[{"data":1,"prerenderedAt":8526},["ShallowReactive",2],{"news-index":3},[4,137,263,371,442,552,667,762,827,917,1018,1081,1180,1273,1341,1434,1531,1595,1660,1720,1812,1873,1940,2003,2066,2160,2226,2290,2360,2422,2507,2570,2625,2682,2739,2801,2865,2928,2991,3093,3159,3226,3317,3398,3486,3582,3678,3738,3800,3867,3931,3995,4056,4115,4175,4237,4300,4362,4422,4483,4549,4611,4674,4770,4865,4930,4991,5051,5114,5176,5237,5297,5356,5416,5480,5540,5598,5659,5721,5780,5841,5900,5967,6032,6091,6152,6214,6276,6335,6399,6461,6525,6582,6642,6701,6761,6827,6892,6950,7007,7069,7128,7193,7254,7313,7373,7434,7494,7554,7613,7674,7738,7797,7857,7918,7978,8040,8103,8162,8224,8285,8345,8404,8464],{"id":5,"title":6,"author":7,"authorTitle":8,"authorUrl":9,"body":10,"canonical":9,"category":92,"date":93,"description":94,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":97,"image":9,"industries":99,"keyFindings":9,"meta":102,"modified":93,"navigation":103,"path":104,"pullquote":9,"recommendations":9,"references":105,"related":118,"seo":125,"seoTitle":126,"signposts":9,"slug":127,"stats":9,"stem":128,"tags":129,"tldr":135,"__hash__":136},"news\u002Fnews\u002Fdefense-industrial-base-pentagon-2030-deadline.md","The Pentagon's 2030 Deadline Pushes Defense Suppliers to Inventory Cryptography Now","ArcQubit Team","",null,{"type":11,"value":12,"toc":83},"minimark",[13,18,31,35,41,45,54,58,69,73,76,80],[14,15,17],"h2",{"id":16},"the-answer-up-front","The answer, up front",[19,20,21,22,26,27,30],"p",{},"Defense suppliers have a hard date to plan around. The US Department of War published a post-quantum strategy in June 2026 that requires all systems to support the new cryptography by December 31, 2030, with full implementation by December 31, 2031 ",[23,24,25],"span",{},"1",". The requirements are expected to reach contractors through the Cybersecurity Maturity Model Certification (CMMC), and reporting says they may flow down before rulemaking finishes ",[23,28,29],{},"2",". The defense industrial base is private-sector by definition, so this is a direct, dated obligation for contractors and their suppliers.",[14,32,34],{"id":33},"the-department-of-war-strategy","The Department of War strategy",[19,36,37,38,40],{},"The strategy sets five lines of effort: governance, cryptographic inventory, technology development, commercial integration and large-scale deployment, and it rules out quantum key distribution and simply lengthening keys in vulnerable algorithms ",[23,39,25],{},". In plain terms, the Department wants an inventory first and a migration that uses the standardized post-quantum algorithms, not stopgaps.",[14,42,44],{"id":43},"the-contractor-flow-down","The contractor flow-down",[19,46,47,48,50,51,53],{},"DefenseScoop reported in July 2026 that the Department plans to bring post-quantum requirements into CMMC, though details remain unclear ",[23,49,29],{},". Experts quoted there say most of the defense industrial base is not ready and that contractors should expect requirements to flow down before rulemaking finishes ",[23,52,29],{},". For a supplier, the lesson is to start the inventory now rather than wait for a final rule, because the compliance expectation is arriving through the contract chain.",[14,55,57],{"id":56},"australia-and-nato","Australia and NATO",[19,59,60,61,64,65,68],{},"Australia is moving on a similar clock. Defence Connect reported in September 2026 that Australian organizations should produce a transition plan within about four months, start migrating critical systems by 2028, and retire traditional public-key cryptography by 2030, and it argues for sovereign control of keys and maintenance capacity ",[23,62,63],{},"3",". That piece cites survey figures the reporting could not verify and does not state the author's affiliation, so weigh its numbers accordingly. NATO, by contrast, has no matching public deadline: an analyst's reading of the alliance's first Quantum Technology Roadmap, approved July 30, 2026, finds it runs to the third quarter of 2029 without an alliance-wide migration date, with a Brussels-Mons pilot aiming to demonstrate post-quantum cryptography in operational networks by the fourth quarter of 2027 ",[23,66,67],{},"4",". That source is analysis, not the roadmap text.",[14,70,72],{"id":71},"what-this-means-for-suppliers","What this means for suppliers",[19,74,75],{},"The 2030 date is close enough that inventory work should start now. Suppliers should map where vulnerable cryptography lives in their products and networks, document crypto agility and which post-quantum profiles they support, and expect customers to ask for both through CMMC and contract terms.",[14,77,79],{"id":78},"how-arcqubit-approaches-it","How ArcQubit approaches it",[19,81,82],{},"ArcQubit treats the cryptographic inventory as the first deliverable the Department of War strategy itself calls for. QuCode builds that inventory across a contractor's systems and products, and QuTrust holds the migration plan so the supplier can show a current, defensible posture as CMMC and flow-down requirements arrive.",{"title":8,"searchDepth":84,"depth":84,"links":85},2,[86,87,88,89,90,91],{"id":16,"depth":84,"text":17},{"id":33,"depth":84,"text":34},{"id":43,"depth":84,"text":44},{"id":56,"depth":84,"text":57},{"id":71,"depth":84,"text":72},{"id":78,"depth":84,"text":79},"Policy","2026-10-06","The US Department of War requires post-quantum support by end 2030, and reporting says the rules will flow to contractors via CMMC before rulemaking finishes.",false,"md",[98],"arlington",[100,101],"Cross-Sector","Defense Industrial Base",{},true,"\u002Fnews\u002Fdefense-industrial-base-pentagon-2030-deadline",[106,109,112,115],{"label":107,"url":108},"A. Ribeiro, \"DoW launches PQC strategy for cryptographic inventory and migration planning for quantum era, sets 2030 migration deadline,\" Industrial Cyber, Jun. 25, 2026.","https:\u002F\u002Findustrialcyber.co\u002Frisk-management\u002Fdow-launches-pqc-strategy-for-cryptographic-inventory-and-migration-planning-for-quantum-era-sets-2030-migration-deadline\u002F",{"label":110,"url":111},"M. Easley, \"What the Pentagon's new post-quantum cryptography directive means for defense contractors,\" DefenseScoop, Jul. 10, 2026.","https:\u002F\u002Fdefensescoop.com\u002F2026\u002F07\u002F10\u002Fcmmc-pqc-requirements-defense-contractors-cybersecurity\u002F",{"label":113,"url":114},"A. Wilson, \"Time waits for no company: sovereign encryption is becoming a front-line defence capability,\" Defence Connect, Sep. 10, 2026.","https:\u002F\u002Fwww.defenceconnect.com.au\u002Findustry\u002F18843-time-waits-for-no-company-sovereign-encryption-is-becoming-a-frontline-defence-capability",{"label":116,"url":117},"M. Ivezic, \"NATO's First Quantum Roadmap: Sea Trials, a PQC Pilot and No Public Date for its Own PQC Migration,\" PostQuantum.com, Oct. 2, 2026.","https:\u002F\u002Fpostquantum.com\u002Fquantum-policy\u002Fnato-quantum-technology-roadmap\u002F",[119,122],{"label":120,"url":121},"PQC Mandates and Deadlines","\u002Fblog\u002Fpqc-mandates-deadlines",{"label":123,"url":124},"What Executive Order 14412 Requires","\u002Fnews\u002Fus-executive-order-14412-post-quantum-deadline",{"title":6,"description":94},"Pentagon 2030 Deadline Hits Suppliers","defense-industrial-base-pentagon-2030-deadline","news\u002Fdefense-industrial-base-pentagon-2030-deadline",[130,131,132,133,134],"defense industrial base","CNSA 2.0","PQC migration","cryptographic discovery","federal compliance","The US Department of War's post-quantum strategy requires all systems to support the new cryptography by the end of 2030, and reporting says those requirements will flow down to defense contractors through CMMC before rulemaking finishes.","KXh8wIPKmpQbZD-KCuYF_zuohvDnLjfwqUvPARquEIg",{"id":138,"title":139,"author":7,"authorTitle":8,"authorUrl":9,"body":140,"canonical":9,"category":220,"date":221,"description":222,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":223,"image":9,"industries":226,"keyFindings":9,"meta":229,"modified":221,"navigation":103,"path":230,"pullquote":9,"recommendations":9,"references":231,"related":244,"seo":251,"seoTitle":252,"signposts":9,"slug":253,"stats":9,"stem":254,"tags":255,"tldr":261,"__hash__":262},"news\u002Fnews\u002Fbitcoin-quantum-exposure-estimates-2026.md","Why the New Bitcoin Quantum Estimates Matter for Anyone Holding Digital Assets",{"type":11,"value":141,"toc":212},[142,144,156,160,172,176,187,191,200,204,207,209],[14,143,17],{"id":16},[19,145,146,147,149,150,152,153,155],{},"The quantum threat to digital assets moved from abstract to measured in 2026, and institutions that hold or safekeep cryptocurrency should treat it as a current diligence question. On March 31, 2026, Google Quantum AI published work that lowered the estimated cost of breaking the elliptic-curve signatures used by Bitcoin and several other chains by roughly twentyfold ",[23,148,25],{},". Independent studies put millions of coins in exposed address types ",[23,151,29],{},", ",[23,154,63],{},". No quantum computer can do this today, but the distance has shortened enough that investors, auditors and counterparties are starting to ask how much of a holding sits in exposed form.",[14,157,159],{"id":158},"what-google-published","What Google published",[19,161,162,163,165,166,168,169,171],{},"Google's team described circuits needing fewer than 1,200 to 1,450 logical qubits, which on superconducting hardware would require fewer than 500,000 physical qubits for a few minutes, a roughly twentyfold improvement over earlier estimates ",[23,164,25],{},". The accompanying paper estimated that about 6.9 million BTC are vulnerable across all protocols, counting weak locking scripts and address reuse, with a little over 1.7 million in one legacy output type ",[23,167,25],{},". Separately, CoinDesk reported that Google would move its own authentication services to quantum-resistant cryptography by 2029, a planning horizon worth noting ",[23,170,67],{},".",[14,173,175],{"id":174},"how-much-is-exposed","How much is exposed",[19,177,178,179,181,182,184,185,171],{},"Independent measurements agree on the broad shape. Glassnode, in May 2026, counted about 6.04 million BTC, or 30.2 percent of issued supply, as exposed at rest, meaning the public key needed