An educational migration-risk scenario calculator, not a Q-day prediction or compliance certificate.
In this article
LuniQ Risk Guide: Assess Retention, Migration Time and Quantum-Threat Scenarios
This guide explains the controls in LuniQ Risk using fictional information categories. The app is an educational planning aid. It does not inspect your network, certify compliance or predict a date for a cryptographically relevant quantum computer.
Step 1: List categories, not secret content
Begin with the data-type list. Use a preset as a starting point, then edit its name and confidentiality lifetime to match the scenario you want to examine. A category such as fictional design archive is sufficient; the model does not need the archive's contents, actual key material or personal identifiers.
Retention needs and confidentiality needs are not necessarily identical. A document can be retained for operational reasons without every field requiring the same secrecy period. Choose a defensible duration and write down the reason outside the calculator if the assessment will support a real project discussion.
Step 2: Estimate the migration work
Complete the migration questions and read how their answers contribute to the estimated years. Use the manual migration-time option when you have a different planning assumption. The calculation is intentionally transparent, but transparency does not make the estimate a measured inventory or a supplier commitment.
Consider how your scenario changes if migration takes longer than expected. Systems that are difficult to update, long-lived equipment, integration testing and external dependencies can be reasons to investigate a wider time range. The app cannot establish which of those issues actually exists in your environment.
Step 3: Choose an explicit Q-day assumption
Select one of the scenario years or enter a custom year. Treat all of them as inputs, not forecasts. The interface provides context for its presets, but a survey-based scenario is not a promise that a particular year is safe or unsafe.
The assessment compares confidentiality lifetime plus migration time with the assumed remaining preparation window. If the first two quantities exceed the third, the category is flagged under that model. A different Q-day assumption or a better migration estimate can change the outcome without any underlying cryptographic system changing.
Step 4: Read the timeline and category table together
Inspect each category's lifetime, the migration allowance, the resulting status and its place on the timeline. Do not summarize the entire inventory using only the strongest color. A category with a very long secrecy requirement may deserve different follow-up from a short-lived operational message.
For a simple arithmetic check, use ten years of secrecy, three years of migration and an eight-year threat window. Thirteen is greater than eight, so the model identifies an overlap. This is a check of the rule, not a probability calculation and not evidence that an attack will occur.
Step 5: Verify policy references separately
The page includes NIST and optional federal-policy context. Read the cited source itself before relying on a deadline, and establish whether it applies to your organization, system and cryptographic use. A checkbox cannot make that applicability determination.
A primary reference is NIST's Transition to Post-Quantum Cryptography Standards publication page. NIST's PQC project also links the relevant standards and ongoing work. The tool's planning output is not a substitute for those documents or for qualified review of a real migration.
Step 6: Turn the result into specific questions
Use the suggested next actions to organize follow-up: confirm data lifetimes, build a cryptographic inventory, identify difficult dependencies and verify a realistic migration sequence. Assign owners and seek actual evidence. The app does not create tasks in an enterprise system or automatically contact suppliers.
Rerun with a shorter and a longer migration estimate. If the conclusion changes sharply, record that sensitivity in your discussion. A useful report should expose uncertainty instead of implying that a single chosen year settles it.
Step 7: Export, reset and revisit
Download the Markdown report or use Print / save PDF. Reopen the artifact and check that the assumptions match what you intended to discuss. Use a clear filename and date if you compare later assessments.
The app remembers choices in local storage on this browser profile. Reset clears them; closing the tab alone does not have the same effect. Static hosting requests still occur, even though the calculation does not require an uploaded inventory. For the distinction between scenario arithmetic and a real prediction, read the Risk overview.