Tiered remediation

A staged path from broken to quantum-safe.

Tier 1 · Hardening

Stop the bleeding

TLS 1.2+ minimums, SSH KEX cleanup, deprecated cipher suite removal, certificate rotation. Quick wins, days not months.

Tier 2 · Hybrid

Buy time

LUKS upgrade, database TDE, KMS-backed keys, hybrid PQC TLS where supported. The pragmatic middle ground.

Tier 3 · Full PQC

Quantum-safe

ML-KEM, ML-DSA, SLH-DSA. Hybrid PQC TLS on every edge. Signed PQC binaries. The end state.

Sector-specific coverage.

Defense

National security & military

TIBER-LT aligned, CNSA 2.0 deadline-aware. Sovereign on-prem deployment is the default for this sector.

Frameworks
TIBER-LT · CNSA 2.0 · NATO CIS
Government

Public sector & KII

NIS2 essential entities, Lithuanian KSĮ scope, eIDAS Regulation. Sector calibration lives in Vilnius.

Frameworks
NIS2 · KSĮ · eIDAS · ENISA
$
Finance

Banking & insurance

DORA in force since January 2025. PCI DSS 4.0 cryptographic strength requirements. Vendor crypto attestation.

Frameworks
DORA · PCI DSS 4.0 · MAS TRM
Healthcare

Hospitals & medical

GDPR Article 32 cryptographic appropriateness. HIPAA equivalents. Long data shelf-life raises Rest-layer pressure.

Frameworks
GDPR Art. 32 · HIPAA · ISO 27799
Telecom

Operators & carriers

ENISA 5G toolbox. NIS2 essential. Long-haul transport cryptographic posture and inter-PLMN signalling.

Frameworks
ENISA 5G · NIS2 · ETSI ZSM
ϟ
Energy

Grid & OT

IEC 62443-zoned topology. Wind, BESS and substation operators. OT/IT crypto convergence is the priority.

Frameworks
IEC 62443 · NIS2 · NERC CIP
Education

Universities & research

GÉANT alignment, eduGAIN federation. Research-data shelf-life is generational; Rest-layer scoring is critical.

Frameworks
GÉANT · eduGAIN · ISO 27001
Transport

Mobility & logistics

ISO/SAE 21434 for automotive. Aviation EUROCAE ED-202A. Maritime IACS UR E26/E27. Long-life embedded crypto everywhere.

Frameworks
ISO/SAE 21434 · ED-202A · IACS UR
Retail

Commerce & payments

PCI DSS 4.0. SCA / 3DS2 cryptographic strength. Loyalty & identity systems are the silent Rest-layer load.

Frameworks
PCI DSS 4.0 · PSD2 SCA · ISO 27001
Test lab

A reproducible sector test lab.

Each sector calibration is validated against a Proxmox-based replica of a representative organisation in that sector — built from infrastructure-as-code (Ludus + Ansible) and rebuilt from scratch on every release. We run the audit against the lab, verify the score, and ship.

ProxmoxLudusAnsibleReproducibleVerifiable
Get started

Ready to see your score?

Free pilot · 25 assets · QARS-NI report in 72h.

Audit now View pricing