to spend the coin has already appeared on the blockchain ",[23,180,29],{},". It split that into structural exposure from older output designs and a larger operational share driven mainly by address reuse, and described the operational trend as reversible through ordinary address management ",[23,183,29],{},". Chaincode Labs, in May 2025, estimated that 20 to 50 percent of Bitcoin in circulation, 4 to 10 million BTC, is at risk, and noted that migrating the whole set of coin records could take between 76 and 568 days ",[23,186,63],{},[14,188,190],{"id":189},"why-the-exposure-is-partly-a-management-problem","Why the exposure is partly a management problem",[19,192,193,194,196,197,199],{},"The important nuance is that much of the exposure comes from how custodians and users manage addresses, not from a flaw nobody can fix ",[23,195,29],{},". Glassnode describes the exchange trend as reversible, which makes address hygiene a low-cost first step ",[23,198,29],{},". For an institution, that reframes the issue: ordinary address practices already within the firm's control can cut a meaningful share of risk today, while the deeper protocol questions play out over years.",[14,201,203],{"id":202},"what-this-means-for-holders-and-custodians","What this means for holders and custodians",[19,205,206],{},"Executives who hold or custody Bitcoin should expect investors, auditors and regulators to ask what share of holdings sits in exposed address types, and the honest answer requires measuring it. The migration estimates make the second point: moving an entire holding or an entire system cannot happen quickly once a threat is acute, so the work belongs on the planning horizon now, not after someone announces a capable machine.",[14,208,79],{"id":78},[19,210,211],{},"ArcQubit treats this as a measurement-first problem. The same discipline that QuCode applies to enterprise cryptographic discovery, finding where vulnerable keys and signatures live, applies to a digital-asset posture review, and QuTrust holds the resulting plan so a custodian can show investors and auditors a current, defensible view of exposure and the steps underway to reduce it.",{"title":8,"searchDepth":84,"depth":84,"links":213},[214,215,216,217,218,219],{"id":16,"depth":84,"text":17},{"id":158,"depth":84,"text":159},{"id":174,"depth":84,"text":175},{"id":189,"depth":84,"text":190},{"id":202,"depth":84,"text":203},{"id":78,"depth":84,"text":79},"Analysis","2026-10-01","Google cut the estimated cost of breaking Bitcoin signatures ~20x and studies flag millions of exposed coins. What digital-asset holders should take from it.",[224,225],"mountain-view","global",[100,227,228],"Financial Services","Information Technology",{},"\u002Fnews\u002Fbitcoin-quantum-exposure-estimates-2026",[232,235,238,241],{"label":233,"url":234},"Google Research, \"Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly,\" Mar. 31, 2026.","https:\u002F\u002Fresearch.google\u002Fblog\u002Fsafeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly\u002F",{"label":236,"url":237},"Glassnode, \"Measuring Bitcoin Quantum-Exposed Supply,\" May 20, 2026.","https:\u002F\u002Finsights.glassnode.com\u002Fmeasuring-bitcoins-quantum-exposed-supply\u002F",{"label":239,"url":240},"Chaincode Labs, \"Bitcoin and Quantum Computing: Current Status and Future Directions,\" May 2025.","https:\u002F\u002Fchaincode.com\u002Fbitcoin-post-quantum.pdf",{"label":242,"url":243},"CoinDesk, \"Watch out Bitcoin devs. Google says post-quantum migration needs to happen by 2029,\" Mar. 28, 2026.","https:\u002F\u002Fwww.coindesk.com\u002Ftech\u002F2026\u002F03\u002F28\u002Fwatch-out-bitcoin-devs-google-says-post-quantum-migration-needs-to-happen-by-2029",[245,248],{"label":246,"url":247},"Harvest Now, Decrypt Later: The Threat Explained","\u002Fblog\u002Fharvest-now-decrypt-later",{"label":249,"url":250},"What Is Q-Day?","\u002Fblog\u002Fwhat-is-q-day",{"title":139,"description":222},"What the Bitcoin Quantum Estimates Mean","bitcoin-quantum-exposure-estimates-2026","news\u002Fbitcoin-quantum-exposure-estimates-2026",[256,257,258,259,260],"digital assets","financial services","quantum risk","harvest now decrypt later","for enterprises","Google lowered the estimated cost of breaking Bitcoin signatures about twentyfold and independent studies put millions of coins at risk, so institutions that hold or custody digital assets should expect questions about address exposure and key management.","Pzobb7Z45-BGzVz9QoGJEeNX1wfgr9IzCBk1ljUte5U",{"id":264,"title":265,"author":7,"authorTitle":8,"authorUrl":9,"body":266,"canonical":9,"category":220,"date":339,"description":340,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":341,"image":9,"industries":343,"keyFindings":9,"meta":345,"modified":339,"navigation":103,"path":346,"pullquote":9,"recommendations":9,"references":347,"related":357,"seo":362,"seoTitle":363,"signposts":9,"slug":364,"stats":9,"stem":365,"tags":366,"tldr":369,"__hash__":370},"news\u002Fnews\u002Fhhs-aspr-healthcare-post-quantum-guidance.md","A US Health Agency Signals Post-Quantum Guidance for Hospitals",{"type":11,"value":267,"toc":331},[268,270,279,283,292,296,307,311,316,320,326,328],[14,269,17],{"id":16},[19,271,272,273,275,276,278],{},"Hospitals and public health organizations face no post-quantum requirement today, but federal guidance is coming, and the exposure is already real. On September 2, 2026, a senior cybersecurity advisor at the HHS Administration for Strategic Preparedness and Response (ASPR) said the office was working with private sector partners and about to release guidance on preparing for and mitigating quantum-related threats ",[23,274,25],{},". It had not been published as of early October 2026, and no release date was given ",[23,277,25],{},". The reason the sector should not wait is simple: health records stay sensitive for decades, so data copied today can be decrypted later once a capable quantum computer exists.",[14,280,282],{"id":281},"what-aspr-signaled","What ASPR signaled",[19,284,285,286,288,289,291],{},"GovCIO Media reported remarks from ASPR advisor Bob Bastani that the office would release guidance documents soon ",[23,287,25],{},". The same report notes that ASPR's updated RISC 2.0 assessment tool currently carries no post-quantum guidance, though it includes cybersecurity assessments, and it advises organizations to inventory data and systems as a preparatory step ",[23,290,25],{},". ASPR is developing the guidance with industry partners, which suggests it will reflect how hospitals actually run their systems rather than a purely theoretical model.",[14,293,295],{"id":294},"federal-advisors-flagged-this-in-2022","Federal advisors flagged this in 2022",[19,297,298,299,301,302,304,305,171],{},"This is not a new concern for the health sector. In July 2022 the HHS Health Sector Cybersecurity Coordination Center (HC3) issued a threat briefing, \"Quantum Cryptography and the Health Sector,\" explaining how quantum computers could undermine current encryption ",[23,300,29],{},". It stressed that healthcare organizations hold sensitive data across electronic health records, mobile devices, cloud platforms and wireless medical equipment, and it recommended a cross-functional working group, quantum risk evaluations to find vulnerable data stores and transmissions, an inventory of data sensitivity and retention, and integration of mitigation into risk management plans ",[23,303,29],{},". It said there was no immediate threat but that the work needs time and resources, so organizations should begin planning ",[23,306,29],{},[14,308,310],{"id":309},"why-the-data-lifetime-matters","Why the data lifetime matters",[19,312,313,314,171],{},"The defining fact for healthcare is retention. A patient record created today may need to stay confidential for the rest of a person's life. That long shelf life is exactly what makes harvest-now-decrypt-later a present exposure rather than a future one: an attacker does not need to read the data today, only to store it until a quantum computer can break the cryptography protecting it. NIST finalized its first post-quantum standards in August 2024, so named algorithms now exist for organizations ready to begin ",[23,315,63],{},[14,317,319],{"id":318},"what-this-means-for-healthcare-organizations","What this means for healthcare organizations",[19,321,322,323,325],{},"Hospitals, health systems and health IT providers should expect federal guidance soon and can act before it arrives. The inventory and working group steps described in the 2022 HC3 briefing are available now and do not depend on new guidance ",[23,324,29],{},". The practical sequence is to find where quantum-vulnerable cryptography protects long-lived patient data, rank those stores by sensitivity and retention, and start planning migration.",[14,327,79],{"id":78},[19,329,330],{},"ArcQubit treats the cryptographic inventory as the first deliverable, because a health system cannot protect data it cannot locate. QuCode discovers where vulnerable cryptography sits across records, devices and cloud platforms, and QuTrust holds the migration plan so the organization can show a current, defensible posture when federal guidance and auditors arrive.",{"title":8,"searchDepth":84,"depth":84,"links":332},[333,334,335,336,337,338],{"id":16,"depth":84,"text":17},{"id":281,"depth":84,"text":282},{"id":294,"depth":84,"text":295},{"id":309,"depth":84,"text":310},{"id":318,"depth":84,"text":319},{"id":78,"depth":84,"text":79},"2026-09-29","HHS's ASPR signals coming post-quantum guidance for hospitals. With health records sensitive for decades, harvest-now-decrypt-later risk is present for healthcare.",[342],"washington-dc",[100,344],"Healthcare and Public Health",{},"\u002Fnews\u002Fhhs-aspr-healthcare-post-quantum-guidance",[348,351,354],{"label":349,"url":350},"GovCIO Media, \"ASPR Signals New Quantum Guidance Amid Health Cyber Threats,\" Sep. 3, 2026.","https:\u002F\u002Fgovciomedia.com\u002Faspr-signals-new-quantum-guidance-amid-health-cyber-threats\u002F",{"label":352,"url":353},"HHS Health Sector Cybersecurity Coordination Center, \"Quantum Cryptography and the Health Sector,\" Jul. 7, 2022.","https:\u002F\u002Fwww.hhs.