Quantum-Safe Compliance Program
Quantum-Safe Readiness Check
A verified, clause-by-clause answer to the post-quantum and cryptography questions in your Canadian and US public-sector bids, in five business days.
Why now
The problem
The public-key cryptography most systems use today can be broken by a large enough quantum computer, and data recorded now can be decrypted later. Public-sector buyers have started asking vendors about it in bids, citing CCCS ITSM.00.501 and the Treasury Board's SPIN on migrating the Government of Canada to post-quantum cryptography in Canada, and OMB M-26-15 in the United States.
What your next Government of Canada bid is likely to ask
- Do your cryptographic modules support post-quantum cryptography by the end of 2026? (CCCS ITSM.00.501)
- Is your CMVP certificate still active? FIPS 140-2 certificates moved to NIST's Historical List on 21 September 2026.
- Can your algorithms be changed by configuration, without replacing software or hardware?
The Check
What the Check is
We verify the facts instead of asking you to self-declare: from the outside (TLS, certificates, hybrid ML-KEM key exchange), from NIST's records (CMVP and CAVP), from your code, and from a 90-minute interview with one of your engineers. Each finding is cited with its source and date, so a buyer can re-run the checks.
What we are not: a certification body, a CMVP laboratory, or a law firm. The attestation records what we verified, by which method, on which date.
Fit
Who it is for
Software and service companies with a bid or security questionnaire that asks about post-quantum cryptography.
- Vendors to the Government of Canada
- US federal contractors
- Vendors to banks and credit unions
Deliverables
What you receive
- A signed bilingual attestation (English and French), signed with ML-DSA-65 and ECDSA P-256, that anyone can verify in a browser
- A clause-by-clause answer sheet with paste-ready answers for your bid or security questionnaire
- A gap list: every clause you do not meet today, and why
- A dated remediation plan to close those gaps
- A verification page your buyer can open, and a 60-minute walkthrough with your team
Timeline
How it works
Five business days from the day we have your order form and access.
- Day 0: Order form, your domains, read-only repository access, the current bid text
- Day 1: Outside-in TLS and certificate probes; code and dependency scan
- Day 2: NIST CMVP and CAVP lookups; identity and signing configuration
- Day 3: 90-minute interview with one of your engineers
- Day 4: Clause mapping, gap list, paste-ready answers
- Day 5: Independent review, signature, verification page, 60-minute walkthrough
English and French
Languages
The Check runs in English or French, and the attestation and answer sheet are delivered in both.
Talk to us about your next bid
Tell us who you sell to and when your bid or questionnaire is due, and we will tell you which clauses apply.