QuantumReady
The 2027 plan needs an inventory first
By 31 March 2027 a CII owner submits a quantum-safe migration plan to CSA. That plan cannot be written without knowing what cryptography is already deployed, and discovery is the cheapest and most skippable part of the whole exercise.
Three deadlines, in order
The dates are the reason to start, not the reason to panic. Each one needs the same underlying register.
31 March 2027
CII owners submit their quantum-safe migration plan to CSA. A plan without an inventory is a schedule with nothing attached to it.
1 January 2028
New CII systems should support quantum-safe algorithms or be quantum-safe ready. The design decision arrives before the migration does.
31 December 2031
Migration complete. Vulnerable cryptography is no longer in use across CII systems.
Migration waves one to three, each item tied to an owner, a date and a CSA milestone.
The five Handbook areas, as a working plan
The workbench is organised around risk and inventory, governance, technology, training and vendors. It does not reproduce the Handbook or administer the official Quantum Readiness Index, and it says so on every export.
| Area | What the workbench holds |
|---|---|
| Risk and inventory | Crown jewels, the cryptographic register, exposure and the systems each finding belongs to |
| Governance | Owners, policy answers, target dates and the people accountable for each wave |
| Technology | The remediation per finding, with the recommended replacement and its priority |
| Training | The internal capability the plan assumes, and the gaps it has to close |
| Vendors | The supplier register and the cryptographic questions each supplier has to answer |
Inside your network, if that is the requirement
Offline scanner
One download, runs on your infrastructure over repositories, container images, artifacts, hosts and cloud accounts. Source code never leaves your side; reports upload only when you choose.
Air-gapped
Where the estate has no route out, the runner still produces the inventory and the CBOM locally. Bringing it back is a file transfer you control.
Enterprise terms
Contract terms, security review, custom retention and a named contact, quoted per engagement rather than sold off a price list.
Start where it matters
The Handbook says to begin with your highest risk systems rather than everywhere at once. The workbench does the exposure arithmetic that tells you which those are.