An assessment is only useful in an audit if its criterion can be read.
The question that reaches a risk team is not what the score is. It is how it was produced, what it was compared against, on what date, with what coverage, and what it explicitly does not conclude. A methodology that a third party cannot read does not support a decision recorded in minutes.
Adopting, and being able to defend, a criterion for assessing cryptographic exposure that produces consistent evidence across entities, across cycles, and before an auditor who took no part in the collection.
What is at stake
IEQ's methodology is published and citable: technical report 2026-S1 covers 39,903 organizations across 17 sectors under a CC-BY license, with a permanent DOI.
- Source
- IEQ Technical Report 2026-S1, Zenodo
- Date
- 2026-S1 edition
- Population
- 39,903 organizations published
- Coverage
- Sector aggregates with an anonymity floor of K = 30: no organization is individually exposed.
Limitation. The published base and the operational base are distinct collections with distinct cutoffs. Neither is a sample of the other, and results from one do not add to the other.
Open the source →What makes the score useful for risk and compliance is that it can be checked: the readout can be audited by someone who did not produce it.
Model, dimensions, and limits documented under an open license, with a citable DOI.
Source, cutoff date, run, population, and coverage accompany every value presented.
Comparison always against aggregates, with the anonymity floor stated.
What the assessment does not conclude is part of the deliverable, not a footnote caveat.
Documentation that survives a change of vendor, assessor, and cycle.
What you receive
- The assessment criterion, with model and dimensions documented.
- Collection cutoff date and identifier of the run used.
- Population of the comparison ruler and anonymity floor.
- Coverage per module and the fallbacks the model applied.
- Contributors and the evidence origin for each.
- Explicit limitations of what the readout does not support.
See the method's limits, the dependencies and where measurement ends
What cannot be claimed from this
A risk report that reproduces the limits alongside the result is more defensible than one that reproduces only the number. These limits can be quoted as they stand.
Observed
Public collection saw
- Publicly verifiable cryptographic configuration on the cutoff date.
- Publicly announced post-quantum readiness signals.
Calculated
The IEQ engine derived
- Structural exposure on a common, comparable scale.
- Relative position against anonymous sector aggregates.
Inferred
The model estimated
- Secrecy shelf life from a sector prior, absent a declaration.
- Fallback values when a module does not complete collection.
Out of scope
Other evidence decides
- Compliance with any standard, attestation, or certification.
- Actuarial probability of an incident or attack.
- The date on which a relevant quantum computer will exist.
- That two results are comparable when engine version, calibration, mode, or coverage changed.
What it depends on
- A scope definition: which entities and domains are covered.
- An agreed cadence, when comparison across cycles is intended.
- A defined owner for validating declared data, when the readout is in complete mode.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureRead the method before contracting the readout
The methodology is published under an open license and can be reviewed by your team before any commercial conversation. If you would rather discuss how it applies to your context, that is what the technical session is for.