Present score against projected score
In productionBoth numbers on the same ruler as the Exposure Report.
Application · PQC Readiness Track
Two scores on one scale: today and projected.
The PQC Readiness Track translates the post-quantum migration program into two numbers on the same IEQ scale: today's score and the projected score if the planned milestones are completed. The difference between the two guides which milestone to prioritize — it does not replace the committee's decision, and it is not a compliance attestation.
01The problem
Prioritizing post-quantum migration within a governance program, knowing today which milestone reduces exposure the most before committing budget and schedule.
What is at stake
- Governance milestones compete for budget without knowing which one reduces exposure the most.
- The program reports progress in completed activities, not in a comparable before/after score.
- Without a projection, the committee only sees a milestone's gain after it has already been completed.
02Evidence
The PQC Readiness Track's present-day score comes from the same public collection and the same IEQ engine as the Exposure Report. The projection adds the governance gain of the milestones the organization marks as planned, holding the other declared parameters constant — the same mode used to compute the present-day score.
The PQC Readiness Track's present-day score comes from the same public collection and the same IEQ engine as the Exposure Report. The projection adds the governance gain of the milestones the organization marks as planned, holding the other declared parameters constant — the same mode used to compute the present-day score.
- Source
- IEQ publication used by the products, the same as the Exposure Report
- Date
- October 7, 2026
- Run
- ml_1791394929
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation: The projection depends on the milestones the organization itself declares as planned: it is a simulation over governance hypotheses, not a new collection nor a post-change measurement.
03What applies
The same IEQ engine as the diagnostic, with the calculation mode held constant to isolate the governance effect.
Gain per governance milestone
In productionHow much each planned milestone would reduce governance exposure, in isolation.
Auditable delta, action by action
In productionEach milestone checked or unchecked explains the change in the projected score on its own.
04What comes out
A comparison of two scores and the gain attributed to each milestone — not a regulatory compliance attestation.
- Today's score, calculated over the current public collection.
- Projected score from the milestones marked as planned.
- Governance exposure gain attributed to each milestone, in isolation.
- Auditable delta: each milestone can be checked and unchecked to see its isolated effect.
What it depends on
- A domain with public collection already performed (same base as the Exposure Report).
- The program's list of governance milestones, declared as planned or completed.
05What the projection is not
The projection simulates a governance program over hypotheses the organization itself declares — it does not replace verification, nor does it attest regulatory compliance. Coverage of the ITI Normative 35/2026 requirements is still in validation.
Observed
Public collection saw
- Public DNS, TLS, PQC readiness, and header signals, in the collection that produces today's score.
Calculated
The IEQ engine derived
- Today's score, by the same IEQ engine as the diagnostic.
- Projected score and each milestone's gain, in the same calculation mode as today's score.
Declared
The organization reported
- The governance milestones the organization marks as planned or completed.
Inferred
The model estimated
- Reference sector, when not declared, used only to contextualize today's score.
Out of scope
Other evidence decides
- A regulatory compliance attestation: coverage of IN ITI 35/2026 is under validation, and the track organizes governance milestones, but does not issue an attestation.
- A guarantee that a milestone marked as planned will be completed on schedule.
- An achieved result: the projection is a simulation over planned actions, not a measurement taken after the change.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries — work carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureMeasure your migration program
Share the domain and your program's governance milestones. The result shows today's score, the projected score, and each milestone's gain, with the limits declared above.