How Ready Is Your Cryptography, Really? Take the PQC Lab Assessment 

You can’t plan a migration from a guess 

Ask five people on your security team how ready you are for post-quantum cryptography (PQC). You might get five different answers. 

One person points to a working group. Another mentions a vendor roadmap. A third isn’t sure anyone owns the work yet. Maybe some other is still catching up with what PQC is. 

That spread matters, because a safe migration takes years and the window to start keeps shrinking. The PQC readiness assessment in PQC Lab replaces the guesswork with a structured starting point. 

In about two minutes, you answer six questions. You get a clear read on your post-quantum cryptography readiness: what’s in place, where you’re strongest, and what to tackle next. 

Where the assessment fits on the road to quantum resilience 

Quantum readiness happens in phases. You move from understanding your exposure to modernizing the cryptography your business depends on. Keyfactor maps that journey as the five stages of quantum resilience: 

Phase 1: Awareness and Alignment: Secure buy-in across teams and make clear who owns the work. 

Phase 2: Discovery and Planning: Find every certificate, key, and algorithm, then set a baseline for the plan. 

Phase 3: Risk Prioritization: Rank systems by data sensitivity, exposure, and shelf life so critical fixes come first. 

Phase 4: Agility and Automation: Automate cryptographic operations so security, identity, and infrastructure teams share one playbook. 

Phase 5: Resilience: Build crypto-agility into your processes so you can swap algorithms without disruption. 

The assessment lives in Phase 2, where benchmarking your readiness sets the baseline. Although, it works from any starting point. Your answers place you on the road wherever you are today. 

What the PQC readiness assessment measures 

Your result reflects six connected areas of readiness. Each question offers five statements, running from first steps to an established practice. Here’s what the two ends of each scale look like. 

Program ownership 

This area asks who owns and coordinates the work. 

• At level one, people discuss PQC, but no person or team is accountable for it. 

• At level five, PQC and crypto-agility belong to a standing operating model with executive reporting, measures, and recurring investment. 

Everything else gets easier once you establish accountable ownership. 

Cryptographic observability 

This area asks how clearly you can see where quantum-vulnerable cryptography is used. 

• At level one, you don’t have a reliable view. 

• At level five, continuous observability feeds your change, asset, vulnerability, or risk-management processes. 

Most teams start closing the gap with targeted cryptographic discovery across known high-value systems. 

Risk prioritization 

This area asks how you decide what migrates first. 

• At level one, you haven’t defined how to set migration priorities. 

• At level five, you review priorities on a set cadence as business needs, threats, standards, regulations, and dependencies change. 

To prioritize by risk, teams weigh data sensitivity and longevity, business criticality, exposure, regulatory obligations, and migration complexity. 

Ecosystem readiness 

This area covers the external dependencies that shape your migration. 

• At level one, you haven’t assessed vendor, supply chain, hardware, software, or service dependencies. 

• At level five, PQC readiness is part of procurement standards, architecture decisions, vendor governance, and lifecycle planning. 

Mapping dependencies shows where migration timing may sit outside your direct control. 

Testing and transition 

This area tracks your move from planning into technical validation and migration. 

• At level one, you haven’t selected use cases or started testing. 

• At level five, you can repeat cryptographic transitions across systems with established patterns, policies, automation, and validation. 

Pilots that test interoperability, performance, and fallback behavior become the raw material for repeatable migration patterns. 

Operational governance 

This area asks how you’ll sustain readiness after the first migrations. 

• At level one, PQC is a one-time project with no ongoing governance. 

• At level five, continuous monitoring, regression testing, remediation, and crypto-agility sit inside your security and technology governance. 

That’s where crypto-agility as an ongoing capability takes hold. 

How to answer for an honest result 

For each question, pick the statement that best reflects your organization’s current position. Answer for where you are today, rather than where you plan to be. 

If progress varies a lot across teams, environments, or systems, choose the earlier state as your starting point. An honest baseline produces focus areas you can act on. An optimistic one hides the gaps you most need to see. 

How your result is calculated 

Each answer maps to one of five readiness levels. Your overall stage starts with the median of your six responses. One standout area can’t pull the whole result up on its own. 

Guardrails add a second check. Phases build on top of one another. Therefore, guardrails are necessry to keep strong progress in one area from masking a missing foundation in another. Advanced testing, for example, shouldn’t hide a program with no clear owner. 

The web result keeps things simple, so it doesn’t show answer levels, numeric scores, medians, or guardrail logic. The downloadable report includes a plain-language statement of the method. 

What you get when you finish 

Your results arrive in two forms: a concise web result and a downloadable report that includes a breakdown of your readiness in detail. Both use the same stage, composition, and focus-area copy. 

Your stage and what it means 

The result opens with your stage, a headline, and a short summary. A respondent in the third stage sees the label “Stage 3 of 5 | Risk Prioritization” and the headline “You are turning insight into priorities.” 

The summary explains what that means in practice. At this stage, you can identify your highest-risk exposure and you’re shaping a coordinated roadmap. Your next move is to test the assumptions behind that plan. 

Each result also describes what progress looks like. For the third stage, that means priority use cases are tested and the first migration wave is defined. 

Stage	Result headline
Awareness and Alignment	You are building the foundation
Discovery and Planning	You are building a clearer picture
Risk Prioritization	You are turning insight into priorities
Agility and Automation	You are putting the plan into motion
Continuous Resilience	You are operating with crypto-agility

A six-area readiness breakdown 

Next, you get one plain-language statement for each of the six areas, tied to the answer you chose. Level numbers stay hidden, so you see what your answers indicate. 

In the third-stage example, the program ownership statement confirms that sponsorship and program leadership are in place. The testing statement notes that you’ve identified where to test first and gathered the teams to begin. 

Reading all six side by side shows where progress is strongest and where it lags. 

Three focus areas to move forward 

The result then highlights three areas most likely to help you move forward. Selection starts with any areas that triggered a guardrail, then adds your lowest-scoring areas. 

Each focus area comes with one broad statement of direction. In the third-stage example, the three focus areas are: 

• Bring external dependencies into the plan 

• Test a priority use case 

• Put clear ownership in place 

Treat them as starting points rather than a prescribed migration plan. They don’t assign owners, deadlines, or completion criteria. 

A downloadable report to share 

The report repeats your full web result and adds three things: 

• Three educational resources mapped to your stage 

• A plain-language explanation of how your result was calculated 

• A cover with your name, organization, and assessment date 

The report is useful for briefing leadership. It gives sponsors and stakeholders one shared view of where you stand and what comes next. 

What the assessment is and isn’t 

The assessment is a quick self-assessment that reflects the answers you provide. It gives your teams a starting point, a common language, and a direction. 

It isn’t a technical audit, compliance determination, certification, or migration plan. Validate decisions against your own environment, requirements, and priorities. 

Take the PQC readiness assessment 

Two minutes and six questions stand between you and a clear baseline. 

From result to next step 

Your PQC readiness assessment result tells you where you stand. These three moves help you act on it. 

Talk with a Keyfactor PQC expert to connect your result to your environment. An expert can answer questions about discovery, prioritization, testing, and migration. 

Then read the deep dive for your stage. Each one goes deeper into what that stage involves and how to move to the next. 

Finally, explore PQC Lab for hands-on help: 

• Lessons from the Lab videos with answers from the PQC experts behind the lab 

• Short guided walkthroughs on surfacing and assessing cryptographic vulnerabilities 

• A free sandbox for testing quantum-resilient certificates, code signing, and lifecycle management 

The sandbox spins up a working environment in minutes, with no complex setup. Start the free test drive.