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fquantum-cryptography-and-health-sector.pdf",{"label":355,"url":356},"National Institute of Standards and Technology, \"NIST Releases Finalized Post-Quantum Encryption Standards,\" Aug. 13, 2024.","https:\u002F\u002Fwww.hipaajournal.com\u002Fnist-releases-finalized-post-quantum-encryption-standards\u002F",[358,359],{"label":246,"url":247},{"label":360,"url":361},"How to Assess Quantum Readiness in Your Organization","\u002Fblog\u002Fhow-to-assess-quantum-readiness-in-your-organization",{"title":265,"description":340},"US Health Agency Signals Quantum Guidance","hhs-aspr-healthcare-post-quantum-guidance","news\u002Fhhs-aspr-healthcare-post-quantum-guidance",[367,259,368,133,260],"healthcare","quantum readiness","The HHS preparedness office has signaled post-quantum migration guidance for hospitals and public health organizations, and because health records stay sensitive for decades, the harvest-now-decrypt-later exposure for this sector is real today.","wdTJ6QZ4z_nn6zFmb1P2StnNRg1eKfvhMOaoR5N72lc",{"id":372,"title":373,"author":7,"authorTitle":8,"authorUrl":9,"body":374,"canonical":9,"category":92,"date":339,"description":404,"draft":95,"extension":96,"faqs":405,"findingsSource":9,"geo":415,"image":417,"industries":418,"keyFindings":9,"meta":420,"modified":421,"navigation":103,"path":422,"pullquote":9,"recommendations":9,"references":423,"related":427,"seo":433,"seoTitle":434,"signposts":9,"slug":435,"stats":9,"stem":436,"tags":437,"tldr":440,"__hash__":441},"news\u002Fnews\u002Fnato-quantum-roadmap-2027-milestones.md","NATO Sets a Quantum Roadmap With 2027 Milestones for Adopting Post-Quantum Cryptography",{"type":11,"value":375,"toc":401},[376,380,386,389,392,395],[14,377,379],{"id":378},"nato-sets-a-quantum-roadmap-with-2027-milestones","NATO sets a quantum roadmap with 2027 milestones",[19,381,382],{},[383,384,385],"strong",{},"29 SEPTEMBER 2026, BRUSSELS",[19,387,388],{},"NATO set a quantum roadmap on 29 September 2026, committing the alliance to adopt and implement post-quantum cryptography. The roadmap sets near-term milestones: an action plan update by the third quarter of 2027 and a pilot called Quantum Zero Beacon in the fourth quarter of 2027. These dates give the alliance a defined path rather than an open-ended intent.",[19,390,391],{},"The Quantum Zero Beacon pilot is the practical test. As a pilot planned for the fourth quarter of 2027, it lets NATO try post-quantum implementation in a controlled setting before wider rollout. Learning from a pilot first reduces the risk of problems when the alliance moves to broader adoption across its systems.",[19,393,394],{},"NATO's move carries weight beyond its own networks. Because the alliance coordinates defense across member states, its direction influences allied militaries and the defense industrial base that supplies them. A common roadmap helps members and suppliers align on compatible post-quantum approaches, which matters for interoperability among forces that must operate together.",[19,396,397,400],{},[383,398,399],{},"Why it matters."," NATO's roadmap puts post-quantum cryptography on a dated path for the alliance, with a 2027 action plan update and pilot as the first checkpoints. Its influence reaches allied militaries and defense suppliers who need to interoperate with NATO systems. Organizations in the defense industrial base should treat the roadmap as a signal that post-quantum requirements will flow through allied defense procurement.",{"title":8,"searchDepth":84,"depth":84,"links":402},[403],{"id":378,"depth":84,"text":379},"NATO set a quantum roadmap in September 2026 to adopt post-quantum cryptography, with an action plan update by Q3 2027 and a pilot in Q4 2027.",[406,409,412],{"q":407,"a":408},"What does NATO's quantum roadmap set out?","The roadmap, dated 29 September 2026, commits NATO to adopt and implement post-quantum cryptography. It sets an action plan update by the third quarter of 2027 and a pilot it calls Quantum Zero Beacon in the fourth quarter of 2027, giving the alliance near-term milestones.",{"q":410,"a":411},"What is the Quantum Zero Beacon pilot?","Quantum Zero Beacon is the pilot NATO plans for the fourth quarter of 2027. As a pilot, it tests post-quantum implementation in practice before wider rollout, letting the alliance learn from a controlled deployment before committing to broad adoption.",{"q":413,"a":414},"Why does NATO adopting PQC matter?","NATO coordinates defense across member states, so its move toward post-quantum cryptography influences allied militaries and the defense industrial base that supplies them. A common roadmap helps members and suppliers align on compatible post-quantum approaches.",[416],"brussels","\u002Fassets\u002Fog-default.png",[101,419],"Government Facilities",{},"2026-09-30","\u002Fnews\u002Fnato-quantum-roadmap-2027-milestones",[424],{"label":425,"url":426},"North Atlantic Treaty Organization, \"NATO quantum roadmap,\" Sep. 29, 2026.","https:\u002F\u002Fwww.nato.int\u002F",[428,431],{"label":429,"url":430},"Pentagon Sets 2030 and 2031 Post-Quantum Deadlines","\u002Fnews\u002Fpentagon-post-quantum-cryptography-strategy-2030-2031",{"label":432,"url":124},"US Executive Order 14412 Post-Quantum Deadline",{"title":373,"description":404},"NATO Sets a Quantum Roadmap With 2027 Milestones","nato-quantum-roadmap-2027-milestones","news\u002Fnato-quantum-roadmap-2027-milestones",[438,130,132,368,439],"post-quantum cryptography","for government","NATO set a quantum roadmap in September 2026 to adopt and implement post-quantum cryptography, with an action plan update by Q3 2027 and a pilot in Q4 2027.","hvNAY2Wk0EceEF9MoinxZsSqkeqcjpOwMBCcpIEPus0",{"id":443,"title":444,"author":7,"authorTitle":8,"authorUrl":9,"body":445,"canonical":9,"category":220,"date":517,"description":518,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":519,"image":9,"industries":520,"keyFindings":9,"meta":524,"modified":517,"navigation":103,"path":525,"pullquote":9,"recommendations":9,"references":526,"related":534,"seo":541,"seoTitle":542,"signposts":9,"slug":543,"stats":9,"stem":544,"tags":545,"tldr":550,"__hash__":551},"news\u002Fnews\u002Fcisa-operational-technology-post-quantum.md","CISA Warns Industrial Operators That Quantum Risk Hits Plant Systems Hardest",{"type":11,"value":446,"toc":509},[447,449,457,461,470,474,487,491,497,501,504,506],[14,448,17],{"id":16},[19,450,451,452,454,455,171],{},"Operational technology faces the hardest post-quantum migration of any environment, and the systems at risk run power grids, water plants and factory lines. In late October 2024 CISA, with the Department of Homeland Security, published \"Post-Quantum Considerations for Operational Technology,\" warning that long equipment lifecycles, slow patching cycles, strict safety testing and end-of-life operating systems make OT far harder to move than ordinary IT ",[23,453,25],{},". The practical message for operators is to segment networks, build crypto agility into new platforms, protect remote access first, and begin cryptographic inventories now ",[23,456,25],{},[14,458,460],{"id":459},"why-ot-is-the-hard-case","Why OT is the hard case",[19,462,463,464,466,467,469],{},"Operational technology uses less encryption than IT, but it stays exposed through its links to IT networks and through specific critical functions ",[23,465,25],{},". The obstacles are structural. Industrial equipment can have a service life measured in decades, patching windows are rare and tightly controlled, safety rules require extensive retesting after any change, and much of the installed base runs operating systems that are no longer supported ",[23,468,25],{},". A control system bought today may still be in service when quantum risk becomes real, so purchasing decisions now carry long-term exposure.",[14,471,473],{"id":472},"what-cisa-recommends","What CISA recommends",[19,475,476,477,479,480,152,482,484,485,171],{},"CISA's recommendations are advisory, not a mandate ",[23,478,25],{},". They include segmenting OT networks to limit how far an attacker can move, building crypto agility so algorithms can change without replacing infrastructure, protecting remote access points first, layering classical and post-quantum protections during the transition, writing a transition roadmap, and adopting the NIST post-quantum standards finalized in August 2024 ",[23,481,25],{},[23,483,63],{},". Practitioners disagree on urgency, which operators should weigh against their own risk: some argue the quantum threat is real and present, while others say OT teams have more immediate security gaps to close first ",[23,486,25],{},[14,488,490],{"id":489},"a-gap-worth-noting","A gap worth noting",[19,492,493,494,496],{},"CISA's January 2026 list of product categories that should support post-quantum cryptography explicitly leaves OT and IoT devices outside its current scope ",[23,495,29],{},". In plain terms, the buyer's checklist that federal agencies will use does not yet cover the industrial devices most exposed to the migration problem. Operators cannot assume a vendor's product is covered simply because it appears post-quantum ready in other categories.",[14,498,500],{"id":499},"what-this-means-for-operators","What this means for operators",[19,502,503],{},"Owners and operators of industrial control systems and SCADA in energy, water and wastewater, and manufacturing should treat long equipment lifecycles as the central planning fact. The two steps available today need no vendor or finished standard: locate where cryptography is used across the environment, and build crypto agility requirements into new equipment purchases so future algorithm changes do not require ripping out hardware.",[14,505,79],{"id":78},[19,507,508],{},"ArcQubit treats discovery as the first move in any OT environment, because an operator cannot protect cryptography it cannot see. QuCode builds the cryptographic inventory across IT and OT surfaces, and QuTrust holds the prioritized migration plan so segmentation, remote-access hardening and phased upgrades proceed in a defensible order rather than all at once.",{"title":8,"searchDepth":84,"depth":84,"links":510},[511,512,513,514,515,516],{"id":16,"depth":84,"text":17},{"id":459,"depth":84,"text":460},{"id":472,"depth":84,"text":473},{"id":489,"depth":84,"text":490},{"id":499,"depth":84,"text":500},{"id":78,"depth":84,"text":79},"2026-09-22","CISA