Building a CBOM lets your organization determine its cryptographic footprint. What it doesn't do is map out the complexity of the migration and what should be fixed first.
The CBOM Finding Prioritization Tool is an Excel workbook that helps your organization prioritize its quantum migration. You score each finding based on three factors, and it does the rest. Each finding in the inventory is assigned one of four priority labels.
How Scoring Works
All findings in your CBOM are scored based on three factors:- Harvest Now, Decrypt Later (HNDL) Exposure Measures the risk that data collected today would still be sensitive when cryptographically-relevant quantum computers (CRQCs) become available.
- Regulatory Deadlines Identifies time until relevant binding regulatory deadlines go into effect (US EO 14413, EU Coordinated Implementation Roadmap, UK, NSCS timeline).
- Migration Complexity Estimates the complexity of the migration, including downstream impacts, vendor dependencies, and the scope of the change (config update vs. full rearchitecture, etc.
HNDL Exposure and Regulatory Deadline are used to calculate a Composite Risk Score, which is then plotted against Complexity to sort every finding into one of four quadrants: Quick Win, Critical Path, Low Priority, or Long-Tail.
What's in the Workbook
Six tabs:
- Editable methodology weights
- Findings inventory configured as a live Excel Table
- Three fully worked and explained sample findings
- Summary with a risk-vs-complexity chart.