Our board needs to understand the risk Directors are asking what quantum computing means for the organisation and what management should be doing. We need to know where our cryptography is There is no reliable record of the algorithms, certificates, keys and suppliers the organisation depends on. We have a plan and need it delivered A transition plan exists. The organisation needs specialists to carry it out, critical systems first. A supplier, customer or regulator has asked us Someone has asked for evidence of post-quantum readiness and the organisation needs a credible, documented answer.
Your route
Advise Start here
Plan
Implement
Board and Executive Briefing A briefing gives directors a clear view of exposure and the decisions sought, so the board can sponsor the work that follows.
Likely scope One to two weeks
Engagement type Fixed-scope A two-page board paper on exposure and decisions sought A 90-day action plan mapped to Australian guidance Then: Most organisations move to a Transition Plan once the board has sponsored the response.
Your route
Advise
Plan Start here
Implement
Post-Quantum Transition PlanValidated discovery and a cryptographic inventory are the foundation of the plan. Scope is set by the size and spread of the estate.
Likely scope Enterprise · 6–10 weeks
Engagement type Fixed-scope Validated discovery and cryptographic inventory, with a CycloneDX CBOM Risk assessment method and prioritised findings Then: The roadmap from the plan feeds directly into Implement when the organisation is ready.
Your route
Advise
Plan
Implement Start here
Transition delivery and plan maintenance Our Australian bench delivers the change hands-on, under one accountable lead and alongside your teams and suppliers.
Likely scope Set by the roadmap
Engagement type Programme delivery or Embedded Migration of critical systems, with test evidence for each change Quarterly re-scans, CBOM change reports and an annual plan refresh Then: Ongoing maintenance keeps the inventory and plan current through to completion.
Your route
Advise
Plan Start here
Implement
Post-Quantum Transition PlanThe plan produces the documented position others ask for: an inventory, prioritised findings and a roadmap the organisation owns.
Likely scope Foundation · 3–4 weeks
Engagement type Fixed-scope Readiness and migration plan Board paper and business case Then: A short board paper and business case go with the plan, so directors can see the position too.
APRA-regulated entity Banks, insurers and superannuation trustees, including their material service providers. Critical infrastructure Energy, water, transport, communications and other operators of essential services. Commonwealth entity Non-corporate Commonwealth entities and agencies working to ASD and PSPF requirements. Board director or executive Chairs, directors, chief risk officers and executive teams who need to lead the response.
Your route
Advise
Plan Start here
Implement
Post-Quantum Transition PlanEntities are expected to map where cryptography is relied upon across systems, data and third-party providers, and boards to understand the risk. The plan covers suppliers as well as the internal estate.
Likely scope Enterprise · 6–10 weeks
Engagement type Fixed-scope, then Programme delivery Supplier coverage within the validated inventory Board paper and business case for directors Then: Larger groups typically move to Programme scope and Programme delivery.
Your route
Advise
Plan Start here
Implement
Post-Quantum Transition PlanLong-lived operational systems and embedded devices make migration patterns and sequencing central. Discovery is agreed segment by segment.
Likely scope Enterprise · 6–10 weeks
Engagement type Fixed-scope, then Embedded A migration pattern for each critical system Transition waves with owners and dependencies Then: Embedded specialists build capability in your teams as transition waves proceed.
Your route
Advise
Plan Start here
Implement
Post-Quantum Transition PlanEntities are required to have a transition plan that is developed, implemented and maintained. The plan is structured around ASD's published guidance and hands over to the programme office.
Likely scope Programme · 10–16 weeks
Engagement type Fixed-scope, then Programme delivery Readiness and migration plan with a plan-maintenance procedure First-year work plan the organisation can execute Then: Implement and Ongoing maintenance cover the implemented and maintained parts of the requirement.
Your route
Advise Start here
Plan
Implement
Board and Executive Briefing One session equips directors to explain exposure, the guidance that applies and the questions management should answer.
Likely scope One to two weeks
Engagement type Fixed-scope A pre-read and a structured pre-interview A 90 to 120 minute session for up to twelve attendees Then: The 90-day action plan usually becomes the brief for a Transition Plan.
