Resources / News
Announcements and analysis as the post-quantum transition accelerates: the mandates reshaping the 2030 to 2035 window, what they mean for enterprises, and the moves we are making.
The US Department of War's post-quantum strategy requires all systems to support the new cryptography by the end of 2030, and reporting says those requirements will flow down to defense contractors through CMMC before rulemaking finishes.
Google lowered the estimated cost of breaking Bitcoin signatures about twentyfold and independent studies put millions of coins at risk, so institutions that hold or custody digital assets should expect questions about address exposure and key management.
The HHS preparedness office has signaled post-quantum migration guidance for hospitals and public health organizations, and because health records stay sensitive for decades, the harvest-now-decrypt-later exposure for this sector is real today.
NATO set a quantum roadmap in September 2026 to adopt and implement post-quantum cryptography, with an action plan update by Q3 2027 and a pilot in Q4 2027.
CISA's guidance on post-quantum cryptography for operational technology warns that long equipment lifecycles, slow patching, and end-of-life systems make industrial migration the hardest, so operators should segment networks and start inventories now.
The G7 financial roadmap targets 2030 to 2032 for critical systems and the ECB told eurozone banks that post-quantum migration must start now, which turns quantum readiness from a research topic into a supervised expectation.
Ransomware in food and agriculture rose sharply through 2026 and the sector's traceability records depend on signatures that must stay trustworthy for years, yet almost no post-quantum migration planning exists for the sector in current reporting.
HHS and ASPR signalled in September 2026 that post-quantum guidance for hospitals is coming, while current resilience guidance still contains no post-quantum content.
Building controllers and hotel systems often run 15 to 20 years, so encryption installed today will outlive the hardware, and vendors warn that harvest-now-decrypt-later exposure plus a 2027 to 2028 tipping point should move owners toward zero-trust designs now.
The US aviation regulator asked industry how to move air traffic systems to post-quantum cryptography, a research review found transport standards lack post-quantum certificate profiles, and port and road operators face trust decisions that will persist for decades.
US Senate bill S. 5313, introduced in August 2026, would have FERC consider quantum risk in reliability standards and create a DOE post-quantum sandbox; it is a bill, not law.
The Bank for International Settlements told banks to start the transition now with a cryptographic inventory, a Europol-linked framework shows how to rank what moves first, and Singapore signaled formal supervisory expectations later in 2026.
Chemical plants run control systems built to last decades, so the post-quantum migration collides with hardware that cannot easily be patched, while harvest-now-decrypt-later threatens long-lived process data and NIS2 sets the audit frame.
An HKMA assessment in July 2026 scored Hong Kong banks 2.3 out of 10 on quantum readiness, set a target of 10 by 2030, and found about half lack a formal plan.
The EU's coordinated roadmap targets 2030 for high-risk critical infrastructure, and because substation equipment lasts 20 to 40 years, grid operators that install today's cryptography now will still run it when quantum attacks become feasible.
Australia's signals directorate published vendor-readiness questions for procurement, and an industry body names operational technology a priority because system lifecycles run 10 to 40 years, which puts manufacturers on both sides of the supply-chain migration problem.
Singapore's CSA published a final post-quantum migration handbook and readiness index in July 2026, superseding its October 2025 draft, with emphasis on critical information infrastructure.
Malaysia launched a national post-quantum migration plan and a sandbox in July 2026, building on November 2025 work, without setting dated deadlines.
A July 2026 FINMA review of 60 institutions found banks and insurers lack post-quantum roadmaps, and recommended each build one by mid-2027.
While the headlines fixate on 2035, the UK expects cryptographic discovery finished by 2028 and the EU expects national roadmaps by 2026, which makes discovery the deadline that actually starts the clock.
The ECB ordered eurozone banks to submit AI cyber action plans to their supervisory teams by 31 October 2026, and said post-quantum adoption must start now.
Mexico set biometric bank rules in July 2026 requiring isolated encrypted storage of face and fingerprint data, with compliance due around late 2026; the rules are not post-quantum.
The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 through a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.
Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, so quantum readiness remains outside the framework's required controls for now.
The U.S., UK, and EU have set post-quantum deadlines that converge between 2030 and 2035, so a multinational enterprise faces one overlapping clock rather than three separate programs.
Bermuda's digital asset licensees grew to 49 by June 2026, operating under binding cyber-risk and custody rules that make cryptographic security a supervised matter.
Australia's APRA signalled tougher quantum supervision in June 2026, telling firms to map cryptographic dependencies including third parties, using CPS 234 and CPS 230 as hooks.
