Operator artifacts.
Five working tools for the PQC transition — inventory, vendor pressure, maturity, rehearsal, board.
The briefings translate the analysis. Foundation provides the depth. Tools are what you actually carry into the room. Each artifact is published in two forms: a web page that mirrors the section's editorial voice and a downloadable file you can take into Excel, the boardroom, or the facilitator's binder.
A working register for cryptography across applications, infrastructure, firmware, certificates, and third-party services. Thirteen columns, three-axis priority scoring, dropdown validation for the volatile fields. The foundation of every other PQC decision.
A scored evaluation framework for vendor PQC readiness. Fourteen criteria across algorithm standards, hybrid operation, PKI, operational, observability, rollback, roadmap, and support — with three hard pass/fail gates that auto-disqualify a non-starter.
An interactive self-assessment scoring your organization across the six CSWP 39 capability domains and five maturity levels. Thirty-six questions. Radar-chart output. Prioritized next-action recommendations based on the lowest-scoring domain.
"Operation Quiet Rollback" — a five-inject red-team exercise covering the structural pitfalls of a real hybrid deployment. Facilitator guide, inject cards, debrief scoring sheet. Ninety minutes for an experienced room; two hours otherwise.
A single-page board-ready summary in three columns: the risk (HNDL is happening now), the mandate (CNSA 2.0 is on the calendar), and the ask (inventory, procurement language, transition owner). A4 / Letter. Reviewed quarterly. Printable, citable, and short enough to read in the elevator.
The order matters. Begin with the Inventory Worksheet — without it, none of the others are meaningful. Run the Self-Assessment after the first inventory pass to see where the gaps are. Use the RFP Rubric the next time you go out to procurement. Run the Tabletop before any production hybrid deployment. Hand the One-Pager to the board whenever the conversation turns to capital allocation or risk reporting.