guidance says operational technology faces the hardest post-quantum migration: long lifecycles, slow patching, legacy systems. What OT operators should do now.",[98],[100,521,522,523],"Critical Manufacturing","Energy","Water and Wastewater Systems",{},"\u002Fnews\u002Fcisa-operational-technology-post-quantum",[527,530,533],{"label":528,"url":529},"Industrial Cyber, \"DHS and CISA prescribe proactive steps toward post-quantum cryptography across OT environments,\" Oct. 29, 2024.","https:\u002F\u002Findustrialcyber.co\u002Fcisa\u002Fdhs-and-cisa-prescribe-proactive-steps-toward-post-quantum-cryptography-across-ot-environments\u002F",{"label":531,"url":532},"Infosecurity Magazine, \"CISA Releases List of Post-Quantum Cryptography Product Categories,\" Jan. 26, 2026.","https:\u002F\u002Fwww.infosecurity-magazine.com\u002Fnews\u002Fcisa-post-quantum-cryptography\u002F",{"label":355,"url":356},[535,538],{"label":536,"url":537},"Seven Places Quantum-Vulnerable Cryptography Hides","\u002Fblog\u002Fseven-places-quantum-crypto-hides",{"label":539,"url":540},"Where to Start a PQC Migration","\u002Fblog\u002Fpqc-migration-where-to-start",{"title":444,"description":518},"CISA Warns OT Faces Hard Quantum Migration","cisa-operational-technology-post-quantum","news\u002Fcisa-operational-technology-post-quantum",[546,547,548,133,549],"critical infrastructure","operational technology","energy sector","crypto-agility","CISA's guidance on post-quantum cryptography for operational technology warns that long equipment lifecycles, slow patching, and end-of-life systems make industrial migration the hardest, so operators should segment networks and start inventories now.","QvlgwHPTyv8biANoF9wqBrjhoFf7GHG7qNH8gZzy9is",{"id":553,"title":554,"author":7,"authorTitle":8,"authorUrl":9,"body":555,"canonical":9,"category":220,"date":631,"description":632,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":633,"image":9,"industries":635,"keyFindings":9,"meta":636,"modified":631,"navigation":103,"path":637,"pullquote":9,"recommendations":9,"references":638,"related":651,"seo":658,"seoTitle":659,"signposts":9,"slug":660,"stats":9,"stem":661,"tags":662,"tldr":665,"__hash__":666},"news\u002Fnews\u002Ffinancial-regulators-quantum-deadlines-2026.md","Financial Regulators Are Turning Quantum Risk Into a Supervised Duty",{"type":11,"value":556,"toc":623},[557,559,570,574,588,592,598,602,608,612,615,618,620],[14,558,17],{"id":16},[19,560,561,562,152,564,566,567,569],{},"Quantum readiness is no longer a research topic for banks. It is becoming a supervised expectation. The G7 Cyber Expert Group, co-chaired by the U.S. Treasury and the Bank of England, published a roadmap in January 2026 that targets 2035 for the financial sector overall and 2030 to 2032 for the most critical systems ",[23,563,25],{},[23,565,29],{},". In July 2026 the European Central Bank told the largest eurozone banks that adoption of post-quantum cryptography must start now ",[23,568,67],{},". The direction is clear: regulators expect financial firms to inventory their cryptography and plan the migration, and they are starting to ask for proof.",[14,571,573],{"id":572},"what-the-g7-roadmap-sets","What the G7 roadmap sets",[19,575,576,577,579,580,582,583,585,586,171],{},"The G7 roadmap is guidance, not a binding rule, but financial authorities from the G7 and the EU helped write it, so supervisors are likely to treat it as a benchmark ",[23,578,25],{},". It sets 2035 as the overall transition target for the sector and prioritizes the most critical systems in a 2030 to 2032 window ",[23,581,25],{},". It lays out six activities: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring ",[23,584,25],{},". The stated reason is harvest-now-decrypt-later risk, where an attacker copies encrypted data today and decrypts it once a capable quantum computer exists ",[23,587,29],{},[14,589,591],{"id":590},"why-dora-already-makes-this-a-current-duty","Why DORA already makes this a current duty",[19,593,594,595,597],{},"In the European Union, the duty is not waiting for a new law. The Digital Operational Resilience Act (DORA) has applied to financial firms since January 2025 and governs how they manage information and communication technology risk ",[23,596,63],{},". DORA sets no post-quantum deadline of its own, but its encryption and key-management duties sit in delegated technical standards whose recital refers to quantum threats. Supervisors use DORA as the legal anchor for cryptographic resilience. In practice, that means a bank can be asked how it would respond when cryptanalysis advances, and \"we have not looked\" is not a defensible answer.",[14,599,601],{"id":600},"the-ecb-signal","The ECB signal",[19,603,604,605,607],{},"The ECB's July 2026 letter to significant institutions focused on AI-enabled cyber threats, but it closed by saying that post-quantum cryptography adoption must start now and needs sustained strategic investment, and it promised a separate supervisory letter on quantum risk ",[23,606,67],{},". For boards, that is the tell: a dated, named quantum expectation is coming through the same supervisory channel that already carries DORA.",[14,609,611],{"id":610},"what-this-means-for-financial-institutions","What this means for financial institutions",[19,613,614],{},"Firms that have already built a cryptographic inventory and a risk-based priority list will be ready when the questions arrive. Those that have not should expect to explain why.",[19,616,617],{},"ArcQubit guidance: treat the inventory as the foundation. Map where public-key cryptography lives across systems, data and third-party providers, rank exposure by data shelf life and business impact, and build the ability to change algorithms without rebuilding systems. These steps satisfy the G7 roadmap's early phases and the DORA duty to manage cryptographic risk at the same time.",[14,619,79],{"id":78},[19,621,622],{},"ArcQubit treats this as a sustained program, not a one-time project. QuCode delivers the discovery and cryptographic inventory that the G7 roadmap and DORA both assume, and QuTrust acts as the system of record for the migration so a bank can show supervisors a current, defensible plan rather than a stale snapshot.",{"title":8,"searchDepth":84,"depth":84,"links":624},[625,626,627,628,629,630],{"id":16,"depth":84,"text":17},{"id":572,"depth":84,"text":573},{"id":590,"depth":84,"text":591},{"id":600,"depth":84,"text":601},{"id":610,"depth":84,"text":611},{"id":78,"depth":84,"text":79},"2026-09-15","The G7 sets 2030-2032 for critical financial systems, DORA anchors crypto duties, and the ECB says post-quantum work must start now. Quantum risk is now supervised.",[342,634],"frankfurt",[100,227],{},"\u002Fnews\u002Ffinancial-regulators-quantum-deadlines-2026",[639,642,645,648],{"label":640,"url":641},"G7 Cyber Expert Group, \"Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector,\" U.S. Department of the Treasury, Jan. 2026.","https:\u002F\u002Fhome.treasury.gov\u002Fsystem\u002Ffiles\u002F136\u002FG7-CEG-Quantum-Roadmap.pdf",{"label":643,"url":644},"U.S. Department of the Treasury, \"G7 Cyber Expert Group Releases Roadmap for Coordinating the Transition to Post-Quantum Cryptography in the Financial Sector,\" Jan. 12, 2026.","https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0355",{"label":646,"url":647},"European Securities and Markets Authority, \"Digital Operational Resilience Act (DORA),\" ESMA, n.d.","https:\u002F\u002Fwww.esma.europa.eu\u002Fesmas-activities\u002Fdigital-finance-and-innovation\u002Fdigital-operational-resilience-act-dora",{"label":649,"url":650},"Allen & Overy Shearman, \"ECB requires significant institutions to address AI-enabled cybersecurity threats,\" Jul. 9, 2026.","https:\u002F\u002Fwww.aoshearman.com\u002Fen\u002Finsights\u002Fecb-requires-significant-institutions-to-address-ai-enabled-cybersecurity-threats",[652,655],{"label":653,"url":654},"One Clock, Three Jurisdictions: How the U.S., UK, and EU Deadlines Line Up","\u002Fnews\u002Fus-uk-eu-post-quantum-deadlines-aligned",{"label":656,"url":657},"2028 Is the Post-Quantum Deadline Nobody Is Talking About","\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about",{"title":554,"description":632},"Financial Regulators Set Quantum Deadlines","financial-regulators-quantum-deadlines-2026","news\u002Ffinancial-regulators-quantum-deadlines-2026",[257,663,132,368,664],"DORA","for CISOs","The G7 financial roadmap targets 2030 to 2032 for critical systems and the ECB told eurozone banks that post-quantum migration must start now, which turns quantum readiness from a research topic into a supervised expectation.","YZSKjjJVNISVl1Xz4NHqOrZAunsLDIUY1ZBlEWjFJWE",{"id":668,"title":669,"author":7,"authorTitle":8,"authorUrl":9,"body":670,"canonical":9,"category":220,"date":733,"description":734,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":735,"image":9,"industries":737,"keyFindings":9,"meta":739,"modified":740,"navigation":103,"path":741,"pullquote":9,"recommendations":9,"references":742,"related":751,"seo":754,"seoTitle":755,"signposts":9,"slug":756,"stats":9,"stem":757,"tags":758,"tldr":760,"__hash__":761},"news\u002Fnews\u002Ffood-agriculture-supply-chain-post-quantum.md","Food Supply Chains Face Rising Cyber Pressure While Post-Quantum Planning Barely Registers",{"type":11,"value":671,"toc":725},[672,674,677,681,693,697,703,707,713,717,720,722],[14,673,17],{"id":16},[19,675,676],{},"Food and agriculture is under rising cyber pressure, but post-quantum migration planning for the sector barely registers in current reporting. No article in the set is mainly about post-quantum migration for food and agriculture: one source never mentions quantum, one is general operational-technology guidance, and one is an academic proposal. The connection to the quantum migration is an inference, and a reasonable one: the batch, quality and traceability records that keep food safe depend on digital signatures that must stay trustworthy for years.",[14,678,680],{"id":679},"the-immediate-pressure","The immediate pressure",[19,682,683,684,686,687,689,690,692],{},"Industrial Cyber reported in September 2026 that ransomware incidents in food and agriculture rose 