PQC Ready · practical transition guidance
PQCEMM: enterprise post-quantum maturity
Understand PQCEMM, PQC Ready’s enterprise maturity framework, and turn quantum-risk evidence into practical transition decisions.
Published and reviewed 15 September 2026 · PQC Ready, a brand of SDTC Solutions Ltd
A common language for the transition
The Post-Quantum Cryptography Enterprise Maturity Model (PQCEMM) is PQC Ready’s own framework for understanding organisational and technical readiness. This public overview, version 1.0, explains its purpose and assessment outputs. It is not a certification scheme or a replacement for cryptographic testing.
A useful assessment connects leadership decisions to the systems, suppliers and information that depend on cryptography. A technology inventory alone cannot show whether a programme has accountable owners, resources and tested continuity arrangements.
Evidence before confidence
Assessment results reflect the scope and evidence available. Phase 1 answers are self-reported: they help establish a baseline but do not prove that a deployed system is quantum-safe. Deeper discovery and consultant verification can strengthen that evidence.
The application applies a versioned assessment method; Quinn helps interpret and explain the evidence. Scores, assumptions, evidence gaps and priorities should be considered together. An aggregate score must not hide a critical dependency or an unsupported claim.
What the assessment should give you
The practical output is a maturity profile, a record of the evidence considered, areas of uncertainty and a prioritised set of next actions. Use it to assign ownership, decide where verification is needed and agree the next investment decision. Repeat assessments should retain their scope and version so that apparent progress can be examined.
Connecting readiness to existing governance
The mapping is an organising aid: information-security governance connects to ISO/IEC 27001:2022; business impact and continuity planning connect to ISO 22301:2019; risk identification and treatment connect to ISO 31000:2018. Financial-sector teams can also organise relevant evidence around DORA’s ICT risk and third-party oversight requirements.
These connections do not establish conformity, certification or legal compliance. Applicability and control effectiveness require their own assessment. NIST algorithm standards and the NCSC timeline inform technical planning; they do not certify a PQCEMM score.
The maturity levels
- Level 1: Quantum Unaware
- Level 2: Quantum Aware
- Level 3: Quantum Preparing
- Level 4: Quantum Advancing
- Level 5: Quantum Ready
The level describes readiness in the assessed scope. It is not a guarantee that all systems are quantum-safe.
The assessment dimensions
The following dimension names are also published in our glossary.
- A1 – PQC Leadership and Governance
- A2 – Workforce Quantum Awareness
- A3 – PQC Programme Structure
- A4 – Enterprise Integration and Coverage
- A5 – PQC Metrics and Measurement
- A6 – Resource Commitment
- A7 – Supply Chain and External Coordination
- B1 – Cryptographic Discovery and Asset Management
- B2 – Cryptographic Agility and Migration Execution
- B3 – Cryptographic Disruption and Transition Resilience
- B4 – HNDL Risk Management