Back to DashboardStrategyPhase 1 · Discovery & Inventoryintermediate50 min

Data & Asset Sensitivity Assessment

Classify your data assets, map compliance obligations across GDPR, HIPAA, NIS2, and CNSA 2.0, then generate a prioritized PQC migration list using NIST RMF, ISO 27005, FAIR, and DORA methodologies.

Why this matters: Not every dataset needs to move to PQC on the same timeline — data with a 20-year confidentiality requirement is already vulnerable to harvest-now-decrypt-later, data that expires next year isn't. Classifying by sensitivity turns 'migrate everything' into an actual prioritized plan.

Start here: Fill in the Add Data Asset form — name, type, sensitivity tier, retention — and drag the CRQC arrival slider: each asset's HNDL Risk Year in the inventory table updates live.

For your role

Executive / Business Leader: Catalogue data assets by type, sensitivity tier and retention, score them across four weighted dimensions, and read the prioritised migration list: not every dataset moves on the same timeline.
GRC / Risk & Compliance: The Classification Challenge scores ten real scenarios on the four-tier model and the conflict step resolves GDPR, HIPAA and CNSA obligations against each other; the output is a prioritised list with recommended algorithms.
Researcher / Academic: The four-dimension composite score and the multi-framework conflict resolution are explicit methods (NIST RMF, ISO 27005, FAIR), so the priority map is reproducible.
Curious Explorer: Ten short scenarios ask you to rate how sensitive a piece of data is and for how long it matters; the answer shows why some data needs protecting from future computers now and some does not.

Practice in the Simulation

The threat means adversaries are collecting encrypted data today — storing it until a Cryptographically Relevant Quantum Computer (CRQC) arrives to break it. The critical question is: which of your data is worth harvesting?

The answer depends on how sensitive the data is and how long it needs to remain confidential. You cannot prioritize your PQC migration without first knowing what data assets you hold, how sensitive they are, and what compliance frameworks govern their protection.

“NIST SP 800-37 RMF Step 1 is ‘Prepare’ — and Step 2 is ‘Categorize’ your information systems. Data classification is not optional; it is the foundation of any risk-based approach to cryptographic migration.”

— NIST SP 800-37, Risk Management Framework