Formalize Quantum Top 10 entry template

[galoisField7]

Formalize the Quantum Security Top 10 Entry Template

Summary

This PR updates the Quantum Security Top 10 entry template to formalize conventions that have already emerged during the development of the v0.1 entries and the subsequent community discussions.

The goal is not to increase the amount of content required for each entry, but to improve consistency, clarify scope boundaries, and make the guidance more useful for practitioners.

This PR follows the discussion in #15 and incorporates subsequent community feedback.

---

Motivation

While reviewing the current Top 10 entries, several concepts repeatedly appear despite not being part of the current template.

Examples include:

• explicit scope boundaries between related risks;
• standards and regulatory mappings;
• evidence maturity;
• practical detection guidance;
• relationships between entries.

Rather than leaving these as ad hoc additions, this PR incorporates them into the common authoring template.

The changes are intended to codify conventions that are already emerging across the project rather than introducing entirely new concepts.

---

Proposed Changes

Scope

Introduce an explicit Scope section to clearly define what an entry covers and, where useful, what it explicitly does not cover.

This helps reduce overlap between entries and makes the taxonomy more consistent.

---

Evidence

Introduce an Evidence section together with a common evidence convention.

Each entry classifies the maturity of the attack class using one of:

• Demonstrated
• Emerging
• Theoretical

The detailed definitions are maintained in a separate EVIDENCE.md document to keep the Top 10 concise while ensuring consistent classification across entries.

---

Detection

Introduce a Detection section describing practical ways organisations can determine whether they are exposed to the risk.

Examples include:

• architecture reviews;
• cryptographic inventories / CBOMs;
• configuration analysis;
• software composition analysis;
• runtime monitoring;
• infrastructure assessments.

---

Mitigation Guidance

Clarify that, where practical, mitigations should be:

• actionable;
• measurable;
• verifiable.

The intention is to encourage engineering-oriented guidance while leaving detailed verification procedures to future supporting guidance rather than the Top 10 itself.

---

Standards & Regulatory Mapping

Formalize this section within the template.

Every current migration entry already contains standards and regulatory mapping, making it a de facto part of the project. Including it in the template improves consistency and strengthens the usefulness of the Top 10 for regulated industries.

---

Related Risks

Introduce a Related Risks section allowing entries to reference adjacent Quantum Security Top 10 risks and briefly explain the relationship.

This improves navigation and helps clarify scope boundaries.

---

Benefits

These additions make the Top 10:

• more consistent;
• easier to review;
• easier to navigate;
• more actionable for practitioners;
• better aligned with the project's principle of Evidence over speculation.

---

Non-goals

This PR intentionally does not rewrite the existing Top 10 entries.

The revised template can be adopted incrementally as entries continue to evolve.

---

Related Discussions

This PR implements the template improvements discussed in #15.

The proposed evidence field is designed to work together with a separate evidence convention, should the project decide to adopt one.