FAQ
The questions we hear on scoping calls. If yours is not here, the scoping call is twenty minutes and there are no slides. Sector specific questions are answered on each sector page.
BEFORE YOU CALL
A fixed scope engagement that produces a cryptographic bill of materials for the networks you put in scope: every tunnel, certificate, cipher and key exchange, across IT and OT, discovered passively. You get the findings ranked by operational consequence, a phased migration roadmap mapped to ITSM.40.001 and NIST guidance, and a 90 day action plan. It is the Detect phase of Detect, Protect, Comply, Scale, and it is where every engagement starts.
It depends on the number of sites and network segments in scope, which is what the scoping call settles. The scope and the schedule are written into the quote before any work starts, so you know both before you commit.
Fixed scope, fixed price, quoted in writing after the scoping call. There is no hourly billing and no change in price once the scope is agreed unless you change the scope. Monthly instalments are available under the Fall 2026 enrolment, and we will structure the quote to fit a fiscal year or a capital cycle if that helps you get it approved.
No. Bill C-8 names finance, telecommunications, energy and transport in its first wave, and the regulations that designate specific operators are being written now. The Cyber Centre's ITSM.40.001 timeline applies to federal systems and flows down to anyone who supplies them. Whether or not a regulator is asking you today, the first thing any of them will ask is for an inventory, and an inventory takes weeks to build and minutes to produce once you have it.
No. The scope is sized to the network, not to the company. A single treatment plant, a regional district, a credit union or a mid sized producer can run a Discovery Program on the parts of the estate that matter most. A regional commission or shared services group can scope one program across several members.
The scoping call is twenty minutes, has no slides, and ends with us telling you plainly whether a Discovery Program fits or whether a smaller first step is right. If the answer is that you do not need us yet, we say so. The Cryptographic Risk Check on this site is a five minute self assessment if you would rather look first.
WHAT WE NEED FROM YOU AND WHAT WE TOUCH
Read only visibility into the network segments in scope, arranged with your network and security team on the scoping call, plus any documentation you already have: network diagrams, firewall and VPN configurations, certificate inventories. We work with what exists. Missing documentation is itself a finding, not a blocker.
No. Discovery is passive: it observes and catalogues, it does not reconfigure, patch or interrupt. Nothing on an OT or control network is touched. Any change to the network only happens in a later phase, if you choose it, under its own scope and change control.
We identify the cryptography in use by observing the network and reading configurations rather than by sending traffic or running agents on operational systems. That is why it is safe on control networks that cannot tolerate downtime, and it is why some findings are labelled discovered and others customer supplied: we tell you which is which.
Findings are held in carrier neutral Canadian colocation operated by Fabric and are shared only with the people you name. The report is written for you, belongs to you, and is not used as a reference or a case study without your written permission. Fabric Networks designs, supplies, installs and operates in Canada, from Calgary.
Yes. That is what it is for. The report is written for two readers at once, the engineer who has to act on it and the executive who has to sign for it, and the evidence trail is laid out so an auditor or a regulator can follow how each finding was established.
WHAT YOU GET AND HOW TO READ IT
Every tunnel, certificate, cipher suite, key exchange and protocol version found in the networks in scope, with where it lives, what depends on it, and whether it is quantum vulnerable. Long lived data paths, the ones exposed to capture now and decryption later, are called out separately.
By operational consequence, not by generic severity score. A weak tunnel to a compressor station, a dosing controller or a backbone router ranks above a weak cipher on a printer, even if a scanner would score them the same. The ranking reflects what a compromise would do to your operation.
Every finding carries one of those three labels. Customer supplied means it came from your documentation and we have not independently verified it. Discovered means we observed it directly. Our judgment means it is Fabric's assessment, for example a priority or a migration recommendation. We never present a judgment as a discovered fact.
The migration roadmap is phased against the Cyber Centre's 2031 and 2035 milestones and the NIST post-quantum standards, with each phase tied to the systems and data it protects. For federal departments and their suppliers, the structure is designed to drop into the annual progress reporting ITSM.40.001 already requires.
AFTER THE DISCOVERY PROGRAM
No. The Discovery Program is complete on its own and many organizations will act on the roadmap with their existing teams and vendors. If you want it, Fabric can harden the links that matter with quantum-safe keys delivered into the firewalls you already run, and keep the inventory current through ongoing governance. Neither is required to get value from the first step.
Yes. Quantum-safe key delivery is vendor agnostic: keys are delivered through open interfaces (ETSI 014, SKIP and vici) into the firewalls, routers and optical encryptors you already operate. FortiGate, Juniper SRX, Cisco, Palo Alto Networks and Ciena are examples of platforms in scope, not an exclusive list, and there is no rip and replace. Your MSP or Fortinet partner keeps their role; we work alongside them, and on the scoping call we will tell you exactly where the lines sit.
The SKA-Platform is developed by Arqit Quantum Inc. Fabric licenses it as a Private Instance, hosts and operates it in Canada, and does the work around it: the inventory, the architecture, the integration and the governance. Keys are generated on demand, never stored and never transmitted. The platform is validated to FIPS 140-3; its developer's consultancy assurance is from the UK NCSC, which is a UK credential, and we say so.
The platform Fabric operates has been publicly demonstrated by other operators: a Tier 1 carrier on a multi-100G optical ring, a defence integrator across mixed bearers, and a European data centre operator keeping keys sovereign while workloads ran in public cloud. Those are their demonstrations, not Fabric deliverables, and each is recorded in the Library with its source and our reading of it. Fabric's own evidence is the method, which you will see on the scoping call, and the report, which is yours to judge.
You get an email from Brent within one business day with three times for a twenty minute scoping call. No mailing list, no automated sequence. If you took the Risk Check instead, you get your results and nothing else unless you ask.
Still have a question? Request a scoping call. Twenty minutes, no slides.
Request a scoping call