PQC Readiness Scorecard — Aeroxis

Ready to assess your PQC readiness?

This assessment covers 5 key areas across 15 questions. Answer honestly to get an accurate picture of where your organization stands.

Takes about 5 minutes
Instant maturity rating with recommendations
Detailed report sent to your email

Category 1 of 5

Cryptographic Practices

Do you maintain an inventory of cryptographic algorithms used across your systems?

No inventory exists Partial — we know some but not all Yes — comprehensive inventory maintained Yes — automated discovery and continuous tracking

Have you identified which systems rely on RSA, ECC, or Diffie-Hellman key exchange?

No — we haven't assessed this Partially — some systems are mapped Yes — all public-key cryptography is documented Yes — and we've begun testing PQC replacements

Are your TLS/SSL configurations regularly audited for weak cipher suites?

No — we don't audit TLS configurations Occasionally — ad-hoc checks only Yes — scheduled quarterly reviews Yes — automated continuous monitoring with alerts

Category 2 of 5

Data Sensitivity & Exposure

Do you classify data by sensitivity level and understand which data requires long-term confidentiality?

No classification exists Informal classification — no formal process Yes — formal classification policy in place Yes — classification drives encryption and retention policy

Are you concerned about 'harvest now, decrypt later' attacks on your encrypted data?

Not aware of this threat Aware but haven't assessed the risk Assessed — some data at risk, mitigation planned Mitigated — sensitive data uses hybrid or PQC encryption

How long must your most sensitive data remain confidential?

We haven't determined this Less than 5 years 5-15 years 15+ years — we need long-term quantum resistance

Category 3 of 5

Regulatory & Compliance

Are you tracking NIST post-quantum cryptography standards (FIPS 203, 204, 205)?

Not aware of these standards Aware but not actively tracking Actively tracking — no implementation yet Implementing — piloting NIST-approved algorithms

Does your organization have a timeline or mandate for PQC migration?

No — PQC isn't on our roadmap Discussed informally — no formal timeline Formal timeline exists — migration within 3 years Already migrating — some systems use PQC algorithms

Are your industry regulators requiring or recommending PQC readiness assessments?

No — not applicable or unaware Recommendations exist but not enforced Required — we have a compliance gap to close Compliant — meeting all current requirements

Category 4 of 5

CI/CD & DevSecOps Maturity

Can you update cryptographic libraries across your systems without major downtime?

No — updates require significant manual effort Partially — some systems are automated Yes — CI/CD handles most library updates Yes — fully automated with rollback capability

Do your CI/CD pipelines include cryptographic policy checks or algorithm scanning?

No security scanning in pipelines Basic SAST/DAST — no crypto-specific checks Crypto-aware scanning for deprecated algorithms Full crypto policy enforcement — PQC compliance gates

How quickly could you swap a cryptographic algorithm across your infrastructure?

Months — it would require a major project Weeks — with coordinated effort Days — most systems are abstracted Hours — crypto-agile architecture in place

Category 5 of 5

Key Management & Agility

Do you use a centralized key management system (KMS)?

No — keys are managed per-application Partially — some applications use a KMS Yes — centralized KMS for most systems Yes — enterprise KMS with automated rotation and audit logging

Can your key management infrastructure support larger key sizes required by PQC algorithms?

Unknown — haven't assessed Likely not — current infrastructure has limitations Partially — some systems can accommodate Yes — infrastructure is ready for PQC key sizes

Do you have a crypto-agility strategy that allows algorithm negotiation and fallback?

No — algorithms are hardcoded Limited — some protocol-level negotiation (e.g., TLS) Moderate — abstraction layers exist in key systems Full crypto-agility — configurable algorithms across the stack

Final Step

Get Your Results

Enter your details to receive your personalized PQC readiness report.

Full Name *

Work Email *

Company

Job Title

Your information is used solely to deliver your report. We respect your privacy.