
Discovery and cryptographic inventory
Identify where traditional asymmetric cryptography is used across applications, APIs, certificates, signing flows, cloud platforms and third-party services.
- Current-state cryptographic inventory across key systems and services
- Initial dependency map covering applications, APIs, certificates and vendors
- Visibility into externally exposed and business-critical cryptographic touchpoints
- Documented view of likely blind spots requiring deeper discovery
- Foundation dataset for risk analysis and transition planning
Approximate duration: 4 to 8 weeks, depending on organisation size and complexity.

Risk assessment and exposure analysis
Assess data sensitivity, long-life confidentiality risk, business criticality, external exposure and the likely impact of delayed transition.
- Initial risk profile by platform, application and data type
- Identification of long-life sensitive data at highest future exposure
- View of operational, regulatory and reputational consequences
- Early understanding of harvest now, decrypt later exposure
- Management-ready summary of priority risk themes
Approximate duration: 3 to 6 weeks, depending on organisation size and complexity.

Roadmap and prioritisation
Create a sequenced plan based on system importance, change complexity, lifecycle constraints, vendor dependencies and organisational risk tolerance.
- Prioritised candidate list for remediation and deeper design
- High-level transition sequence across near, medium and longer term
- Indicative dependency-based delivery phasing
- Clear rationale for what should move first and why
- Board and leadership-friendly roadmap for investment decisions
Approximate duration: 2 to 4 weeks, depending on organisation size and complexity.

PQC transition and crypto agility
Support architecture and planning decisions that improve crypto agility and prepare systems for the adoption of post-quantum standards.
- Crypto-agility design principles for future change
- Transition options for applications, APIs, certificates and integrations
- Architecture guidance for introducing new approved algorithms safely
- Testing and rollback considerations for staged implementation
- Practical view of where vendor engagement or platform change is needed
Approximate duration: 4 to 10 weeks, depending on organisation size and complexity.

Monitoring and governance
Track standards updates, vendor readiness, implementation progress and ongoing risk once the transition is underway.
- Governance checkpoints for milestones, dependencies and decisions
- Tracking model for standards, vendor readiness and residual risk
- Simple reporting view for leadership and steering forums
- Mechanism to keep inventory and roadmap current over time
- Ongoing alignment with Australian regulatory and security guidance
Approximate duration: 2 to 6 weeks to establish, depending on organisation size and complexity.

Executive and stakeholder education
Provide a structured understanding of quantum risk, business drivers, critical milestones and realistic transition expectations across leadership and delivery teams.
- Leadership briefing tailored to the Australian enterprise context
- Common language across cyber, architecture, engineering and risk teams
- Improved awareness of timelines, dependencies and constraints
- Working understanding of what post-quantum transition actually involves
- Better organisational readiness to sponsor, sequence and govern change
Approximate duration: 1 to 2 weeks, depending on organisation size and complexity.