Part of the QRAMM toolkit by CSNP: CryptoScan, CryptoDeps, TLS Analyzer. Framework: qramm.org.
Website · Toolkit · Quick assessment
QRAMM is a free and open framework that helps an organization find out how ready it is for quantum computers and plan its move to quantum-safe cryptography. It looks at four dimensions through 120 assessment questions, and comes with an Excel toolkit that does the scoring for you: it labels each dimension score and the overall score with one of four maturity levels, from Basic to Advanced (the Scoring Methodology gives the score ranges).
Start with the four dimensions in the framework overview. They are what you rate your organization against.
CryptoScan automates part of Dimension 1: it inventories the cryptography in a code repository and maps each finding to practice 1.1, 1.2 or 1.3 (CryptoScan guide):
go install github.com/csnp/cryptoscan/cmd/cryptoscan@latest
cryptoscan scan .These tools automate parts of a QRAMM assessment. The Open Source Tools page has a guide for each one.
These are built and maintained alongside the framework, and CSNP stands behind them. They support Dimension 1 (Cryptographic Visibility & Inventory).
| Tool | Description | Repository |
|---|---|---|
| CryptoScan | Cryptographic discovery scanner: scans codebases for quantum-vulnerable algorithms with SARIF and CBOM output | GitHub |
| TLS Analyzer | TLS/SSL configuration analyzer: evaluates cipher suites and key exchange, detects hybrid ML-KEM key exchange, and tracks CNSA 2.0 compliance | GitHub |
| CryptoDeps | Dependency crypto analyzer: identifies quantum-vulnerable algorithms in your software supply chain | GitHub |
Tools from the wider community that people using QRAMM may find useful. They are not maintained by CSNP, are not part of the QRAMM toolkit, and listing one here is not an endorsement or a security review. Evaluate any of them the same way you would evaluate any other third-party dependency.
| Tool | Description | Maintainer | Repository |
|---|---|---|---|
| pqc-tools | Finds quantum-vulnerable cryptography in code, writes CycloneDX CBOMs and gives NIST migration guidance. CLI, MCP server and GitHub Action. | quantakrypto | GitHub |
To propose a tool for this table, open a pull request. Please include the license, who maintains it, and a link to its documentation.
QRAMM looks at four dimensions, each with three practices. The framework overview describes every one of them.
- Cryptographic Visibility & Inventory (CVI): find and list the cryptography your systems use.
- Strategic Governance & Risk Management (SGRM): leadership, policy and risk management for the move.
- Data Protection Engineering (DPE): protect data at rest, in transit and in use.
- Implementation & Technical Readiness (ITR): deploy, integrate and maintain quantum-safe technology.
Your answers place you on five maturity levels, from Basic to Optimizing. The scoring methodology explains how answers become scores.
The Excel toolkit holds all 120 questions, scores your answers for you, adjusts the result for your organization's risk profile, and maps it to eight compliance frameworks.
- Download the toolkit
- Sample assessment, already filled in
- Toolkit overview
- Screenshots of the scorecards and compliance views
- Take the quick assessment for a first maturity score in 5 to 10 minutes.
- Follow the getting started guide to plan a full assessment.
- Use the templates for an executive report, asset inventory, vendor questionnaire and evidence collection.
The toolkit maps QRAMM to eight frameworks and standards: NIST PQC, NIST CSF, CMMC, FISMA, FedRAMP, ISO 27001, SOC 2 and CIS Controls (descriptions). The compliance mapping shows practice by practice how QRAMM supports NIST PQC, CMMC, FedRAMP and FISMA, and the coverage summary gives a quick reference.
- Overview: business value, architecture, roadmap, scoring and standards
- Frequently asked questions
- Framework overview
- All 120 assessment questions
- Full assessment
- Maturity levels and scoring methodology
- Toolkit overview and toolkit screenshots
- Getting started guide
- Templates
QRAMM welcomes contributions from security professionals, quantum researchers, enterprise architects and compliance specialists. Open an issue or a pull request, or join GitHub Discussions. For questions about the framework, write to qramm@csnp.org.
QRAMM is written by Emily (Stamm) Fane, author, and Abdel Fane, co-author, of CyberSecurity NonProfit (CSNP). See Framework Development.
QRAMM is released under the MIT License. To cite it:
@software{qramm2025,
title = {QRAMM: Quantum Readiness Assurance Maturity Model},
author = {Fane, Emily and Fane, Abdel},
organization = {CyberSecurity NonProfit (CSNP)},
year = {2025},
url = {https://qramm.org}
}QRAMM is a trademark of CyberSecurity NonProfit (CSNP)
© 2025 CSNP. All rights reserved.