62 percent through July 2026 compared with the prior year ",[23,685,25],{},". Attackers time pressure to planting and harvest seasons, compromised refrigeration forces product disposal because food safety cannot be verified, and doubt about batch or traceability records triggers holds and recalls ",[23,688,25],{},". The piece draws on Food and Ag-ISAC data, which is likely US-centered though the article does not state a region, and it does not discuss quantum ",[23,691,25],{},". The link to post-quantum work runs through those records: if the signatures protecting traceability data can be forged, the whole chain of trust that food safety relies on weakens.",[14,694,696],{"id":695},"the-shared-ot-problem","The shared OT problem",[19,698,699,700,702],{},"Trade coverage of the DHS and CISA operational-technology guidance describes the problem food processors share with other sectors: public-key dependencies in remote access, firmware validation and device authentication are exposed, and slow patch cycles, decades-old systems and safety testing slow any change ",[23,701,29],{},". That coverage names water, telecommunications, energy, manufacturing and transportation rather than food, though processors and cold-chain operators run similar control systems, so applying it here is a reasonable extension rather than a direct finding.",[14,704,706],{"id":705},"early-academic-work","Early academic work",[19,708,709,710,712],{},"Researchers at an institute in Chennai described in July 2025 a framework combining federated learning, quantum-inspired reinforcement learning and lightweight lattice-based hashing on a blockchain for food traceability, reporting high anomaly-detection accuracy and strong protection against cyber threats including quantum attacks ",[23,711,63],{},". Those are the authors' own unverified claims, and the paper proposes a design without offering migration guidance, so it points to a research direction rather than a deployable answer.",[14,714,716],{"id":715},"what-this-means-for-the-sector","What this means for the sector",[19,718,719],{},"With no sector-specific standard, the defensible path is to protect the records that matter. Processors and distributors should inventory where signatures and public-key cryptography protect traceability, batch and quality data, prioritize records that must stay trustworthy for years, and require crypto agility in the systems that produce and verify them.",[14,721,79],{"id":78},[19,723,724],{},"ArcQubit treats discovery as the first move where sector guidance is thin. QuCode maps where vulnerable cryptography protects traceability and control systems, and QuTrust holds the migration plan so the records that underpin food safety stay verifiable through the transition.",{"title":8,"searchDepth":84,"depth":84,"links":726},[727,728,729,730,731,732],{"id":16,"depth":84,"text":17},{"id":679,"depth":84,"text":680},{"id":695,"depth":84,"text":696},{"id":705,"depth":84,"text":706},{"id":715,"depth":84,"text":716},{"id":78,"depth":84,"text":79},"2026-09-08","Ransomware in food and agriculture rose sharply through 2026, and traceability records rely on long-lived signatures, yet post-quantum planning barely registers.",[736],"us",[100,738],"Food and Agriculture",{},"2026-09-10","\u002Fnews\u002Ffood-agriculture-supply-chain-post-quantum",[743,746,748],{"label":744,"url":745},"A. Ribeiro, S. King, O. Calderon, and J. Braley, \"Cyberattacks on food and agriculture can turn disruptions into safety crises, threatening public health and supply chains,\" Industrial Cyber, Sep. 8, 2026.","https:\u002F\u002Findustrialcyber.co\u002Ffeatures\u002Fcyberattacks-on-food-and-agriculture-can-turn-disruptions-into-safety-crises-threatening-public-health-and-supply-chains\u002F",{"label":747,"url":529},"A. Ribeiro, \"DHS and CISA prescribe proactive steps toward post-quantum cryptography across OT environments,\" Industrial Cyber, Oct. 29, 2024.",{"label":749,"url":750},"I. M. M. Sheriff and D. J. Aravindhar, \"Towards quantum-resilient food systems: federated AI and lightweight lattice hashing for blockchain-based traceability,\" SN Computer Science, Jul. 17, 2025.","https:\u002F\u002Flink.springer.com\u002Farticle\u002F10.1007\u002Fs42979-025-04163-2",[752,753],{"label":444,"url":525},{"label":246,"url":247},{"title":669,"description":734},"Food Supply Chains and Quantum Risk","food-agriculture-supply-chain-post-quantum","news\u002Ffood-agriculture-supply-chain-post-quantum",[759,547,546,259,368],"supply chain","Ransomware in food and agriculture rose sharply through 2026 and the sector's traceability records depend on signatures that must stay trustworthy for years, yet almost no post-quantum migration planning exists for the sector in current reporting.","U-Zu1L7OSxud5ySebbNWIrAFMj-0q2joJPdsbUR_Wmc",{"id":763,"title":764,"author":7,"authorTitle":8,"authorUrl":9,"body":765,"canonical":9,"category":92,"date":793,"description":794,"draft":95,"extension":96,"faqs":795,"findingsSource":9,"geo":805,"image":417,"industries":806,"keyFindings":9,"meta":807,"modified":221,"navigation":103,"path":808,"pullquote":9,"recommendations":9,"references":809,"related":813,"seo":820,"seoTitle":821,"signposts":9,"slug":822,"stats":9,"stem":823,"tags":824,"tldr":825,"__hash__":826},"news\u002Fnews\u002Fhhs-aspr-signals-pq-guidance-for-hospitals.md","HHS and ASPR Signal Coming Post-Quantum Guidance for Hospitals",{"type":11,"value":766,"toc":790},[767,771,776,779,782,785],[14,768,770],{"id":769},"hhs-and-aspr-signal-coming-post-quantum-guidance-for-hospitals","HHS and ASPR signal coming post-quantum guidance for hospitals",[19,772,773],{},[383,774,775],{},"3 SEPTEMBER 2026, WASHINGTON",[19,777,778],{},"HHS and its Administration for Strategic Preparedness and Response, ASPR, signalled on 3 September 2026 that post-quantum guidance for hospitals is coming. ASPR said it is working with partners on the guidance. The current resilience guidance, known as RISC 2.0, still contains no post-quantum content, so the signal points to future guidance rather than a published document.",[19,780,781],{},"Healthcare has a strong reason to prepare. An earlier HC3 briefing from 2022 noted that health data stays sensitive for decades, which makes it a prime target for harvest-now-decrypt-later. An adversary could record long-lived patient records today and decrypt them once a quantum computer exists, so the exposure is already real even before the guidance lands.",[19,783,784],{},"The signal functions as advance notice. Because the guidance is still in development and no binding healthcare post-quantum rule yet exists, healthcare organizations face no current mandate. Treating the signal as a prompt to begin foundational work, rather than waiting for the published guidance, gives them a head start on the slow parts of migration.",[19,786,787,789],{},[383,788,399],{}," The HHS and ASPR signal tells hospitals that post-quantum guidance is on the way, even though current resilience guidance omits it. Given that health data stays sensitive for decades, the harvest-now-decrypt-later risk is pressing for the sector. Healthcare organizations can start cryptographic discovery and inventory now, so they are ready to act on the guidance when ASPR and its partners publish it.",{"title":8,"searchDepth":84,"depth":84,"links":791},[792],{"id":769,"depth":84,"text":770},"2026-09-03","HHS and ASPR signalled in September 2026 that post-quantum guidance for hospitals is coming; current resilience guidance has no post-quantum content yet.",[796,799,802],{"q":797,"a":798},"What did HHS and ASPR signal?","On 3 September 2026, HHS and ASPR signalled that post-quantum guidance for hospitals is coming, saying ASPR is working with partners. The current resilience guidance, RISC 2.0, has no post-quantum content yet, so the signal points to future rather than published guidance.",{"q":800,"a":801},"Why does healthcare need post-quantum guidance?","An earlier HC3 briefing from 2022 noted that health data stays sensitive for decades, which makes it a prime target for harvest-now-decrypt-later. Long-lived patient records exposed today could be decrypted once a quantum computer exists, so the sector has strong reason to inventory and plan now.",{"q":803,"a":804},"Is any binding healthcare post-quantum rule in place?","No. The signal describes guidance in development, and the current RISC 2.0 resilience guidance contains no post-quantum requirements. Healthcare organizations should treat the signal as advance notice and begin foundational work rather than wait for a published mandate.",[342],[344,100],{},"\u002Fnews\u002Fhhs-aspr-signals-pq-guidance-for-hospitals",[810],{"label":811,"url":812},"U.S. Department of Health and Human Services, Administration for Strategic Preparedness and Response (ASPR), \"Post-quantum guidance signal for the health sector,\" Sep. 3, 2026.","https:\u002F\u002Faspr.hhs.gov\u002F",[814,817],{"label":815,"url":816},"CISA, NSA and NIST Urge Organizations to Start Quantum-Readiness Planning","\u002Fnews\u002Fcisa-nsa-nist-quantum-readiness-factsheet",{"label":818,"url":819},"NIST 2021 Paper Warns Post-Quantum Migration Is Hard and Slow","\u002Fnews\u002Fnist-2021-paper-migration-is-hard-and-slow",{"title":764,"description":794},"HHS and ASPR Signal Post-Quantum Hospital Guidance","hhs-aspr-signals-pq-guidance-for-hospitals","news\u002Fhhs-aspr-signals-pq-guidance-for-hospitals",[367,368,259,133,260],"HHS and ASPR signalled in September 2026 that post-quantum guidance for hospitals is coming, while current resilience guidance still contains no post-quantum content.","Guem5v9mSC1L8rxfoX0HtIJ2xsBNEL7tzpwNMiVye_U",{"id":828,"title":829,"author":7,"authorTitle":8,"authorUrl":9,"body":830,"canonical":9,"category":220,"date":890,"description":891,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":892,"image":9,"industries":893,"keyFindings":9,"meta":895,"modified":890,"navigation":103,"path":896,"pullquote":9,"recommendations":9,"references":897,"related":907,"seo":910,"seoTitle":911,"signposts":9,"slug":912,"stats":9,"stem":913,"tags":914,"tldr":915,"__hash__":916},"news\u002Fnews\u002Fcommercial-facilities-smart-buildings-post-quantum.md","Smart Buildings and Hotels Confront Encryption That Will Outlive Their