What does FINMA Guidance 05/2026 actually require?

FINMA expects supervised institutions to manage quantum-related cyber risk under existing operational-risk rules. Practically, that means a board-adopted post-quantum strategy and roadmap by mid-2027, a cryptographic inventory, prioritisation of critical data (including harvest-now-decrypt-later exposure), crypto-agility, and early engagement with vendors and outsourcing partners.

How does the Quantum Risk Score help with the mid-2027 deadline?

The Quantum Risk Score gives you a published, auditable baseline of cryptographic exposure. That baseline is the first page of a FINMA-aligned roadmap: what is vulnerable, what matters most, and where migration should start. No install required for the initial assessment.

What is a Cryptographic Bill of Materials (CBOM)?

A CBOM is an inventory of the cryptographic assets in your environment: algorithms, keys, certificates, protocols and the systems that use them. Without it, a PQC roadmap is guesswork. DuoKey generates and maintains that inventory so you can prioritise by risk, not by convenience.

Does DuoKey integrate with ServiceNow?

Yes. Findings and migration work can sync into ServiceNow so cryptographic risk sits inside the same operational workflows your teams already use.

Where can I read the QRS methodology?

The full Quantum Risk Score methodology, including signal weights and regulatory mapping, is published at duokey.com/solutions/quantum-readiness-score.