The Problem You're Facing

Germany's 2026 regulatory deadline is here. NIS2 Directive requires critical infrastructure and regulated industries to begin post-quantum cryptography (PQC) migration.

 

But most enterprises can't answer these questions:

• Which of our systems use quantum-vulnerable encryption?

• What data is business-critical and needs immediate protection?

• Are we exposed to "harvest-now-decrypt-later" attacks?

• What's our compliance timeline, and what does migration cost?

• Who on our team actually owns this?

​

The "Harvest-Now-Decrypt-Later" Threat

​

Adversaries are storing your encrypted data today to decrypt it tomorrow when quantum computers mature. If your customer data, financial records, or IP are encrypted with RSA or ECC, they're vulnerable.

Big consulting firms want €400-800K for 12-week assessments. You need clarity fast, at a rational cost, from someone who understands your infrastructure.

My Approach: The PQC Risk Assessment Framework
 

Timeline: 4-6 weeks
Investment: €15-25K (pilot pricing for first engagements)
Deliverable: Written risk assessment + 18-month migration roadmap
 

Week 1: Discovery & Cryptographic Asset Inventory

• Comprehensive interviews with CTO, CISO, IT architecture team

• Map your infrastructure: applications, databases, PKI, cloud/edge systems

• Identify all cryptographic dependencies (SSL/TLS, VPNs, code signing, data encryption)

Weeks 2-3: Risk Classification & Threat Modeling

• Classify data by sensitivity (personal, financial, IP, critical infrastructure)

• Assess quantum vulnerability of each system (RSA, ECC, Diffie-Hellman)

• Priority matrix: Which systems are critical-risk vs. manageable-risk?

• "Harvest-now-decrypt-later" exposure analysis

Week 4: Regulatory Compliance Mapping

• NIS2 Directive alignment (3-year audit cycles)

• Sector-specific mandates (finance, pharma, energy, telecom)

• GDPR considerations for encrypted personal data

• Timeline pressure points and compliance deadlines

Weeks 5-6: Roadmap Development & Stakeholder Presentation

• 18-month migration roadmap with phased approach

• Budget estimates (infrastructure, software, labor, training)

• Implementation options: in-house, external partners, hybrid

• Vendor evaluation criteria (if applicable)

• Executive presentation (board-ready summary)

What You Get (Deliverables)
✅ Written Risk Assessment Report (30-50 pages)

• Executive summary (2 pages, board-ready)

• Cryptographic asset inventory

• Risk classification matrix (critical/high/medium/low systems)

• Threat modeling and vulnerability analysis

• Regulatory compliance gap analysis

✅ 18-Month PQC Migration Roadmap

• Phased implementation plan (Quarter 1-6)

• System prioritization (what to migrate first)

• Budget breakdown (infrastructure, software, labor, training)

• Milestone timeline with checkpoints

✅ Stakeholder Presentation

• 60-90 minute executive briefing

• Q&A session with your leadership team

• Follow-up consultation (2 weeks post-delivery)

Ideal Clients

Company Size: €50M-€500M revenue (German Mittelstand sweet spot)
Industries: Manufacturing, finance, pharma, telecom, energy (regulated sectors)
Decision-Maker: CTO or CISO responsible for cryptography and infrastructure
Urgency: Facing 2026/2027 compliance deadlines or concerned about data vulnerability