A financial-services PQC evidence record connects a cryptographic observation or declaration to its source, scope, owner, business context, migration decision and verification evidence. It is a working record, not a readiness score or compliance certificate.
Build an evidence record before making a readiness claim
The G7 Cyber Expert Group's January 2026 roadmap discusses inventory, third-party dependencies, migration testing and continuing validation. It explicitly does not set regulatory expectations. Use it as planning context, then have the responsible team establish which obligations and policies apply to its institution.
NCSC guidance recommends discovery and planning by 2028, priority migration work by 2031 and completion by 2035. Those are planning milestones, not a guarantee that a particular bank, product or public endpoint is compliant.
Download the Financial Services PQC Evidence Worksheet
Use the blank workbook to organize identified assets and the systems that remain unassessed. Its Evidence register and Coverage gaps tabs are editable locally. It contains no bank data, macros, automatic readiness rating or uploaded customer information.
This is not an official Bank of England questionnaire, a response to undisclosed supervisory questions or a complete bank assessment. A manual stage change does not establish successful migration. Keep original evidence in approved storage and record references, timestamps and scope in the worksheet.
| Record | Keep visible |
|---|---|
| Asset and business context | Application, service, environment, owner, criticality and sensitive-data lifetime |
| Source evidence | Cryptographic property, detection method, evidence reference, time and confidence |
| Dependencies | Supplier or platform prerequisites, reviewed separately from observed cryptography |
| Migration | Asserted stage, expected profile, observed result and separate verification evidence |
| Coverage gaps | Scanned, discovered, inferred, unknown or not scanned; responsible owner and next action |
Separate public exposure from the internal estate
An authorized public-service scan can establish selected TLS and X.509 properties at the observed endpoint and time. It does not inspect a core banking platform, payments network, private PKI, database encryption or internal application merely because those systems belong to the same organization.
Supported repository checks provide inferred declarations, not proof of runtime execution. Imported CBOM records retain their declared provenance. Owner, service and migration context entered by a reviewer remains a manual assertion. Preserve these distinctions when combining records for a financial-services cryptographic inventory.
Request supplier evidence, not a quantum-safe checkbox
For each dependency, record the product and version in scope, the proposed replacement profile, interoperability constraints, responsible supplier and the evidence still needed. A vendor roadmap or library declaration is different from a deployed configuration.
Keep long-lived sensitive information, operational criticality and change constraints explicit. Record unknowns for review rather than inventing a harvest-now/decrypt-later score or assuming every cryptographic finding needs the same migration treatment.
Verify the approved change after deployment
Cipher Discovery's current certificate control compares an intended public leaf DER SHA-256 fingerprint with newer observed certificates. Its separate migration verification evaluates supported public certificate profiles. Neither provides a complete bank risk assessment or guarantees quantum safety.
- Record the intended state
Name the exact target service and approved cryptographic expectation. Keep the approval and its time separate from discovered evidence.
- Collect newer evidence
Compare a newer same-scope observation with the expectation. A deployment ticket or manual deployed stage alone is not verification.
- Retain the result and gaps
Preserve mismatch, partial and inconclusive states with evidence, observation age and the next responsible action. A matching public certificate does not verify every replica or the wider migration.
Use current capabilities without assuming Enterprise availability
Free evaluation includes bounded public scans, supported browser-local repository checks, CBOM workflows, a private browser-bound register and up to five opt-in daily/weekly exact-service monitors with 30-day authorization. Current drift, expiry warnings and expected-fingerprint results are in-workspace, not delivered by email or webhook.
Paid plans are request-only Early Access. Recoverable accounts, shared team roles, expanded quotas, commercial retention and email delivery are not active subscriptions. Discuss financial-sector requirements without assuming an SLA, SSO, private deployment, data-residency commitment or regulatory approval.
Frequently asked questions
Is this an official Bank of England questionnaire?
No. It is an independent blank evidence worksheet, not a verified official questionnaire or a substitute for institution-specific supervisory instructions.
Does a public scan assess an entire bank?
No. It observes the exact selected public service from the scanner vantage. Internal infrastructure and unselected systems remain outside that scan's coverage.
Can a deployed stage mark migration complete?
No. Keep manual planning stages separate from newer scoped verification evidence and preserve failed, partial and inconclusive results.
Does the worksheet upload evidence or secrets?
No. The download is a blank local workbook with no upload workflow. Record metadata and approved references only; never enter private keys, tokens, credentials or sensitive source contents.
Can we use it to claim PQC compliance?
No. It organizes evidence and gaps for review; it does not certify quantum safety, regulatory compliance or complete cryptographic coverage.