Organisational Readiness
Source: Singapore QRI self-assessment.
Readiness by Domain
Maturity across the five QRI domains. Source: QRI self-assessment.
| Domain | Level | Meaning |
|---|
Findings by Severity
. Click a slice to filter the list below. Source: all scan tools, .
Findings by Domain
. Source: all scan tools, .
External provider Quantum Readiness vs Your Usage
Provider readiness (from public disclosures, 2026) against which providers your questionnaire and scan show you rely on.
| Provider | Readiness | Commitment | You use | Source |
|---|
Organisational Readiness
Readiness by Domain
| Domain | Level | Meaning |
|---|
Findings by Severity
Findings by Type
| Provider | Readiness | Commitment | You use | Source |
|---|
Organisational Readiness
Readiness by Domain
| Domain | Level | Meaning |
|---|
Findings by Severity
Findings by Type
| Provider | Readiness | Commitment | You use | Source |
|---|
Organisational Readiness
Readiness by Domain
| Domain | Level | Meaning |
|---|
Findings by Severity
Findings by Type
| Provider | Readiness | Commitment | You use | Source |
|---|
Organisational Readiness
Readiness by Domain
| Domain | Level | Meaning |
|---|
Findings by Severity
Findings by Type
| Provider | Readiness | Commitment | You use | Source |
|---|
Organisational Readiness
Readiness by Domain
| Domain | Level | Meaning |
|---|
Findings by Severity
Findings by Type
| Provider | Readiness | Commitment | You use | Source |
|---|
Cryptographic inventory by domain. Click a filter graph to narrow the list. Scan: .
Inventory Overview
All findings across the 5 sections. Click a filter to narrow the list.
Network 5 findings
Code 4 findings
Infra 4 findings
Data 4 findings
PKI 5 findings
Remediation Backlog
Every finding, prioritized. Click a row to expand, or click its status to update it. The deadline column follows the selected standard.
Recommended Quantum Integrations — connect a part of your stack to a quantum-ready technology, with the article behind each.
Remediation How-tos
What each finding's action means and how to carry it out.
Rotate a TDE key to ML-KEM-768
Transparent Data Encryption keys wrap the data-at-rest encryption. Generate a new ML-KEM-768 key in your KMS, re-wrap the database encryption key with it, and point the database at the new wrapped key. Run in a maintenance window; retain the old key until the data is re-encrypted or migrated.
Re-wrap a KMS key with ML-KEM
A customer master key wraps data keys. Create a new ML-KEM-768 CMK, re-wrap each data key with it, then schedule the RSA-2048 CMK for retirement. Verify nothing still references the old key before disabling it.
Decommission SSLv2/3
Disable SSLv2 and SSLv3 and the cipher suites they enable (RC4, DROWN, POODLE) in the server configuration. Allow only TLS 1.2 and 1.3, then re-scan to confirm the protocols no longer negotiate.
Upgrade a service to TLS 1.3
Update the server to offer only TLS 1.3 and disable RSA key exchange in favour of (EC)DHE. Verify with sslyze or testssl that TLS 1.0/1.1 and RSA cipher suites are gone.
Disable RSA key exchange
Remove all TLS_RSA_* cipher suites from the server so key exchange uses ephemeral (EC)DHE only. This stops a future quantum computer from decrypting captured handshakes.
Re-issue a certificate with a shorter lifespan
Generate a new certificate with a validity of 366 days or less (per policy), replace the long-lived one, and update the issuer. Re-scan to confirm the lifespan is now compliant.
Add PQC key exchange
Enable a hybrid post-quantum key exchange such as X25519MLKEM768 on the endpoint. This requires a TLS stack that supports ML-KEM; fall back to classical ECDHE for compatibility.
Replace MD5 with SHA-256
Find every MD5 usage (hashing, checksums, signatures), switch to SHA-256 or SHA-384, and update any stored hashes. MD5 is not collision-resistant and must not be used for security.
Replace 3DES with AES-256
Replace DES/3DES with AES-256 (GCM where possible). 3DES has a 64-bit block size and is deprecated; migrate any legacy data encrypted with it.
Migrate JWT signing
Plan the move from RS256 (RSA) to a quantum-safe signature (ML-DSA-based JWT) once the IETF standard lands. In the meantime, track the standards work and document the migration path.
Pin a dependency to a PQC-aware release
Update the library to a version that defaults to quantum-safe algorithms, pin the exact version, and re-run the scan to confirm the weak default is gone.
Re-encrypt Ansible Vault
Re-encrypt the vault file with a stronger key derivation and rotate the vault password. Ansible Vault uses password-derived keys, so a weak password or key exposes the secrets.
Migrate a KMS key
For signing keys, migrate to ML-DSA; for encryption keys, ML-KEM. Create the new key in the KMS, re-wrap the dependent keys, and retire the ECDSA/RSA key.
Monitor
No immediate action required. Revisit on the next scan or when standards change. This item is recorded for traceability but is not urgent.
Plan a hybrid CA
Issue a parallel ML-DSA certificate hierarchy alongside the RSA root, so both are valid during the transition. This lets endpoints validate either signature while you migrate.
Migrate a CA to ML-DSA
Plan the intermediate CA migration: re-issue the intermediate under an ML-DSA root, then re-issue leaf certificates. Coordinate with relying parties so trust chains remain valid.
Rotate the SSH CA
Issue a new SSH CA key (Ed25519 or ML-DSA), re-sign host and user keys, and update the trusted CA on every host. Retire the RSA-2048 CA after the transition.
Migrate DNSSEC to a PQC algorithm
Wait for a standardized PQC DNSSEC algorithm, then rotate the ZSK and KSK. Until then, monitor the standards process and keep the current keys.
Integration Technologies
Emerging quantum technologies, how to integrate them, and the article behind each.
PQC for Legacy Systems
Deploy a gateway proxy that terminates TLS; apply hybrid X25519 + ML-KEM-768 key exchange; phase the rollout from edge to internal services; verify existing applications keep working unchanged.
Read the article →Hybrid QKD + PQC (MadQCI)
Stand up an SDN-controlled QKD network; seed ML-KEM with QKD-derived key material; deploy virtual key management (vKMS + a Quantum Security Controller); run a long-duration benchmark over TLS.
Read the article →QRNG via D-Bus
Deploy a D-Bus service that exposes a quantum random number generator as a shared resource; build an OpenSSL 3 provider that replaces the built-in RNG; secure remote access with PQC TLS; test across virtualised environments.
Read the article →Quantum Time Synchronization
Deploy an entangled-photon source; run two-way time transfer between nodes to compute clock offsets; integrate with classical timing infrastructure; validate the precision gain.
Read the article →Hybrid Quantum-Classical Networks (QuANET)
Assess existing fiber; add WDM add-drop multiplexing (O-band quantum + C-band classical on the same fiber); set up active polarisation stabilization; run a pilot link with both traffic types.
Read the article →Quantum as HPC Accelerator
Verify Slurm + QDMI support; add quantum processors as scheduled Slurm nodes alongside CPUs and GPUs; deploy the QDMI standardisation layer; test job submission.
Read the article →