POST-QUANTUM READINESS / THE ADVISORY MODEL
A Framework Can Tell You What to Do. It Cannot Tell You What You Have.
KPMG's new seven-step Q-PREP plan is a strong map for post-quantum readiness. Like every advisory framework, several of its steps depend on measurement evidence that the framework itself does not produce. That gap is where Qtonic Quantum complements them, not competes.
Qtonic Quantum Research Team | June 9, 2026
In June 2026, KPMG published Q-PREP, a seven-step framework for guiding an organization to post-quantum cryptography readiness [1]. It is a good framework. It moves past general warnings to a defined sequence, from objectives aligned with business goals, through a full inventory of cryptographic assets, risk prioritization and data governance, algorithm evaluation, a transition plan, implementation and validation, and finally continuous monitoring. KPMG's US quantum lead has likened the migration to retuning every key, algorithm, and certificate across a vast IT estate without missing a note.
The metaphor is apt, and it points at the problem the framework cannot solve on its own. A score tells the orchestra what to play. It does not tell the conductor whether each instrument is in tune. For three of Q-PREP's seven steps, knowing what to do is the easy part. The hard part is measuring what is actually there, and proving whether the fix works.
A plan is not the same as the capability to execute it. The framework identifies where measurement is required. The framework itself is not the measurement evidence. That division of labor is the whole point of this piece.
x.com/QtonicQuantum/status/2…