Quick answer: A cryptographic inventory with a thousand findings and no scoring model produces a thousand equally urgent-looking problems, which in practice means none of them get prioritized correctly. A workable PQC risk score weighs six dimensions: confidentiality lifetime (how long the protected data needs to stay secret), system criticality (what breaks if this asset fails), external exposure (internet-facing versus internal-only), algorithm vulnerability (how exposed the specific algorithm is to both classical and quantum attack), migration complexity (how hard this specific finding is to actually remediate), and vendor readiness (whether a replacement path exists yet at all). This guide provides a scoring model across those six dimensions that turns an inventory into a ranked, defensible migration sequence.
CISA’s own guidance frames prioritization by consequence, not convenience, and that principle only becomes usable once it is converted into a repeatable scoring method rather than left as a general instinct applied inconsistently across a large inventory. This guide is that conversion.
Key Takeaways
- A six-dimension scoring model, confidentiality lifetime, criticality, exposure, algorithm vulnerability, migration complexity, and vendor readiness, converts a flat inventory into a ranked, defensible sequence.
- Confidentiality lifetime and exposure combined identify the clearest harvest-now-decrypt-later priority: long-lived, externally exposed data is the highest-urgency combination in almost every model.
- Migration complexity and vendor readiness are risk-reducing factors that get systematically underweighted; a low-risk finding with no available replacement path can block a program longer than a higher-risk finding with a straightforward fix.
- A scoring model needs to be simple enough for a non-specialist to apply consistently across thousands of findings, not a research-grade risk calculation that only a small team can execute.
- The score is a sequencing tool, not a final decision; it should inform, not replace, judgment calls on genuinely ambiguous or unusual findings.
The Six Scoring Dimensions
| Dimension | What it measures | Low score example | High score example |
|---|---|---|---|
| Confidentiality lifetime | How long the protected data must remain secret or verifiable | Session tokens valid for minutes | Genomic, legal, or trade-secret data with decade-plus retention |
| System criticality | Business or operational impact if this asset is compromised or unavailable | Internal test environment | Payment processing, safety, or authentication infrastructure |
| External exposure | Whether the asset is reachable from outside your controlled network | Air-gapped internal system | Public-facing API or website |
| Algorithm vulnerability | How exposed the specific algorithm and key size are to classical and quantum attack | AES-256 symmetric encryption | RSA-2048 or ECDSA with a small curve |
| Migration complexity | How difficult remediation is: configuration change versus application redesign | Config-level TLS group update | Hardcoded algorithm in legacy application code |
| Vendor readiness | Whether a validated replacement path currently exists | Vendor has shipped and validated PQC support | No vendor roadmap or validation timeline exists yet |
Building a Usable Composite Score
Score each dimension on a simple scale, 1 to 3 or 1 to 5 works for most organizations, since finer granularity tends to create false precision without improving prioritization accuracy. Weight confidentiality lifetime and exposure most heavily for urgency, since their combination is the clearest signal of active harvest-now-decrypt-later risk. Treat migration complexity and vendor readiness as separate, risk-reducing modifiers rather than folding them into the same weighted sum as the risk-driving factors: a finding can carry high urgency and simultaneously have no available remediation path yet, and collapsing that into a single number obscures exactly the information a program manager needs to see, which findings are urgent but blocked, versus urgent and actionable now.
A practical output format separates findings into a small number of clear categories rather than a long, granular ranked list that is hard to act on: act now (high urgency, remediation available), plan and pilot (high urgency, remediation path exists but needs validation work first), monitor vendor progress (high urgency, no remediation path yet, requires tracking rather than action), and lower priority (low urgency regardless of complexity). This four-category structure maps directly to what a program actually needs to do differently for each group.
Why Complexity and Vendor Readiness Get Systematically Underweighted
Most informal prioritization exercises focus almost entirely on risk, how bad would it be if this were exploited, and treat remediation difficulty as a secondary planning concern to sort out after the priority list is set. That ordering produces a common, costly mistake: a program commits to tackling its highest-risk findings first, only to discover the top several have no validated vendor replacement path yet, effectively blocking the highest-priority items while lower-risk, immediately actionable findings sit untouched. Scoring vendor readiness and migration complexity explicitly, at the same stage as risk scoring rather than after, surfaces this conflict before a program commits resources to work it cannot yet complete.
What We’d Actually Recommend
Keep the scoring scale simple enough that different team members produce consistent scores independently; a model that requires deep expertise to apply consistently will not scale across a large inventory. Score vendor readiness and migration complexity at the same time as risk factors, not as an afterthought, and use the resulting categories, not a single composite number, to drive program sequencing decisions. Revisit vendor-readiness scores on a defined cadence, quarterly is reasonable for most programs, since this is the dimension most likely to change as vendors ship validated PQC support over the migration timeline.
How Encryption Consulting Can Help
This scoring model depends entirely on having the underlying inventory fields, data lifetime, exposure, algorithm, and vendor dependency, already captured, exactly what CBOM Secure produces as part of its structured cryptographic inventory, so a risk score can be generated from real data rather than reconstructed manually for each finding.
Our PQC Advisory Services apply this six-dimension scoring model to your actual inventory, producing the act-now, plan-and-pilot, monitor, and lower-priority categories that turn a flat findings list into a sequenced, defensible migration roadmap your leadership and auditors can both follow.
A Score That Drives Decisions, Not Just Describes Risk
A risk score that only measures danger, without also measuring how hard a finding is to fix and whether a fix currently exists, tells a program what to worry about without telling it what to actually do next. Scoring confidentiality lifetime, criticality, and exposure alongside migration complexity and vendor readiness, and keeping those risk-driving and risk-reducing factors visibly separate rather than collapsed into one number, is what turns a cryptographic inventory into a genuinely actionable migration sequence rather than a long list of equally alarming findings.
Frequently Asked Questions
What is the highest-priority combination in a PQC risk scoring model?
Long confidentiality lifetime combined with high external exposure. Data that needs to remain secret for years and is reachable from outside the controlled network represents the clearest active harvest-now-decrypt-later risk in almost every scoring model.
Why shouldn’t migration complexity and vendor readiness be combined into the same risk score as urgency factors?
Because they answer a different question: not how dangerous a finding is, but how actionable it currently is. Collapsing them into one number obscures the distinction between findings that are urgent and fixable now versus urgent but blocked by a lack of vendor readiness, which need very different program responses.
How granular should the scoring scale be?
Simple enough for consistent application across a large inventory by different team members; a 1-to-3 or 1-to-5 scale works for most organizations. Finer granularity tends to create false precision without meaningfully improving prioritization accuracy.
How often should vendor-readiness scores be revisited?
On a defined, regular cadence, quarterly is reasonable for most programs, since vendor readiness is the dimension most likely to change over the course of a migration as vendors ship and validate PQC support.
What is the risk of prioritizing purely by algorithm vulnerability without the other dimensions?
It produces a technically accurate but operationally unusable ranking, since it ignores whether the finding is actually exposed, how much it would cost to fix, and whether a fix is even available yet. Programs following algorithm-vulnerability-only rankings frequently commit to work they cannot complete due to missing vendor readiness.