Hardware",{"type":11,"value":831,"toc":882},[832,834,837,841,850,854,860,864,870,874,877,879],[14,833,17],{"id":16},[19,835,836],{},"Building edge controllers and access gateways often stay in service for 15 to 20 years, so the encryption protecting them today will likely outlive the hardware. That mismatch is the core of the quantum-era problem for commercial facilities, from office towers to hotels. The current reporting is led by vendor and opinion pieces, which should be read as viewpoints rather than independent findings, but the shared point is credible: equipment with long lifecycles bought now carries encryption that a future quantum computer could break, so purchasing and architecture decisions made today have long tails.",[14,838,840],{"id":839},"smart-buildings","Smart buildings",[19,842,843,844,846,847,849],{},"A Propmodo article by a Neeve executive warns that adversaries can harvest building data such as security logs and intellectual property now and decrypt it later ",[23,845,25],{},". It cites an NSA expectation of post-quantum support in new networking equipment beginning January 2027, calls 2028 a practical tipping point, and urges owners to move from legacy VPNs toward zero-trust architectures and to buy hardware with headroom for larger algorithms ",[23,848,25],{},". The author works for a vendor and the piece is US-focused, so treat the dates as the author's framing.",[14,851,853],{"id":852},"hospitality","Hospitality",[19,855,856,857,859],{},"Hospitality faces a similar exposure. In January 2026, Mark Fancourt argued in Hotel Online that much of global digital security, hospitality systems included, rests on algorithms quantum computers could break, and he criticized the industry's weak baseline information-security practice while a major cryptographic transition approaches ",[23,858,29],{},". The piece is opinion with limited technical depth, so it signals concern more than it establishes fact.",[14,861,863],{"id":862},"the-payments-angle","The payments angle",[19,865,866,867,869],{},"Card acceptance gives facility operators a more specific read. A 2025 Mastercard research white paper, written with contributors from NTU Singapore and PQStation, estimates a cryptographically relevant quantum computer is at least 10 years away and probably 20 or more, and argues card-transaction harvest risk is low because EMV cryptograms are single-use and symmetric, while long-lived digital signatures form the harder migration problem ",[23,868,63],{},". Hotels and retailers sit on that card-acceptance infrastructure, though the paper targets financial services.",[14,871,873],{"id":872},"what-this-means-for-facility-owners","What this means for facility owners",[19,875,876],{},"The honest first steps need no facility-specific standard: inventory where cryptography lives across building and payment systems, prioritize the long-lived trust anchors and access controls, and write crypto agility into new hardware tenders so a later algorithm change does not force a rip-and-replace.",[14,878,79],{"id":78},[19,880,881],{},"ArcQubit treats discovery as the foundation. QuCode maps where vulnerable cryptography sits across building and enterprise systems, and QuTrust holds the migration plan so owners can sequence upgrades against real hardware refresh cycles rather than all at once.",{"title":8,"searchDepth":84,"depth":84,"links":883},[884,885,886,887,888,889],{"id":16,"depth":84,"text":17},{"id":839,"depth":84,"text":840},{"id":852,"depth":84,"text":853},{"id":862,"depth":84,"text":863},{"id":872,"depth":84,"text":873},{"id":78,"depth":84,"text":79},"2026-09-02","Smart-building and hotel systems run 15-20 years, outliving their encryption. Vendors flag harvest-now risk and a 2027-2028 tipping point for owners.",[736],[100,894],"Commercial Facilities",{},"\u002Fnews\u002Fcommercial-facilities-smart-buildings-post-quantum",[898,901,904],{"label":899,"url":900},"C. Stucki, \"How quantum computing is forcing a smart building security overhaul,\" Propmodo, Sep. 10, 2026.","https:\u002F\u002Fpropmodo.com\u002Fhow-quantum-computing-is-forcing-a-smart-building-security-overhaul\u002F",{"label":902,"url":903},"M. Fancourt, \"Quantum of vulnerability,\" Hotel Online, Jan. 7, 2026.","https:\u002F\u002Fwww.hotel-online.com\u002Fnews\u002Fquantum-of-vulnerability",{"label":905,"url":906},"Mastercard R&D, NTU Singapore, and PQStation Pte. Ltd., \"Migration to post-quantum cryptography,\" Mastercard white paper, 2025.","https:\u002F\u002Fwww.mastercard.com\u002Fcontent\u002Fdam\u002Fmccom\u002Fshared\u002Fnews-and-trends\u002Fstories\u002F2025\u002Fquantum-explainer-and-white-paper\u002FMigration-to-post-quantum-cryptography-WhitePaper_2025.pdf",[908,909],{"label":444,"url":525},{"label":246,"url":247},{"title":829,"description":891},"Smart Buildings Face Quantum-Era Encryption","commercial-facilities-smart-buildings-post-quantum","news\u002Fcommercial-facilities-smart-buildings-post-quantum",[547,546,259,368,260],"Building controllers and hotel systems often run 15 to 20 years, so encryption installed today will outlive the hardware, and vendors warn that harvest-now-decrypt-later exposure plus a 2027 to 2028 tipping point should move owners toward zero-trust designs now.","3aQ8a3WcrAQlydjTozB-TqvR2Bk2UrgxLj2MAPBYmU8",{"id":918,"title":919,"author":7,"authorTitle":8,"authorUrl":9,"body":920,"canonical":9,"category":220,"date":987,"description":988,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":989,"image":9,"industries":990,"keyFindings":9,"meta":992,"modified":631,"navigation":103,"path":993,"pullquote":9,"recommendations":9,"references":994,"related":1007,"seo":1010,"seoTitle":1011,"signposts":9,"slug":1012,"stats":9,"stem":1013,"tags":1014,"tldr":1016,"__hash__":1017},"news\u002Fnews\u002Ftransportation-systems-aviation-ports-post-quantum.md","Aviation, Ports, and Road Networks Begin Post-Quantum Planning With Standards Still Missing",{"type":11,"value":921,"toc":979},[922,924,933,937,943,947,955,959,967,971,974,976],[14,923,17],{"id":16},[19,925,926,927,929,930,932],{},"Transportation operators have started post-quantum planning while the standards they would migrate to are still incomplete. In March 2026 the US Federal Aviation Administration asked industry for input on moving both the National Airspace System and its business systems to post-quantum cryptography ",[23,928,25],{},". A research review published in August 2026 found that two core intelligent-transportation standards lack post-quantum certificate profiles ",[23,931,29],{},", and port and road operators face trust decisions now that will persist for decades. The sector has direct coverage for aviation, ports and road, plus a regional warning from Australia.",[14,934,936],{"id":935},"aviation","Aviation",[19,938,939,940,942],{},"The FAA framed post-quantum cryptography as an enabler, not just a compliance exercise, and noted that air-traffic infrastructure runs continuously with little tolerance for downtime and ties to aircraft safety systems, with responses due in April 2026 ",[23,941,25],{},". A request for input is an early step, but it signals that the regulator intends to move the airspace system deliberately rather than reactively.",[14,944,946],{"id":945},"ports-and-road","Ports and road",[19,948,949,950,952,953,171],{},"A review in Vehicular Communications from August 2026 covers 179 publications on intelligent transportation systems, identifies 13 research and regulatory gaps, and finds that the IEEE 1609.2 and ETSI C-ITS standards lack post-quantum certificate profiles, concluding that migration needs system-level redesign of certificates and protocols, not just algorithm swaps ",[23,951,29],{},". For ports, a BMT analysis in August 2026 argued that harvest-now-decrypt-later applies to cargo information, logistics data, access controls, financial records and navigation data, anticipated quantum computers around the mid-2030s, and warned that security decisions made now may persist 25 to 30 years ",[23,954,63],{},[14,956,958],{"id":957},"australias-warning","Australia's warning",[19,960,961,962,964,965,171],{},"Australia's industry association adds a regional signal. SecurityBrief Australia reported in May 2026 that the Australian Information Security Association says government and critical-infrastructure organizations underestimate quantum risk, naming transport alongside energy, finance and government, and that organizations should have a plan by the end of 2026, while poor asset visibility and hard-to-update operational technology remain obstacles ",[23,963,67],{},". The association also cautioned against rushed regulation that yields superficial implementations ",[23,966,67],{},[14,968,970],{"id":969},"what-this-means-for-transport-operators","What this means for transport operators",[19,972,973],{},"The missing certificate profiles are the key planning fact: an operator cannot simply swap an algorithm when the standard it depends on has no post-quantum profile yet. The practical path is to inventory where certificates and public-key cryptography protect vehicle, vessel and air-traffic communications, track the standards work, and require crypto agility in new equipment so systems can adopt profiles once they land.",[14,975,79],{"id":78},[19,977,978],{},"ArcQubit treats discovery as the first move, because transport systems depend on certificate chains that are hard to see across a fleet or a network. QuCode maps where vulnerable cryptography and certificates sit, and QuTrust holds the migration plan so operators can adopt post-quantum profiles in a defensible order as the standards mature.",{"title":8,"searchDepth":84,"depth":84,"links":980},[981,982,983,984,985,986],{"id":16,"depth":84,"text":17},{"id":935,"depth":84,"text":936},{"id":945,"depth":84,"text":946},{"id":957,"depth":84,"text":958},{"id":969,"depth":84,"text":970},{"id":78,"depth":84,"text":79},"2026-08-11","The FAA asked industry how to move air traffic to post-quantum cryptography, and reviews find transport standards lack post-quantum certificate profiles.",[736],[100,991],"Transportation Systems",{},"\u002Fnews\u002Ftransportation-systems-aviation-ports-post-quantum",[995,998,1001,1004],{"label":996,"url":997},"J. Whitney, \"FAA seeks industry input on post-quantum cryptography transition for