OMB M-26-15 gives civilian agencies 120 days, about 22 October 2026, to submit post-quantum migration plans, so vendors should expect roadmap requests.
The Department of War's June 2026 strategy says systems must support post-quantum cryptography or be phased out by end-2030, so contractors should plan now.
Executive Order 14412 directs OMB to require U.S. federal high-impact systems to adopt post-quantum key establishment by 2030 and digital signatures by 2031, and it directs a rule that would put covered contractors on the same clock.
Executive Order 14412 directs CISA and NIST to publish cryptography bill of materials minimum elements within 270 days, pointing to a March 2027 standard.
Executive Order 14412 directs a Federal Acquisition Regulation proposal within 180 days, requiring covered contractors to meet post-quantum obligations by the end of 2030.
Executive Order 14412 directs federal systems to adopt post-quantum key establishment by the end of 2030 and post-quantum signatures by the end of 2031.
Executive Order 14413 targets quantum research, commercialization and export controls, not migration, so encryption deadlines sit in EO 14412 and OMB M-26-15.
GSA's 2025 buyer's guide helps federal agencies acquire quantum-resistant cryptography and write crypto agile selection criteria, so vendors should expect matching language in procurement.
IETF RFC 9958, published in June 2026, explains post-quantum cryptography for engineers and warns that migration may need protocol redesign, not just an algorithm swap.
G7 central banks published their first shared quantum report in May 2026, marking coordinated attention to how quantum computing affects the financial system.
The UAE launched a national cryptography discovery platform in May 2026, pairing a discovery tool and national libraries with a national post-quantum readiness index.
Ericsson researchers urge telecom operators to migrate high-priority systems before 2031 and finish by 2035, with long-lived trust anchors built into infrastructure today posing the hardest problem, while ESA and Singapore show the work already underway.
South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space in May 2026, aiming for cryptographic self-reliance by 2030.
An April 2026 ENISA review found hybrid key agreement more mature than hybrid signatures, offering a status check rather than a recommendation on which to adopt.
No current reporting addresses post-quantum cryptography for dams directly, so operators must read across critical-infrastructure OT analysis, a 2023 quantum-key-distribution paper, and NIS2 obligations to judge their own long-lived control systems.
Testimony prepared for a US Senate hearing urges water utilities to build a post-quantum transition plan aligned to NIST standards, but dedicated sector guidance is thin and most sources address critical-infrastructure operational technology in general.
Research models significant quantum-attack success against nuclear plants under current postures and reports that full post-quantum migration cuts residual feasibility sharply, while field demonstrations so far test quantum key distribution rather than post-quantum algorithms.
Cloudflare reports that more than 60 percent of human-generated TLS traffic to its network already uses hybrid post-quantum protection, while UK and EU timelines put weight on software and cloud vendors to carry smaller customers through the migration.
India's task force set 2027 to 2029 milestones for critical information infrastructure, the EU coordinated roadmap targets 2030 for high-risk systems, and Singapore published a migration handbook and readiness index for agencies and critical infrastructure.
An India task force set a 2029 deadline for critical infrastructure post-quantum migration in February 2026, with foundations by 2027 and crypto agility in procurement.
Brazil added post-quantum algorithms ML-DSA and ML-KEM to its national ICP-Brasil certificate system in early 2026, making it a binding national standard.
CISA's January 2026 list names the technology categories that should support post-quantum standards such as FIPS 203, 204 and 205, serving as advisory guidance for procurement.
Germany's BSI advised in January 2026 against using Classic McEliece in new systems, citing cryptanalysis progress, as a precautionary update to its TR-02102-1 guidance.
Europol published a post-quantum prioritization method in January 2026 that ranks systems by shelf life, exposure and business impact, weighing risk against migration time.
A January 2026 Commission proposal would write post-quantum migration into NIS2 national strategies, with critical systems by 2030 and medium-risk systems by 2035.
The G7 Cyber Expert Group's January 2026 roadmap sets 2030 to 2032 for migrating critical financial systems and 2035 for the sector, and it is voluntary.
The Central Bank of Jordan issued a post-quantum roadmap for banks in January 2026, covering governance, inventory, prioritization and pilots, without a dated target.
An African consortium issued a post-quantum readiness white paper and formed a regional alliance in 2026, pointing to mobile money scale and free migration tools.
Germany's BSI estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040, a 15-year path that could compress to about 10 years.
A December 2025 IDB and OAS report found Latin American and Caribbean cyber maturity improving but flagged gaps in software quality, critical infrastructure protection and cyber insurance.
Project Leap completed its second phase in December 2025, testing post-quantum signatures in live payment systems and finding they work but add processing time.
