Find what quantum breaks. Fix it in the right order.
Read-only discovery across your network, hosts and code. One standards-based inventory and a migration plan your assessors can read.
01 · The threat
Harvest now. Decrypt later.
What adversaries capture today, a quantum computer opens tomorrow.
02 · How it works
Discover. Normalize. Reason. Remediate.
The inventory feeds the plan. The plan is the product.
Discover
Network, hosts, HSMs, SBOMs and source code. Read-only, every time.
Normalize
One CycloneDX 1.7 inventory. Every finding keeps its source.
Reason
Judged against CNSA 2.0 or NIST FIPS, grouped by the fix that clears it.
Remediate
File, line and replacement API, cited and dated. Your engineers decide.
Nothing changes in your environment without your approval.
03 · The deadlines
The clock is already running.
FIPS 140-2 certificates moved to NIST's Historical List.
New National Security System acquisitions must be CNSA 2.0 compliant.
High value assets and high impact systems: post-quantum key establishment by 31 December 2030, signatures by 31 December 2031. National security systems excluded.
Software and firmware signing, VPNs and routers.
Browsers, servers, cloud services and operating systems.
RSA and elliptic-curve deprecated after 2030 at every approved strength, disallowed after 2035.
The algorithms: CNSA 2.0 and NIST
Each run is judged by one rulebook, your choice: CNSA 2.0, which binds national security systems, or NIST's standards for everyone else.
| Purpose | CNSA 2.0 (national security systems) | NIST (federal civilian and commercial) |
|---|---|---|
| Key establishment | ML-KEM-1024 (FIPS 203) | ML-KEM-512, 768 or 1024 (FIPS 203) |
| Digital signatures | ML-DSA-87 (FIPS 204) | ML-DSA-44, 65 or 87 (FIPS 204); SLH-DSA (FIPS 205) |
| Software and firmware signing | LMS or XMSS (SP 800-208) | LMS or XMSS approved (SP 800-208), not required |
| Symmetric encryption | AES-256 (FIPS 197) | AES; NIST expects no transition |
| Hashing | SHA-384 or SHA-512 (FIPS 180-4) | SHA-2 and SHA-3; NIST expects no transition |
| RSA and elliptic-curve | Replaced on the CNSA 2.0 dates; all national security systems by 2035 | Deprecated after 2030 at every approved strength; disallowed after 2035 |
Sources: NSA CNSA 2.0 advisory (PP-22-1338) and CNSA 2.0 FAQ (Ver. 2.1); NIST FIPS 203, 204 and 205 (13 August 2024); NIST IR 8547, final (27 October 2026); Executive Order 14412, Sec. 4(b) (22 June 2026) and OMB M-26-15 (24 June 2026); NIST CMVP FIPS 140-3 transition page. Confirm against the current releases before relying on any date contractually.
04 · What you get
Evidence, not assurances.
Cryptographic bill of materials
CycloneDX 1.7. Machine-readable, yours to keep and re-run.
Sequenced migration plan
Work in waves, in the order it can actually move.
Executive summary
Exposure, priorities and dates for the budget holder.
Compliance outputs
OMB M‑23‑02 inventory, M‑26‑15 plan inputs, PDF attestation.
05 · Who it's for
Built for a deadline and an estate.
Defense industrial base
CMMC and DFARS flow-downs. An inventory your assessor will accept.
Civilian agencies
A credible path across systems you didn't build.
Regulated industries
Finance, health and energy data that must stay secret for decades.
06 · Engagements
Scoped to your estate.
One system or unit
Up to about 500 endpoints, one or two codebases.
Division-wide
About 500 to 2,000 endpoints and a multi-year roadmap.
Agency or multi-unit
2,000+ endpoints, repeat assessments, governance reporting.
07 · Questions
Straight answers.
Do we need to wait for a quantum computer?
No. Data captured today can be decrypted later, and the 2027 acquisition gate applies regardless.
Will GCS QuantumShield change anything in our environment?
No. Discovery is read-only and every recommendation is advisory. Your engineers apply changes through your own change control.
How is this different from a vulnerability scan?
A vulnerability scan finds known flaws. GCS QuantumShield finds the cryptography itself and orders the migration.
What format is the inventory in?
CycloneDX 1.7, with a 1.6 export for tools that do not read 1.7 yet.
Does it separate test code from production code?
Not yet. On open-source projects most findings sat in test files, so expect some triage. We would rather say so before a pilot.
Know where you stand before 2027.
Run under GovCom leadership, delivered with GovCom's federal team.