Two frameworks for measuring readiness, and a tool for deciding what migrates first
Knowing that migration is necessary is not the same as knowing where to start. This page covers two assessment instruments worth knowing — CSNP's QRAMM maturity model, and BSSN's per-system prioritization instrument for the Indonesian National PQC Migration Task Force — and embeds a working calculator built from the actual BSSN scoring formula.
You cannot sequence what you have not measured
The migration wave planning on the previous page assumes you already know which assets are urgent. Getting there requires an assessment step — and there is more than one credible way to run it. Two are covered here because they solve different problems at different scales.
QRAMM — organisation-level maturity
A 120-question self-assessment answering "how mature is our organisation's quantum-readiness practice, overall?" Useful for a security or risk function benchmarking itself, tracking progress year over year, and mapping to compliance frameworks it already reports against.
BSSN instrument — per-system prioritization
A 13-parameter scoring model answering a narrower, more actionable question: "of the systems we run, which one migrates first?" Built for exactly the sequencing decision a real programme has to make, and carrying real regulatory weight in Indonesia.
QRAMM: 120 questions, four dimensions, a context-aware score
Developed by the CyberSecurity Non-Profit (CSNP), released August 2025. Structured as a maturity model in the CMMI tradition — not a pass/fail checklist, but a graded picture of how systematic your organisation's practice actually is.
| Dimension | Practices |
|---|---|
| CVI — Cryptographic Visibility & Inventory | Asset discovery & classification · vulnerability scanning & analysis · risk prioritization & tracking |
| SGRM — Strategic Governance & Risk Management | Governance structure & leadership · risk management framework · compliance & audit |
| DPE — Data Protection Engineering | Encryption implementation · key management systems · data classification & handling |
| ITR — Implementation & Technical Readiness | Network security architecture · system hardening & updates · incident response & recovery |
Two streams per practice
Each of the 12 practices is scored on a Foundation stream (60% weight — core capability) and an Advanced stream (40% weight — optimisation). 120 questions total, roughly 10 per practice, each carrying explicit "evidence to look for" criteria per maturity level rather than a bare self-report.
A context-aware multiplier
Raw scores run 1.0–4.0 (Basic → Optimizing). An organisational profile — industry, size, geography, data sensitivity, regulatory load — applies a 0.8×–1.5× multiplier to produce a weighted score. A healthcare organisation with strong raw performance and a 1.33× multiplier can weight-score above 4.0, reflecting that its baseline expectation is higher.
| Raw score | Maturity level | What it typically looks like |
|---|---|---|
| 1.0 – 1.5 | Basic | Initial awareness, ad-hoc practices |
| 1.6 – 2.5 | Developing | Structured approaches beginning to emerge |
| 2.6 – 3.5 | Established | Systematic and consistent practices |
| 3.6 – 3.9 | Advanced | Optimised processes, continuous improvement |
| 4.0 | Optimizing | Excellence and industry leadership |
The per-system prioritization model behind Indonesia's PQC task force
Issued by Badan Siber dan Sandi Negara (BSSN) under Peraturan BSSN Nomor 10 Tahun 2024, this is the working instrument the National PQC Migration Task Force uses to collect per-system data from organisations. Unlike QRAMM, it does not score an organisation — it scores one electronic system at a time, and resolves to a single, actionable placement: should this specific system be in the first migration wave or not.
Dimensi Risiko — Risk dimension
Combined weight 74.4% of the final score. Six parameters answering: if this system's cryptography breaks, how much does it cost us?
| P1 | Criticality of the system's role | 22.1% |
| P2 | Data sensitivity & confidentiality lifetime | 19.1% |
| P3 | Data exposure to open networks | 13.4% |
| P4 | User scale | 9.1% |
| P5 | Cross-sector dependency | 15.1% |
| P6 | Dependency on vulnerable cryptography | 21.2% |
Dimensi Kesiapan — Readiness dimension
Combined weight 25.6% of the final score. Seven parameters answering: if we decided to migrate this system today, could we actually do it?
| P7 | Crypto-agility maturity | 10.9% |
| P8 | Legacy technology dependency | 7.1% |
| P9 | Internal resource capacity | 10.3% |
| P10 | Cryptographic asset inventory | 21.1% |
| P11 | Leadership awareness & commitment | 30.2% |
| P12 | Technology vendor support | 10.8% |
| P13 | Migration complexity | 9.6% |
Scroll the tables horizontally on narrow screens.
Each parameter is scored 1–5, against a written rubric
Every parameter carries five concrete descriptions — not a bare numeric slider. Scoring P6 (vulnerable-crypto dependency), for instance, means picking the band that matches your actual inventory: under 20% quantum-vulnerable scores a 1, over 80% scores a 5. The calculator below uses the same rubric text.
The formula, exactly as published
The 60-point threshold is not an arbitrary round number — it is the midpoint of the 1–5 rating scale rescaled to 0–100 (3 ÷ 5 × 100 = 60). A system scored down the middle on every parameter lands almost exactly on the boundary, which is the correct behaviour for a threshold meant to separate above-average from below-average.
Score a system yourself
Move the sliders to reflect one real or hypothetical electronic system. The quadrant, scores and recommendation update as you go — computed with the exact formula and weights above, client-side, in your browser. Nothing you enter here is transmitted anywhere.
Three frameworks, three different jobs
A third framework is worth knowing even though it is not embedded here as a tool: Singapore's Cyber Security Agency Quantum Readiness Index (QRI), released 16 July 2026 with A*STAR, Accenture, Deloitte, evolutionQ, SGTech, SpeQtral and the World Economic Forum. It assesses organisational maturity across five domains — Risk Assessment, Governance, Technology, Training & Capability, External Engagements — on a four-level CMMI-derived scale (L0 Not started → L3 Operational), with one deliberately named "no-regrets" objective per domain as a safe starting point regardless of where else the organisation stands.
| Framework | Unit assessed | Scale | Best for |
|---|---|---|---|
| QRI (Singapore CSA) | Whole organisation | 4 discrete levels (L0–L3) | Board-level readiness narrative; identifying which domain to invest in first |
| QRAMM (CSNP) | Whole organisation | Continuous 1.0–4.0, context-weighted | Practice-level detail; mapping straight onto existing compliance reporting |
| BSSN instrument | One electronic system | 1–5 per parameter → 0–100 quadrant | Deciding which named system enters the next migration wave |
Scroll the table horizontally on narrow screens.