Cloud 15, Capgemini and Zanloop among them, publish day rates for their consultants but no price for the service.
I have just rebuilt the free self-assessment I have offered on PostQuantum.com since August 2025. The PQC Readiness Self-Assessment Scorecard now uses the scoring method of my PQC Migration Framework v3.0. It rates seven domains on a scale from 0 to 5 and takes the weakest as the organization’s readiness level. It also lists the dated regulatory obligations for the jurisdictions and sectors you select. It is free and needs no account or email address. Your answers never leave the browser you type them into.
Run it before you hire anyone, including us. A consultant’s days are better spent checking your evidence than asking questions your team can answer in twenty minutes.
What a Paid PQC Assessment Adds
Paid PQC assessments come in two kinds. The scorecard replaces neither. Axis12 offers the discovery-led kind. It finds the cryptography in the estate with external scans, adding sensors at the higher tiers, then quantifies the risk and proposes an initial remediation plan. In the consulting-led kind, a maturity assessment, consultants ask about the program around that cryptography: who owns it, how complete the inventory is, which vendors will move and when, which deadlines apply, and whether an algorithm can be changed on a planned date. The scorecard’s questions are of this second kind.
Consultants also check the answers. They interview the people who own the systems, read the contracts and the policies, and grade every claim by its evidence. No browser tool can interview people or read contracts, so that verification is what an organization pays a consultant for. The scorecard accepts each answer as given. For each question, it shows what must be true before you answer Yes.
The scorecard does produce what a maturity assessment report contains: the framework’s domains and levels, a gap list for every domain, actions for the next three months, the next year and beyond, the regulatory obligations for your selection, and a board summary. If you then hire a firm, start the first meeting with the scorecard’s findings file instead of a blank questionnaire.
Why Run the Scorecard
The readiness level is the weakest domain’s level
Version 2 combined nine sections into one percentage, so an organization with strong governance answers and no cryptographic inventory could still earn a respectable score. Version 3 applies the framework’s rule that “the weakest domain constrains overall readiness.” A domain is rated at a level only when every question at that level and below is answered Yes. The readiness level is the lowest of the seven domain levels. The results show which domain is lowest and list, for each domain, the questions not yet answered Yes at its next level. The framework’s targets are Level 2 in every domain by the end of the program’s first year, Level 3 by the end of the second and Level 4 in at least five of the seven by the end of the third.
A separate Crypto-Agility result
Crypto-Agility is one of the seven domains. The scorecard also reports its level as a second headline result. As I argued earlier this month, the PQC migration is only the first test of a capability the organization will need again. Under the framework, an organization demonstrates that capability by rehearsal: a timed algorithm change in staging, with the rollback exercised. An organization can be well along on migration and still unable to change an algorithm on a date it chooses. I report Crypto-Agility separately so that gap is visible.
Dated obligations for your jurisdictions and sectors
You tick the jurisdictions and sectors you operate in. The scorecard then lists the regulations, mandates and standards that apply, from a roster of 45 instruments dated 18 October 2026: 40 from 22 jurisdictions and five global ones, such as PCI DSS and the CA/Browser Forum’s ballot on TLS certificate lifetimes. I built the roster from my Global PQC Migration Clock and corrected it this month after a fact-check against the primary documents. Thirty-nine of the 45 have an enforcement tier from 1 to 5. Tiers 1 to 3 are mandatory. Tiers 4 and 5 are guidance.
The headline results at the top show the earliest dated obligation for your selection. I put the dates next to the levels because regulators and clients have already set the deadlines. Boards fund obligations more readily than threat estimates.
A one-page executive summary for the board
The executive summary is a one-page PDF laid out on the framework’s Quarterly Board Report Template. It gives the readiness level and its trend, the Crypto-Agility level, the earliest obligation, the domain profile, the domains to escalate and the top five actions. A note at the foot of the page lists the board KPIs a self-assessment cannot measure, such as coverage and trust, which come from program data. In Board-Level PQC Risk Governance I set out the indicators directors should receive each quarter and the questions to ask when one turns amber or red.
Progress between assessments
Under the framework, an organization re-assesses every six months and escalates to its steering committee any domain that stays flat across two consecutive assessments. The scorecard keeps a dated history in your browser. It flags any domain whose level has not changed between two assessments at least 90 days apart. To move the answers and the history to another browser or a colleague, save the assessment file.
Your Answers Stay in Your Browser
A completed readiness assessment shows where an organization is weakest, so handle it like any sensitive security document. In my framework I give the same advice for the cryptographic bill of materials: no other part of a migration program holds as much intelligence value in one queryable file. When a supervisor or counterparty asks for the CBOM, I recommend sending a signed attestation instead of the document.
The scorecard sends nothing to a server. Your answers, notes and history are saved in the browser’s local storage. The PDFs, CSV files and CycloneDX attestation are built on your machine. When you create a PDF, your browser downloads the PDF library from PostQuantum.com and sends no data with that request. To delete everything the scorecard has saved, use the button in the “Your data” panel at the foot of the scorecard. Closing a private browser window has the same effect.
What Changed From Version 2
If you used the old scorecard, your browser may still have its answers saved. Version 3 offers to import the ones that map to its questions and marks each for review. It never imports a No, because version 2 stored unanswered questions as No. A version 2 percentage cannot be compared with a version 3 level.
How to Use the Scorecard
- Pick a question set. Quick has 35 questions, one per level in each domain, and takes about ten minutes. Standard has 63 questions and takes about 20 minutes. Full has 87 and takes about 30. Start with Quick for a first reading. A larger set adds questions, so when you switch, a domain’s level can stay the same or drop, but never rise.
- Tick your sectors and jurisdictions. When you tick a sector, Standard and Full gain four or five questions from that sector’s module. When you tick a jurisdiction, its obligations appear in the results. Merchants that take cards should tick Payments.
- Answer against the evidence bar. Open “What counts” under any question to see what must be true before you answer Yes. Answer Partial when only part of it is true, and Don’t know when nobody in the room can say. A Don’t know scores zero, and the domain stays below that question’s level until someone answers it. You will find every Don’t know in the results, listed as a knowledge gap for the people who can answer it.
- Read the results from the top. First you will see the readiness level and the lowest domain, the Crypto-Agility level and the earliest obligation. Below them are a suggested first step for the lowest domain, the top five actions and a next-level checklist for each domain.
- Export the reports and the data files. The full report and the one-page summary are PDFs. The findings CSV contains every open requirement with its recommended actions, ready to load into a tracker. The requirements for each domain’s next level come first, ranked. The CycloneDX 1.7 attestation contains your answers in a machine-readable format for tools that read CycloneDX. The assessment file contains everything, for moving the assessment to a colleague or another browser.
- Run it again in six months. The trend view shows which domain levels changed since your previous assessment.
A consulting firm can scan your estate and test your answers against evidence. The scorecard can do neither, but it costs nothing and gives a first reading in about ten minutes. Whoever you hire can start from its findings file.
