Services
Post-quantum transition, from first briefing to completion.
Southern Cipher Security works in three stages: Advise, Plan and Implement. Most clients begin with a Transition Plan; boards that must sponsor the work first begin with Advise.
Know, plan, transition
Three services, matched to what Australian guidance asks.
Guidance asks every organisation to know where it relies on cryptography, to hold a transition plan it owns, and to complete the transition with critical systems first. Each stage of our practice delivers one of those outcomes, and each can be engaged on its own.
Sponsor the response
Directors understand the exposure and sponsor a credible response.
Know and plan
A validated inventory, prioritised findings and a roadmap the organisation owns.
Transition
Critical systems migrated first and the plan kept current, to completion by the end of 2030.
Not sure where to start?
Choose your situation or sector and see the stage and scope that usually fit.
01
Advise
Board and Executive Briefing
- For
- Boards, risk committees and executive teams
- Typical duration
- One to two weeks
Boards and executives are expected to understand quantum risk and to sponsor a credible response. One session equips directors to explain the organisation's exposure, the guidance that applies and the questions management should answer. Board-level AI security risk can be addressed in the same session.
What you receive
- A pre-read and a structured pre-interview
- A 90 to 120 minute session for up to twelve attendees
- A two-page board paper setting out exposure and decisions sought
- A 90-day action plan mapped to Australian guidance
02
Plan
Post-Quantum Transition Plan
- For
- CISOs, chief risk officers and security architecture leads
- Typical duration
- Three to sixteen weeks, by scope
Organisations are expected to know where they rely on cryptography and to hold a transition plan. We deliver an evidence-based readiness and migration plan, tailored to the organisation and structured around ASD's published guidance, that the organisation adopts, owns and can execute.
From discovery to roadmap
Network, PKI, keys, code and suppliers
Validated register with coverage and confidence
Machine-readable record in CycloneDX format
Prioritised waves with owners and dependencies
What you receive
| Deliverable | Contents |
|---|---|
| 1 · Readiness and migration plan | Current-state assessment, target state and a plan-maintenance procedure, tailored to the organisation's systems and obligations |
| 2 · Risk assessment method and findings | A documented scoring method and a findings register that prioritises remediation, each finding with a confidence level |
| 3 · Migration patterns | A defined pattern for each critical system: hybrid key establishment, certificate and key replacement, vendor-led upgrade or system replacement |
| 4 · Validated discovery and cryptographic inventory | Discovery across network and TLS, PKI, key management and HSMs, priority code and suppliers, validated with your teams; delivered as a register, CycloneDX CBOM and coverage statement |
| 5 · Implementation roadmap | Transition waves, owners, dependencies and order-of-magnitude cost options, with a first-year work plan the organisation can execute |
| 6 · Board paper and business case | The organisation's position, the decisions sought and the investment case, written for directors |
03
Implement
Transition delivery and plan maintenance
- For
- Organisations with an agreed plan
- Typical duration
- Set by the roadmap
The plan must be carried out, critical systems first, and kept current as the estate and guidance change. Our bench of Australian specialists delivers the change hands-on, under one accountable lead and alongside the organisation's teams and suppliers.
What you receive
- Migration of critical systems, with test evidence for each change
- Programme management and supplier assurance alongside your teams
- Quarterly re-scans and CBOM change reports, reviewed with you
- An annual plan refresh and progress reporting to the board
The specialists behind the work. An Australian bench of specialists in quantum readiness and post-quantum cryptography migration, engaged as each programme requires. Each specialist is named in the statement of work before work begins.
Start with a 30-minute consultation.
A PQC expert reviews your position and recommends the right first stage and scope. We respond within 24 hours, and after the conversation you receive a short written note confirming fit and the proposed next step.
Book a 30-minute consultation