Quantum computing poses an unprecedented threat to classical cryptography, requiring new risk assessment paradigms. This paper proposes a Quantum-Adjusted Risk Score (QARS) model, a theoretical and methodological innovation within the EU’s PAREK framework (Post-quantum asset and algorithm inventory, risk assessment, road mapping, execution, key governance). QARS extends Mosca’s inequality—which defines a quantum threat timeline threshold—into a multi-factor risk scoring formula. We formalise QARS with mathematical expressions incorporating timeline, sensitivity, and exposure dimensions, each calibrated by factor weights and scaling functions. The design motivations for including these dimensions are discussed in depth. We present method for model calibration (including sector-specific weight adjustments) and outline validation strategies combining quantitative analysis and expert judgement. The proposed QARS model is situated in the context of the EU’s coordinated roadmap for post-quantum cryptography and cybersecurity regulations, illustrating how QARS supports compliance and strategic migration prioritisation. A prototype tool implementing QARS model is also provided to demonstrate practical applicability. Our contributions provide a unified approach to quantum risk assessment, marrying theoretical rigour with policy-relevant risk management needs to help organizations proactively address the quantum threat.
Quantum computing poses an unprecedented threat to classical cryptography, requiring new risk assessment paradigms. This paper proposes a Quantum-Adjusted Risk Score (QARS) model, a theoretical and methodological innovation within the EU’s PAREK framework (Post-quantum asset and algorithm inventory, risk assessment, road mapping, execution, key governance). QARS extends Mosca’s inequality—which defines a quantum threat timeline threshold—into a multi-factor risk scoring formula. We formalise QARS with mathematical expressions incorporating timeline, sensitivity, and exposure dimensions, each calibrated by factor weights and scaling functions. The design motivations for including these dimensions are discussed in depth. We present method for model calibration (including sector-specific weight adjustments) and outline validation strategies combining quantitative analysis and expert judgement. The proposed QARS model is situated in the context of the EU’s coordinated roadmap for post-quantum cryptography and cybersecurity regulations, illustrating how QARS supports compliance and strategic migration prioritisation. A prototype tool implementing QARS model is also provided to demonstrate practical applicability. Our contributions provide a unified approach to quantum risk assessment, marrying theoretical rigour with policy-relevant risk management needs to help organizations proactively address the quantum threat.
Enterprise infrastructure operators face a critical challenge in prioritizing post-quantum migration, as quantum-related risk is not uniformly distributed across data in transit, in use, and at rest. Existing assessments rely on system-level evaluations or protocol-specific analyses, which do not capture the heterogeneity of exposure across infrastructure layers. This paper extends the Quantum-Adjusted Risk Scoring (QARS) model introduced in into an evidence-based, layer-specific framework that evaluates in-transit, in-use, and at-rest data separately. QARS applies a unified five-factor scoring framework separately to each data state and introduces a quantum-vulnerability attenuation mechanism grounded in Grover-bounded residual security that prevents overstating urgency for non-Shor-vulnerable symmetric protection. Observable host-level evidence determines the binary and ratio descriptors used by the model, while the fixed affine mapping coefficients are treated as transparent semi-quantitative calibration parameters. These coefficients are documented separately and subjected to coefficient-level sensitivity analysis to evaluate whether the reported layer ordering depends on their nominal values. The model is demonstrated through an illustrative controlled experiment using real infrastructure observations. Strengthening storage protection reduces the aggregate system risk from 0.707 (high) to 0.414 (moderate), a 41.5% reduction. However, the maximum-layer score remains high (0.657), indicating that the transport layer continues to dominate migration urgency. Sensitivity analysis confirms that the dominance of the transport layer is stable under wide perturbations of the calibration parameters. These findings demonstrate that risk reduction in one layer does not eliminate overall exposure but shifts the dominant vulnerability. By distinguishing between overall system posture and the most critical remediation priority, QARS supports infrastructure operators in identifying high-risk components and planning structured, evidence-based post-quantum migration.
