Quantum Resilience Evidence

1. 01

   Cryptographic Bill of Materials (CBOM/QBOM)

   Complete inventory of cryptographic assets

   Compliant

   What we provide

   • CycloneDX 1.6 compatible CBOM for all 8 products
   • Quantum Bill of Materials (QBOM) classifying quantum-safe vs vulnerable algorithms
   • Automated CBOM generator (regenerated quarterly)
   • Human-readable summaries for each product

   Sample CBOM entry (Wallet Extension)

   {
     "algorithm": "post-quantum digital signature",
     "type": "signature",
     "standard": "NIST-standardized post-quantum cryptography",
     "securityLevel": 2,
     "quantumSafe": true,
     "nistApproved": true,
     "publicKeySize": 1312,
     "signatureSize": 2420,
     "library": "quantum-safe cryptographic libraries"
   }

   The full CBOM/QBOM set is included in the compliance package — request it at info@pqcnow.com.

2. 02

   Integration & Vendor Transparency

   APIs, dependencies, and third-party integrations

   Partial

   Our stack

   Scroll sideways to see all columns.

   Layer	Status
   TLS Layer	PQC-enabled
   Application Layer	PQC (post-quantum digital signature)
   Database Encryption	AES-256 (symmetric)
   Cloud Provider	Mixed (evaluating)

   Mitigation strategy

   • End-to-end encryption bypasses cloud provider
   • Vendor crypto disclosure requirements in procurement
   • Symmetric crypto (AES) not quantum-vulnerable
   • Quarterly vendor PQC readiness assessments
3. 03

   Governance Artifacts & Policies

   Documented procedures, policies, and compliance frameworks

   Compliant

   Key Lifecycle Policy

   Complete procedures for key generation, storage, rotation, revocation, and destruction.

   Included in the compliance package

   Algorithm Agility Framework

   Migration strategies, hybrid cryptography, and future-proofing approach.

   Included in the compliance package

   Compliance Matrix

   Mapping to NIST, CNSA 2.0, ISO 27001, GDPR, and other frameworks.

   Included in the compliance package

4. 04

   Algorithm Agility (Not Just Swap)

   Prepared for cryptographic evolution

   Strong

   Multi-algorithm support

   Post-quantum digital signature — level 1

   NIST-standardized security (128-bit equivalent)

   Post-quantum digital signature — level 3

   NIST-standardized security (192-bit equivalent)

   Post-quantum digital signature — level 5

   NIST-standardized security (256-bit equivalent)

   Post-quantum key encapsulation

   NIST-standardized security, key encapsulation

   Agility features

   1. Versioned Signatures — Every signature includes algorithm ID for future-proof parsing
   2. Hybrid Mode — Classical + PQC for defense-in-depth (blockchain, browser)
   3. Algorithm Registry — EXPERIMENTAL → ACTIVE → DEPRECATED lifecycle
   4. Migration Playbooks — Documented procedures for emergency algorithm replacement
5. 05

   Testing & Validation

   Yes
   • Automated test suite (1000+ iterations)
   • Performance benchmarks published
   • Cross-library interoperability tests
   • NIST Known Answer Tests (KAT)

   See the benchmarks
6. 06

   Vendor Transparency

   Partial
   • Open-source crypto libraries disclosed
   • No proprietary black-box crypto
   • Cloud provider PQC status: evaluating
   • Vendor scorecard in development
7. 07

   Board-Level Oversight

   Yes
   • Quantum risk register maintained
   • Quarterly executive briefings
   • Budget allocated for PQC program
   • Fiduciary duty documented
8. 08

   Telemetry & Observability

   In progress
   • Live metrics dashboard (Q1 2026)
   • Algorithm usage tracking
   • Performance monitoring
   • Real-time anomaly detection

   Preview dashboard
9. 09

   Regulatory Compliance

   Yes
   • NIST-standardized post-quantum cryptography compliant
   • CNSA 2.0 aligned (ahead of 2030)
   • GDPR encryption standards exceeded
   • ISO 27001 certification (Q3 2026)

   See the compliance matrix
10. 10

    Fiduciary Evidence

    Yes
    • Self-certification reports (PDFs)
    • Technical implementation audits
    • Third-party security audit (Q1 2026)
    • NIST cryptographic module validation (Q1 2027)

    Request the compliance package

This evidence page is updated quarterly. Last updated: December 29, 2025. Next review: March 2026. We welcome feedback and independent verification — contact info@pqcnow.com.