Observatory · Methodology

How QRQC verifies evidence

The observatory is structured data first and editorial content second. This page is the contract behind every band, chip and date shown elsewhere on the site.

Dataset as of 2026-09-06

Evidence classes

Normative primary

Sources

Statutes, executive orders, final NIST standards, RFCs, regulator rules, formal national policy

Permitted use

Can support 'requires', 'must', 'standardised' or exact deadline language

Authoritative guidance

Sources

NCSC, CSE, ASD, ANSSI, ENISA, CSA, national CSIRTs, NIST guidance

Permitted use

Can support official recommendations and roadmaps

Official implementation evidence

Sources

Government pilots, certification databases, regulator assessments

Permitted use

Can support claims that a deployment or certification occurred

Scientific

Sources

Peer-reviewed journals and conferences

Permitted use

Technical feasibility, migration studies, performance and security evidence

First-party industry

Sources

Cloudflare, Google, Microsoft, AWS, Sectigo, DigiCert, the OpenSSL project

Permitted use

Authoritative only for that organisation's own product or roadmap

High-quality secondary

Sources

Reputable technical and news analysis

Permitted use

Discovery and context; should be paired with or replaced by primary evidence

Discovery only

Sources

Vendor marketing aggregations, social posts, unsourced timelines

Permitted use

Never sufficient for a material QRQC claim

Class	Name	Sources	Permitted use
A1	Normative primary	Statutes, executive orders, final NIST standards, RFCs, regulator rules, formal national policy	Can support 'requires', 'must', 'standardised' or exact deadline language
A2	Authoritative guidance	NCSC, CSE, ASD, ANSSI, ENISA, CSA, national CSIRTs, NIST guidance	Can support official recommendations and roadmaps
A3	Official implementation evidence	Government pilots, certification databases, regulator assessments	Can support claims that a deployment or certification occurred
B	Scientific	Peer-reviewed journals and conferences	Technical feasibility, migration studies, performance and security evidence
C	First-party industry	Cloudflare, Google, Microsoft, AWS, Sectigo, DigiCert, the OpenSSL project	Authoritative only for that organisation's own product or roadmap
D	High-quality secondary	Reputable technical and news analysis	Discovery and context; should be paired with or replaced by primary evidence
E	Discovery only	Vendor marketing aggregations, social posts, unsourced timelines	Never sufficient for a material QRQC claim

Document status vocabulary

draftproposedadoptedfinaleffectivesupersededwithdrawn

Status prevents the most common error in post-quantum coverage today: treating a draft transition proposal as if it were final regulation.

Readiness bands

Observed
Planning
Mobilizing
Executing
Broad transition
Evidence insufficient

Readiness dimensions

Policy

Published strategy, named authority, explicit scope

Deadline maturity

None → aspirational → dated milestones → enforceable requirement

Technical standards

Algorithm and protocol adoption

Execution evidence

Pilots, certifications, product support, regulatory assessments

Supply-chain enablement

Libraries, cloud, HSM, PKI, network and device availability

Evidence confidence

Quality and directness of the underlying sources

QRQC deliberately does not publish a single composite score such as "United States 87/100". A single number creates false precision and hides which layer of the problem a jurisdiction is actually solving.

Editorial rules

·Readiness measures observable preparation, never quantum-computer capability.
·A high band does not mean a jurisdiction is safe; a low band may mean thin public documentation.
·Draft documents are labelled draft, and their dates are described as proposals.
·Relevance to an industry is never rewritten as a legal obligation for that industry.
·First-party vendor evidence is authoritative only for that vendor's own product or roadmap.
·Where no authoritative public timeline exists, QRQC records an evidence gap rather than a low score.
·Every material claim carries an authority, evidence class, document status and review date.