Quantum computing creates a governance problem before it creates a cryptanalytic event. Information collected today may remain sensitive after a cryptographically relevant quantum computer becomes available, while long-lived operational technology and spacecraft may be unable to adopt new cryptography within conventional replacement cycles.This paper examines how operators of long-lived cyber-physical systems should prioritize post-quantum migration under uncertainty. It distinguishes the present confidentiality risk of harvest-now, decrypt-later collection from the prospective integrity and authentication risks that could follow scalable attacks against public-key cryptography.Building on Mosca's migration inequality, the paper introduces the Quantum Migration Priority Score, a transparent decision framework combining timing pressure, consequence, adversary exposure, and cryptographic agility. Illustrative applications to municipal water systems and proliferated low-Earth-orbit architectures demonstrate how migration priority depends on mission consequences, protocol boundaries, key management, supply-chain dependencies, and compensating controls.The paper concludes with a staged governance strategy centered on cryptographic inventories, crypto-agile procurement, testable migration pathways, accountable risk ownership, and explicit management of residual risk.
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
The rapid progress of quantum computing poses substantial risks to classical cryptographic mechanisms widely deployed in Big Data processing systems, whose distributed architectures, high computational intensity, and exposure to diverse attack vectors impose stringent requirements on long-term security and reliability. Accordingly, this study aims to develop a risk-oriented framework for assessing post-quantum cryptographic (PQC) algorithms in large-scale data environments. The proposed methodology integrates cryptographic reliability and computational efficiency within a unified multi-criteria decision-making model, incorporating formalised threat modelling, probabilistic analysis of resistance to classical and quantum attacks, robustness evaluation under high computational loads, and quantitative performance metrics, including latency, throughput, resource consumption, and scalability in distributed infrastructures. Based on this framework, a comparative analysis of representative classes of PQC algorithms is conducted in typical Big Data processing scenarios. The results indicate that different PQC families exhibit distinct security–performance trade-offs and that no single algorithm is universally optimal across all operational conditions. The study concludes that a risk-oriented, multi-criteria selection of post-quantum cryptographic mechanisms enhances the overall resilience and operational efficiency of secure Big Data systems, providing a practical foundation for their design, modernisation, and cybersecurity governance in the post-quantum era.
The rapid progress of quantum computing poses substantial risks to classical cryptographic mechanisms widely deployed in Big Data processing systems, whose distributed architectures, high computational intensity, and exposure to diverse attack vectors impose stringent requirements on long-term security and reliability. Accordingly, this study aims to develop a risk-oriented framework for assessing post-quantum cryptographic (PQC) algorithms in large-scale data environments. The proposed methodology integrates cryptographic reliability and computational efficiency within a unified multi-criteria decision-making model, incorporating formalised threat modelling, probabilistic analysis of resistance to classical and quantum attacks, robustness evaluation under high computational loads, and quantitative performance metrics, including latency, throughput, resource consumption, and scalability in distributed infrastructures. Based on this framework, a comparative analysis of representative classes of PQC algorithms is conducted in typical Big Data processing scenarios. The results indicate that different PQC families exhibit distinct security–performance trade-offs and that no single algorithm is universally optimal across all operational conditions. The study concludes that a risk-oriented, multi-criteria selection of post-quantum cryptographic mechanisms enhances the overall resilience and operational efficiency of secure Big Data systems, providing a practical foundation for their design, modernisation, and cybersecurity governance in the post-quantum era.
The rise of large-scale quantum computing poses a significant threat to traditional cryptographic security measures. Quantum attacks, particularly targeting the mathematical foundations of current asymmetric cryptographic algorithms, render them ineffective. Even standard symmetric key cryptography is susceptible, albeit to a lesser extent, with potential security enhancements through longer keys or extended hash function outputs. Consequently, the cryptographic solutions currently employed to safeguard data will be inadequately secure and vulnerable to emerging quantum technology threats. In response to this impending quantum menace, organizations must chart a course towards quantum-safe environments, demanding robust business continuity plans and meticulous risk management throughout the migration process. This study provides an in-depth exploration of the challenges associated with migrating from a non-quantum-safe cryptographic state to one resilient against quantum threats. We introduce a comprehensive security risk assessment framework that scrutinizes vulnerabilities across algorithmic, certificate, and protocol layers, covering the entire migration journey, including pre-migration, through-migration, and post-migration stages. Our methodology links identified vulnerabilities to the well-established STRIDE threat model, establishing precise criteria for evaluating their potential impact and likelihood throughout the migration process. Moving beyond theoretical analysis, we address vulnerabilities practically, especially within critical components like cryptographic algorithms, public key infrastructures, and network protocols. Our study not only identifies potential attacks and vulnerabilities at each layer and migration stage but also suggests possible countermeasures and alternatives to enhance system resilience, empowering organizations to construct a secure infrastructure for the quantum era. Through these efforts, we establish the foundation for enduring security in networked systems amid the challenges of the quantum era.