air traffic control and IT systems,\" Military & Aerospace Electronics, Mar. 11, 2026.","https:\u002F\u002Fwww.militaryaerospace.com\u002Fcommercial-aerospace\u002Farticle\u002F55363028\u002Ffaa-seeks-industry-input-on-post-quantum-cryptography-transition-for-air-traffic-control-and-it-systems",{"label":999,"url":1000},"M. Chowdhury, A. Al Mamun, A. Abrar, S. M. M. Rahman, and M. S. Salek, \"Post-quantum cryptography for intelligent transportation systems: an implementation-focused review,\" Veh. Commun., vol. 60, Art. no. 101028, Aug. 2026.","https:\u002F\u002Fwww.sciencedirect.com\u002Fscience\u002Farticle\u002Fpii\u002FS2214209626000306",{"label":1002,"url":1003},"BMT, \"Designing for a post-quantum future: what port operators need to consider now,\" BMT Insights, Aug. 11, 2026.","https:\u002F\u002Fwww.bmt.org\u002Finsights\u002Fdesigning-for-a-post-quantum-future-what-port-operators-need-to-consider-now\u002F",{"label":1005,"url":1006},"M. Tarre, \"Australia warned over quantum cyber security risks,\" SecurityBrief Australia, May 29, 2026.","https:\u002F\u002Fsecuritybrief.com.au\u002Fstory\u002Faustralia-warned-over-quantum-cyber-security-risks",[1008,1009],{"label":444,"url":525},{"label":539,"url":540},{"title":919,"description":988},"Transport Begins Post-Quantum Planning","transportation-systems-aviation-ports-post-quantum","news\u002Ftransportation-systems-aviation-ports-post-quantum",[1015,546,132,133,260],"transportation","The US aviation regulator asked industry how to move air traffic systems to post-quantum cryptography, a research review found transport standards lack post-quantum certificate profiles, and port and road operators face trust decisions that will persist for decades.","WC6VVcM792mRc33t-xfs3GweyLHyVQixENwA8sfoGc4",{"id":1019,"title":1020,"author":7,"authorTitle":8,"authorUrl":9,"body":1021,"canonical":9,"category":92,"date":1049,"description":1050,"draft":95,"extension":96,"faqs":1051,"findingsSource":9,"geo":1061,"image":417,"industries":1062,"keyFindings":9,"meta":1063,"modified":339,"navigation":103,"path":1064,"pullquote":9,"recommendations":9,"references":1065,"related":1069,"seo":1073,"seoTitle":1074,"signposts":9,"slug":1075,"stats":9,"stem":1076,"tags":1077,"tldr":1079,"__hash__":1080},"news\u002Fnews\u002Fus-senate-grid-bill-s-5313-quantum-risk.md","US Senate Grid Bill S. 5313 Would Have FERC Consider Quantum Risk",{"type":11,"value":1022,"toc":1046},[1023,1027,1032,1035,1038,1041],[14,1024,1026],{"id":1025},"us-senate-grid-bill-s-5313-would-have-ferc-consider-quantum-risk","US Senate grid bill S. 5313 would have FERC consider quantum risk",[19,1028,1029],{},[383,1030,1031],{},"6 AUGUST 2026, WASHINGTON",[19,1033,1034],{},"US Senate bill S. 5313, introduced on 6 August 2026, would bring quantum risk into the regulation of the electric grid. It would have the Federal Energy Regulatory Commission consider quantum risk in reliability standards and direct the Department of Energy's CESER office to create a post-quantum cryptography sandbox within one year. As the text makes clear, it is a bill rather than law.",[19,1036,1037],{},"The bill's status shapes how organizations should read it. S. 5313 must pass both chambers of Congress and gain a signature before it carries legal effect, and bills can change or fail along the way. Organizations should track its progress and treat its provisions as a signal of legislative intent rather than a current requirement.",[19,1039,1040],{},"The focus on the grid reflects its importance. The electric grid is critical infrastructure whose reliability underpins the economy and other sectors, and it runs on long-lived systems that are hard to change quickly. Having FERC weigh quantum risk in reliability standards would fold post-quantum concerns into how grid operators are regulated, matching the stakes involved.",[19,1042,1043,1045],{},[383,1044,399],{}," S. 5313 shows post-quantum risk reaching the legislative agenda for the US electric grid, with a proposed FERC role and a DOE sandbox. It is not yet law, so its direct effect is nil for now, but it signals where grid regulation may head. Grid operators and their suppliers can watch the bill while continuing the cryptographic discovery that any future requirement would demand.",{"title":8,"searchDepth":84,"depth":84,"links":1047},[1048],{"id":1025,"depth":84,"text":1026},"2026-08-06","US Senate bill S. 5313 would have FERC consider quantum risk in reliability standards and create a DOE post-quantum sandbox within a year; it is a bill, not law.",[1052,1055,1058],{"q":1053,"a":1054},"What would S. 5313 do?","Introduced on 6 August 2026, the bill would have the Federal Energy Regulatory Commission consider quantum risk in reliability standards and direct the Department of Energy's CESER office to create a post-quantum cryptography sandbox within one year. It is a bill, not yet law.",{"q":1056,"a":1057},"Is S. 5313 in effect?","No. S. 5313 is a bill, so it must pass both chambers of Congress and be signed before it has legal effect. Organizations should track its progress rather than treat its provisions as binding, since bills can change or fail during the legislative process.",{"q":1059,"a":1060},"Why target the electric grid?","The electric grid is critical infrastructure whose reliability underpins the economy and other sectors. Having FERC weigh quantum risk in reliability standards would bring post-quantum concerns into how grid operators are regulated, reflecting the grid's importance and long-lived systems.",[342],[522,419],{},"\u002Fnews\u002Fus-senate-grid-bill-s-5313-quantum-risk",[1066],{"label":1067,"url":1068},"U.S. Senate, \"A bill to address quantum risk in grid reliability (S. 5313),\" introduced Aug. 6, 2026.","https:\u002F\u002Fwww.congress.gov\u002F",[1070,1071],{"label":432,"url":124},{"label":1072,"url":525},"CISA Warns of Post-Quantum Obstacles in OT Systems",{"title":1020,"description":1050},"US Senate Grid Bill S. 5313 Eyes Quantum Risk","us-senate-grid-bill-s-5313-quantum-risk","news\u002Fus-senate-grid-bill-s-5313-quantum-risk",[548,546,258,1078,439],"policy analysis","US Senate bill S. 5313, introduced in August 2026, would have FERC consider quantum risk in reliability standards and create a DOE post-quantum sandbox; it is a bill, not law.","Qx7goikdRkP4iO2Y_g5J0gsiyxxbDoGGQE5neMEJwPw",{"id":1082,"title":1083,"author":7,"authorTitle":8,"authorUrl":9,"body":1084,"canonical":9,"category":220,"date":1149,"description":1150,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":1151,"image":9,"industries":1154,"keyFindings":9,"meta":1155,"modified":1156,"navigation":103,"path":1157,"pullquote":9,"recommendations":9,"references":1158,"related":1168,"seo":1173,"seoTitle":1174,"signposts":9,"slug":1175,"stats":9,"stem":1176,"tags":1177,"tldr":1178,"__hash__":1179},"news\u002Fnews\u002Ffinancial-services-basel-to-singapore-crypto-risk.md","Regulators From Basel to Singapore Push Banks to Rank Cryptographic Risk",{"type":11,"value":1085,"toc":1141},[1086,1088,1091,1095,1104,1108,1119,1123,1129,1133,1136,1138],[14,1087,17],{"id":16},[19,1089,1090],{},"Financial regulators across several jurisdictions now point banks in the same direction: start the post-quantum transition now, build a cryptographic inventory, and rank systems by risk. The Bank for International Settlements set that tone in July 2025, a Europol-linked framework published in early 2026 gives banks a method for deciding what moves first, and Singapore's regulator signaled formal supervisory expectations later in 2026. This is one of the best-covered sectors, though two of the three sources are secondary trade coverage of regulator work.",[14,1092,1094],{"id":1093},"the-bis-roadmap","The BIS roadmap",[19,1096,1097,1098,1100,1101,1103],{},"The Bank for International Settlements told the financial system in July 2025 to start the transition now, with broad awareness and a cryptographic inventory as foundations ",[23,1099,25],{},". Its roadmap presents post-quantum cryptography as the viable near-term solution, stresses crypto agility, defense-in-depth, hybrid models and phased migration, and describes quantum key distribution as promising but limited by infrastructure today ",[23,1102,25],{},". As the central banks' own forum, the BIS signals how supervisors are likely to think, even though the paper is not a rule.",[14,1105,1107],{"id":1106},"a-way-to-rank-the-work","A way to rank the work",[19,1109,1110,1111,1113,1114,1116,1117,171],{},"Europe supplied a method for sequencing. Help Net Security reported in January 2026 on a framework linked to Europol and a financial-sector forum that gives each system a Quantum Risk Score built from three factors scored 1 to 3, shelf life of the protected data, exposure and business impact, plus a separate Migration Time Score based on solution maturity, implementation effort and external dependencies ",[23,1112,29],{},". Combining the two yields a high, medium or low priority matrix ",[23,1115,29],{},". The framework flags point-of-sale payment systems as long-range challenges because of multi-year hardware cycles, while public websites are early candidates since hybrid post-quantum TLS already exists in major browsers and content delivery networks ",[23,1118,29],{},[14,1120,1122],{"id":1121},"singapores-signal","Singapore's signal",[19,1124,1125,1126,1128],{},"Singapore is the clearest regional signal. Trade coverage in August 2026 reported that the Monetary Authority of Singapore plans to issue formal supervisory expectations later in 2026, aiming for financial institutions to reach quantum resilience before the end of the decade, through three parts: cryptographic asset inventories, prioritized migration plans, and technical capability with governance ",[23,1127,63],{},". That is trade-press coverage of the regulator rather than a published MAS document, so treat the detail as reported.",[14,1130,1132],{"id":1131},"what-this-means-for-banks","What this means for banks",[19,1134,1135],{},"The common instruction is unmistakable: inventory first, then prioritize. Banks that build a cryptographic inventory and a risk-ranked migration plan now will be ready when supervisory expectations harden, and they can reuse the BIS and Europol framing to justify sequencing to boards and regulators.",[14,1137,79],{"id":78},[19,1139,1140],{},"ArcQubit treats the inventory as the foundation these regulators all assume. QuCode delivers the cryptographic discovery and inventory, and QuTrust acts as the system of record for a risk-ranked migration, so a bank can show supervisors a current, defensible plan rather than a stale snapshot.",{"title":8,"searchDepth":84,"depth":84,"links":1142},[1143,1144,1145,1146,1147,1148],{"id":16,"depth":84,"text":17},{"id":1093,"depth":84,"text":1094},{"id":1106,"depth":84,"text":1107},{"id":1121,"depth":84,"text":1122},{"id":1131,"depth":84,"text":1132},{"id":78,"depth":84,"text":79},"2026-08-02","The BIS says banks should start now with an inventory, a Europol-linked framework ranks what moves first, and Singapore plans supervisory expectations in 2026.",[1152,1153],"basel","singapore",[100,227],{},"2026-09-09","\u002Fnews\u002Ffinancial-services-basel-to-singapore-crypto-risk",[1159,1162,1165],{"label":1160,"url":1161},"R. Auer et al., \"Quantum-readiness for the financial system: a roadmap,\" Bank for International Settlements, BIS Papers No. 158, Jul. 7, 2025.","https:\u002F\u002Fwww.bis.org\u002Fpublications\u002Fpaper-158-quantum-readiness-financial-system-roadmap",{"label":1163,"url":1164},"S. Markovic, \"A new framework helps banks sort urgent post-quantum crypto work from the rest,\" Help Net Security, Jan. 22, 2026.