Two scores on one scale: today and projected.
The PQC Readiness Track translates the post-quantum migration program into two numbers on the same IEQ scale: today's score and the projected score if the planned milestones are completed. The difference between the two guides which milestone to prioritize. It does not replace the committee's decision, and it is not a compliance attestation.
Prioritizing post-quantum migration within a governance program, knowing today which milestone reduces exposure the most before committing budget and schedule.
What is at stake
The PQC Readiness Track's present-day score comes from the same public collection and the same IEQ engine as the Exposure Report.
- Source
- IEQ publication used by the products, the same as the Exposure Report
- Date
- October 7, 2026
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. The projection depends on the milestones the organization itself declares as planned: it is a simulation over governance hypotheses, not a new collection nor a post-change measurement.
The same IEQ engine as the diagnostic, with the calculation mode held constant to isolate the governance effect.
Both numbers on the same ruler as the Exposure Report.
How much each planned milestone would reduce governance exposure, in isolation.
Each milestone checked or unchecked explains the change in the projected score on its own.
A comparison of two scores and the gain attributed to each milestone, not a regulatory compliance attestation.
What you receive
- Today's score, calculated over the current public collection.
- Projected score from the milestones marked as planned.
- Governance exposure gain attributed to each milestone, in isolation.
- Auditable delta: each milestone can be checked and unchecked to see its isolated effect.
See the method's limits, the dependencies and where measurement ends
What the projection is not
The projection simulates a governance program over hypotheses the organization itself declares. It does not replace verification, nor does it attest regulatory compliance. Coverage of the ITI Normative 35/2026 requirements is still in validation.
Observed
Public collection saw
- Public DNS, TLS, PQC readiness, and header signals, in the collection that produces today's score.
Calculated
The IEQ engine derived
- Today's score, by the same IEQ engine as the diagnostic.
- Projected score and each milestone's gain, in the same calculation mode as today's score.
Declared
The organization reported
- The governance milestones the organization marks as planned or completed.
Inferred
The model estimated
- Reference sector, when not declared, used only to contextualize today's score.
Out of scope
Other evidence decides
- A regulatory compliance attestation: coverage of IN ITI 35/2026 is under validation, and the track organizes governance milestones, but does not issue an attestation.
- A guarantee that a milestone marked as planned will be completed on schedule.
- An achieved result: the projection is a simulation over planned actions, not a measurement taken after the change.
What it depends on
- A domain with public collection already performed (same base as the Exposure Report).
- The program's list of governance milestones, declared as planned or completed.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureMeasure your migration program
Share the domain and your program's governance milestones. The result shows today's score, the projected score, and each milestone's gain, with the limits declared above.