Saudi Arabia's National Cryptographic Standards do not yet accept post-quantum algorithms, and an update consulted in December 2025 was not final as of early 2026.
Japan set a government post-quantum target of 2035 in principle in November 2025, and will publish a detailed migration roadmap in FY2026.
CARICOM and IMPACS updated the Caribbean cybersecurity action plan in October 2025, adding an incident response pillar to strengthen regional cyber resilience.
The PKI Consortium published a draft five-level post-quantum maturity model in October 2025, letting vendors self-grade from Initial to Optimized on a voluntary basis.
Public-safety radio standards already strengthened symmetric encryption against the quantum threat, but a NIST-style post-quantum migration for emergency communications and legacy 911 infrastructure barely registers in current reporting.
Vendors and regulators are converging on 2030 and 2035 milestones for healthcare cryptography, and because patient records need decades of protection, harvest-now-decrypt-later is an active concern even though much of the current reporting is vendor-authored.
The UK NCSC launched an Assured Cyber Security Consultancy pilot for post-quantum migration on 1 October 2025, running through March 2027.
Colombia's financial supervisor flagged quantum among emerging risks in September 2025, amid a sharp rise in cyberattacks, without yet imposing a requirement.
A September 2025 MAS sandbox report positions post-quantum cryptography as the foundation for financial security and quantum key distribution as suited to niche point-to-point links.
Australia's ASD published planning guidance in September 2025 setting a plan by end-2026, commencement by end-2028 and completion by end-2030, under its LATICE framework.
NIST finalized SP 800-227 in September 2025, giving practitioners implementation guidance for key establishment mechanisms that supports FIPS 203 and future HQC.
Brazil dropped blockchain from its Drex pilot in August 2025, with no public central bank digital currency platform expected before 2027 and no post-quantum requirement yet.
India's MeitY and CERT-In published a quantum readiness white paper in July 2025, offering guidance on preparing for post-quantum cryptography without setting a deadline.
BIS Papers No. 158, published in July 2025, urges banks to start post-quantum work now, with inventory as the foundation and crypto agility, defense in depth and hybrid schemes.
Twenty-one European agencies, including Norway, renewed a joint statement in July 2025 urging organizations to treat post-quantum planning as core risk management.
Canada's federal migration roadmap sets high-priority systems by end-2031 and the rest by end-2035, with post-quantum clauses in contracts signed after April 2026.
The EU post-quantum roadmap, published in June 2025, sets national strategies by end-2026, high-risk migration by end-2030 and medium-risk systems by end-2035.
The Bank of Japan joined the G7 central bank quantum working group in June 2025, and the group produced a reference report in May 2026.
The EU certification group ECCG is adding post-quantum cryptography to its scheme, with version 2.0 published in May 2025 and a version 3 draft in public review.
UK CMORG published voluntary post-quantum guidance for financial institutions in April 2025, setting strategic direction that aligns with NCSC and NIST.
Japan's CRYPTREC issued post-quantum guidance in April 2025 and revised its Ciphers List in March 2026 with an ML-KEM table, with ML-DSA and SLH-DSA evaluations in 2026.
The Cayman Islands moved virtual asset service providers from registration to licensing from April 2025, requiring cybersecurity plans as a condition of a licence.
The UK NCSC set three post-quantum deadlines in March 2025: discovery and planning by 2028, early migration by 2031 and complete migration by 2035.
NIST chose HQC as a fifth post-quantum algorithm and backup to ML-KEM, targeting a final standard in 2027, but organizations should keep migrating to ML-KEM now.
NIST's CSWP 39 explains how to replace cryptographic algorithms without disrupting systems, and the 29 June 2026 update supersedes the December 2025 final.
Europol's Quantum Safe Financial Forum issued a call to action in February 2025, saying existing EU rules suffice and urging hybrid schemes, inventories and crypto agility.
China opened a call for next-generation commercial cryptographic algorithms in February 2025, with a 30 June 2026 deadline for public-key proposals.
The Czech cybersecurity agency NUKIB set a post-quantum algorithm baseline in February 2025, naming ML-KEM-1024, ML-DSA-87, SLH-DSA and hybrid schemes, with no deadlines.
The EU Digital Operational Resilience Act has applied to financial firms since January 2025, and cryptography enters its scope through Article 9 and delegated technical standards.
South Korea selected four home-grown post-quantum algorithms in January 2025: AIMer and HAETAE for signatures, and NTRU+ and SMAUG-T for key establishment.
The Bank of Israel ordered banks in January 2025 to submit quantum preparedness plans within one year, with the harvest-now-decrypt-later threat at the centre.
