The Post-Quantum Cryptography Enterprise Maturity Model (PQCEMM) is a structured, vendor-neutral framework for assessing and improving an organisation’s readiness to make the transition to quantum-safe or post-quantum cryptography. Derived from the principles of the Capability Maturity Model Integration (CMMI) and adapted to the specific demands of post-quantum transition, it provides a common language for boards, risk leaders, and technical teams.

The model defines five maturity levels – from Quantum Unaware to Quantum Ready – assessed across eleven dimensions grouped into two categories: Organisational Readiness and PQC Programme Content. It produces a single score on a 1.0–5.0 scale, and a per-dimension breakdown that supports programme planning, board reporting, and regulatory submissions.

The PQCEMM specification will shortly be published under a Creative Commons Attribution 4.0 licence. It will then be available free of charge for use by any organisation, assessor, or standards body.

The PQCEMM White paper describes the structure, rationale, and practical application of the model.