Know which of your cryptography has a shelf life.
Record where the business depends on cryptography a quantum computer would break, get every entry labelled against the published standards, and keep it in the same record as the rest of your compliance evidence.
The exposure is present tense, even though the threat is not
A quantum computer capable of breaking today's public key cryptography does not exist yet. That is not the same as having time.
Encrypted traffic can be captured now and stored, and decrypted later by whoever holds it when the capability arrives. Anything you transmit today that must still be confidential in ten or fifteen years is already exposed to that, and no action taken later can retrieve it. The same applies to any key that protects something long-lived.
For a firm holding client assets on distributed ledger infrastructure, the awkward part is not the cryptography. It is being asked what you depend on and not having an answer that survives being written down.
What the module actually does
Four things, all of them a record rather than an assessment.
- ✓A cryptographic inventory you writeThe systems your firm runs and the algorithm each one depends on. You enter it, because you are the only one who knows it. Nothing is discovered, inferred or assumed on your behalf.
- ✓Each entry labelled, and sourcedEvery algorithm you record is matched against a lookup table and labelled with one factual sentence and the NIST publication that supports it. Which algorithms fall to Shor's algorithm and which survive is settled and citable, so the label is arithmetic rather than an opinion.
- ✓Vendor migration statusMost of a firm's cryptographic exposure sits inside somebody else's product. The module records where each vendor has got to, so the question of who you are waiting on has an answer.
- ✓A migration roadmap with a dateSequencing, dependencies, who owns each step, and a target completion date. Written by your firm, held with the rest of the evidence, and dated so it can be shown to have existed before it was asked for.
Five labels, and what each one means
There is no sixth label meaning "probably fine". An algorithm the table does not recognise says so.
| Label | What it states |
|---|---|
| Broken | Shor's algorithm defeats it outright. A larger key does not help. |
| Weakened | Grover's algorithm halves the effective security. Survivable, but reduced, and the reduction is quantified rather than described. |
| Unaffected | No meaningful quantum advantage is known at the sizes in use. |
| Post-quantum | A NIST-selected post-quantum algorithm, published as a standard in FIPS 203, 204 or 205. |
| Unknown | Not recognised. The module says so rather than guessing, because a wrong label here would sit in a compliance record as though it had been established. |
What it refuses to do
These are not gaps. They are the reason the output is worth putting in front of a supervisor.
It does not score you. There is no readiness percentage and no aggregate figure. A number like that is an opinion wearing precision, and once it is in a record it gets quoted back as though it were measured.
It does not recommend. No suggested migration dates, no "replace this by", no prioritisation. The moment a classification starts advising rather than citing, it has become a judgement your firm did not ask for and your compliance record then carries as established fact.
What you get is the inventory you entered, each row labelled and sourced. What to do about it is your decision, and your regulator's.
Included, not an add-on
Quantum readiness is part of Calder Standard at one price. There is no separate module to buy and no upgrade to reach it.
That is a deliberate decision rather than a pricing accident. Cryptographic exposure is not a topic sitting alongside your compliance record, it is part of it: it bears on the principles covering cyber security and operational resilience, and the question a supervisor asks about it is the same kind of question they ask about everything else. Answering it out of a different system, or not at all because it sat behind another invoice, would make the record less useful precisely where it matters.