FS-ISAC has called for the financial sector to adopt a common end date for post-quantum migration, so interconnected firms move on a shared, coordinated timeline.
ISO/IEC JTC1 SC27 maintains a standing document on post-quantum cryptography that serves as a working reference for its members rather than a published standard.
The ITU-T continues studying quantum-resistant support, with its 2021 X.1811 recommendation scoped to 5G and a study group examining changes to X.509 certificates.
The Dutch AIVD, CWI and TNO published a post-quantum migration handbook in December 2024 with a three-step approach and a free PQChoiceAssistant tool.
Australia's ISM control 1917 requires new government cryptography to support post-quantum algorithms by 2030, naming ML-DSA-87, ML-KEM-1024, SHA-384/512 and AES-256.
A Japan FSA study group urged banks in November 2024 to start post-quantum work now, recommending inventory, crypto agility and a phased approach into the mid-2030s.
NIST draft IR 8547 proposes 2030 and 2035 dates for leaving quantum-vulnerable cryptography, and though it is a draft, it gives boards planning anchors.
The Banque de France and the Monetary Authority of Singapore exchanged post-quantum encrypted email across continents in November 2024, a voluntary trial that hints where pilots may head.
Israel's Directive 364, issued in November 2024, consolidates earlier directives and provides the legal hook for the Bank of Israel's quantum preparedness letter, though it never names quantum.
CISA's October 2024 paper says industrial systems face legacy gear and long patch cycles in post-quantum migration, so operators should plan crypto agility.
The GSMA issued a post-quantum telecom guidance series from October 2024 to May 2026, covering use cases from IoT and roaming to base stations and satellite.
The UK NCSC endorsed ML-KEM-768 and ML-DSA-65 in August 2024 and treats hybrid schemes as an interim measure rather than a long-term goal.
NIST approved FIPS 203, 204 and 205, its first post-quantum encryption standards, so vendors and buyers now have named algorithms to request and plan around.
The Bahamas DARE Act 2024 regulates digital asset activities including staking, stablecoins and custody, bans algorithmic stablecoins, and brings cryptographic custody into supervisory scope.
An OECD primer published in June 2024 frames post-quantum migration as urgent, bringing the issue to policymakers across its member economies.
The European Commission's April 2024 recommendation urges member states to coordinate post-quantum migration, develop national strategies and use hybrid schemes during the transition.
PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, a step that doubles as the foundation for post-quantum migration.
EU delegated regulation 2024/1774 requires financial firms to maintain encryption and key-management policies and update cryptography as cryptanalysis advances, naming quantum in a recital.
The Monetary Authority of Singapore issued an advisory in February 2024 telling financial firms to inventory cryptography and plan for post-quantum migration, with supervisory expectations to follow.
The World Economic Forum and the UK FCA published a January 2024 white paper on quantum security for finance, offering principles and frameworks rather than FCA rules.
FINRA asked securities firms in October 2023 to start a dialogue on post-quantum cryptography, framing the move as research and awareness rather than a new requirement.
CISA, the NSA and NIST urged organizations to begin post-quantum migration planning in 2023, and the voluntary factsheet lists four starting actions.
South Korea set a staged national post-quantum master plan in July 2023, with action plans in 2024, foundations by 2030 and deployment by 2035.
Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data with a life beyond ten years.
India's National Quantum Mission, launched in April 2023, funds the development of quantum technology capability rather than directing any post-quantum cryptography migration for organizations.
The Cayman Islands extended its cybersecurity rule to virtual asset service providers in April 2023, and a 2025 review found gaps that remained to be addressed.
Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but does not mention quantum, so cryptographic risk enters through its general duties.
The US Quantum Computing Cybersecurity Preparedness Act of 2022 requires federal agencies to inventory quantum-vulnerable systems and plan migration to post-quantum cryptography.
OMB M-23-02 requires federal agencies to inventory quantum-vulnerable cryptography annually from 4 May 2023, so vendors should expect inventory requests.
The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges organizations to manage cryptographic risk.
The EU-backed LAC4 cyber training centre, launched in May 2022, serves 27 member countries, building the regional cyber skills that underpin future quantum readiness.
National Security Memorandum 10 set a 2035 goal for moving vulnerable systems to quantum-resistant cryptography, and later federal papers repeat it.
France's ANSSI set a phased hybrid approach from 2022, making hybrid schemes mandatory for long-term products from 2025 and aligning its position with Germany's BSI.
A 2021 NIST paper warned that post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.
NIST approved stateful hash-based signatures in SP 800-208 in 2020, giving firmware and software signing an interim post-quantum option that requires careful state tracking.
Talk to the team about what we're building and where it's headed.