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F01\u002F22\u002Feuropol-post-quantum-cryptography-migration\u002F",{"label":1166,"url":1167},"M. Ivezic, \"MAS Targets Quantum Resilience for FIs by End of Decade,\" PostQuantum.com, Aug. 2, 2026.","https:\u002F\u002Fpostquantum.com\u002Fsecurity-pqc\u002Fmas-quantum-resilience-supervisory-expectations\u002F",[1169,1170],{"label":554,"url":637},{"label":1171,"url":1172},"Quantum Readiness Questions Your Board Should Be Asking","\u002Fblog\u002Fquantum-readiness-questions-your-board-should-be-asking",{"title":1083,"description":1150},"Banks Pushed to Rank Cryptographic Risk","financial-services-basel-to-singapore-crypto-risk","news\u002Ffinancial-services-basel-to-singapore-crypto-risk",[257,132,368,133,664],"The Bank for International Settlements told banks to start the transition now with a cryptographic inventory, a Europol-linked framework shows how to rank what moves first, and Singapore signaled formal supervisory expectations later in 2026.","AUEQGpVi3FPxm842yN2qmKAgZx5YaxyJ3qeClK0B_Ro",{"id":1181,"title":1182,"author":7,"authorTitle":8,"authorUrl":9,"body":1183,"canonical":9,"category":220,"date":1243,"description":1244,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":1245,"image":9,"industries":1246,"keyFindings":9,"meta":1248,"modified":1249,"navigation":103,"path":1250,"pullquote":9,"recommendations":9,"references":1251,"related":1262,"seo":1265,"seoTitle":1266,"signposts":9,"slug":1267,"stats":9,"stem":1268,"tags":1269,"tldr":1271,"__hash__":1272},"news\u002Fnews\u002Fchemical-sector-post-quantum-ot-systems.md","Chemical Producers Weigh Post-Quantum Migration Against Decades-Old Plant Systems",{"type":11,"value":1184,"toc":1235},[1185,1187,1190,1194,1203,1207,1213,1217,1223,1227,1230,1232],[14,1186,17],{"id":16},[19,1188,1189],{},"Chemical producers face the post-quantum migration on hard ground: plant control systems built to run for decades, protecting data that must stay secret far longer than the hardware's service life. No post-quantum guidance written for the chemical sector exists in the current reporting, so the picture comes from operational technology (OT) guidance, a pharma analysis, and European regulation. The through-line is clear. Industrial equipment resists rapid change, long-lived research and process data is a harvest-now-decrypt-later target, and NIS2 sets the supervisory frame in which any cryptographic work will be audited.",[14,1191,1193],{"id":1192},"why-plant-systems-make-this-hard","Why plant systems make this hard",[19,1195,1196,1197,1199,1200,1202],{},"Trade coverage of the DHS and CISA operational technology paper reports that industrial control systems often run end-of-life operating systems over long lifecycles, and that a quantum-capable attacker could decrypt protected traffic, forge signatures and defeat secure boot ",[23,1198,25],{},". A vendor executive writing in Dark Reading adds that many field devices carry as little as 32 KB of RAM and cannot be patched without physical access, which blocks large post-quantum algorithms, and he warns of trust-now-forge-later abuse of stolen firmware-signing keys ",[23,1201,29],{},". That author sells security tooling, so treat the piece as a vendor viewpoint rather than independent analysis.",[14,1204,1206],{"id":1205},"the-data-side-of-the-risk","The data side of the risk",[19,1208,1209,1210,1212],{},"A World Economic Forum analysis co-authored by PwC and GSK contributors argues that nation-state actors already pursue harvest-now-decrypt-later collection against research data, including formulas, intellectual property and manufacturing process data, and it places cryptographically relevant quantum computers around 2030 to 2035 ",[23,1211,63],{},". That piece covers pharma and never mentions chemicals, so applying it to chemical process data is an inference, but the data profiles are similar: both sectors hold formulations and process know-how with a confidentiality life measured in decades.",[14,1214,1216],{"id":1215},"the-regulatory-frame","The regulatory frame",[19,1218,1219,1220,1222],{},"Germany's NIS2 implementation law took effect on December 6, 2025, with a grace period that ended July 31, 2026, and chemical facilities above size thresholds count as particularly important entities with penalties reaching 10 million euros or 2 percent of global turnover ",[23,1221,67],{},". That source does not discuss quantum, so it supports the supervisory picture only, not a quantum deadline.",[14,1224,1226],{"id":1225},"what-this-means-for-chemical-producers","What this means for chemical producers",[19,1228,1229],{},"The practical sequence does not depend on any chemical-specific standard. Build a cryptographic inventory across IT and OT, rank exposure by data shelf life and by how hard a device is to update, and require crypto agility in new equipment tenders so a future algorithm change does not mean replacing hardware mid-lifecycle.",[14,1231,79],{"id":78},[19,1233,1234],{},"ArcQubit treats discovery as the first move, because a producer cannot protect cryptography it cannot see. QuCode builds the inventory across plant and enterprise surfaces, and QuTrust holds the prioritized plan so the work proceeds in a defensible order a NIS2 supervisor can follow.",{"title":8,"searchDepth":84,"depth":84,"links":1236},[1237,1238,1239,1240,1241,1242],{"id":16,"depth":84,"text":17},{"id":1192,"depth":84,"text":1193},{"id":1205,"depth":84,"text":1206},{"id":1215,"depth":84,"text":1216},{"id":1225,"depth":84,"text":1226},{"id":78,"depth":84,"text":79},"2026-07-28","Chemical plant control systems last decades, which makes post-quantum migration hard. Harvest-now risk threatens process data, and NIS2 sets the supervisory frame.",[736],[100,1247],"Chemical",{},"2026-09-01","\u002Fnews\u002Fchemical-sector-post-quantum-ot-systems",[1252,1253,1256,1259],{"label":747,"url":529},{"label":1254,"url":1255},"B. McInnis, \"Empty attestations: OT lacks the tools for cryptographic readiness,\" Dark Reading, Apr. 13, 2026.","https:\u002F\u002Fwww.darkreading.com\u002Fics-ot-security\u002Fot-lacks-tools-cryptographic-readiness",{"label":1257,"url":1258},"N. Gaur and M. Elmore, \"Why pharma and life sciences must act now on the quantum threat,\" World Economic Forum Stories, Sep. 24, 2025.","https:\u002F\u002Fwww.weforum.org\u002Fstories\u002F2025\u002F09\u002Fpharma-life-sciences-quantum-threat-cybersecurity\u002F",{"label":1260,"url":1261},"T. Ruthemann, \"NIS2 directive: What chemical companies need to know,\" Weserland GmbH, Jul. 27, 2026.","https:\u002F\u002Fweserland.eu\u002Fen\u002F2026\u002F07\u002Fnis2-directive-what-chemical-companies-need-to-know\u002F",[1263,1264],{"label":444,"url":525},{"label":536,"url":537},{"title":1182,"description":1244},"Chemical Plants Weigh Post-Quantum Migration","chemical-sector-post-quantum-ot-systems","news\u002Fchemical-sector-post-quantum-ot-systems",[547,546,259,1270,549],"NIS2","Chemical plants run control systems built to last decades, so the post-quantum migration collides with hardware that cannot easily be patched, while harvest-now-decrypt-later threatens long-lived process data and NIS2 sets the audit frame.","6ao6Cr8o8RLF_sB_BL71qbOJxJVE-AasxdmoDLZsz7c",{"id":1274,"title":1275,"author":7,"authorTitle":8,"authorUrl":9,"body":1276,"canonical":9,"category":92,"date":1304,"description":1305,"draft":95,"extension":96,"faqs":1306,"findingsSource":9,"geo":1316,"image":417,"industries":1318,"keyFindings":9,"meta":1319,"modified":1320,"navigation":103,"path":1321,"pullquote":9,"recommendations":9,"references":1322,"related":1326,"seo":1333,"seoTitle":1334,"signposts":9,"slug":1335,"stats":9,"stem":1336,"tags":1337,"tldr":1339,"__hash__":1340},"news\u002Fnews\u002Fhong-kong-banks-score-2-3-quantum-readiness.md","Hong Kong Banks Score 2.3 Out of 10 on Quantum Readiness, HKMA Finds",{"type":11,"value":1277,"toc":1301},[1278,1282,1287,1290,1293,1296],[14,1279,1281],{"id":1280},"hong-kong-banks-score-23-out-of-10-on-quantum-readiness","Hong Kong banks score 2.3 out of 10 on quantum readiness",[19,1283,1284],{},[383,1285,1286],{},"27 JULY 2026, HONG KONG",[19,1288,1289],{},"The Hong Kong Monetary Authority assessed the banking sector's quantum readiness on 27 July 2026 and scored it 2.3 out of 10. The regulator set a target of 10 by 2030 and found that about half of the banks assessed lacked a formal plan. The low score shows the sector sits early in its preparation despite the growing international attention to quantum risk.",[19,1291,1292],{},"The 2030 target gives the score meaning. A target of 10 out of 10 represents full readiness across the dimensions the HKMA measures, so the gap between the current 2.3 and that target maps the scale of work banks must complete over the remaining years. The finding that half the banks lack a formal plan identifies the most basic gap to close first.",[19,1294,1295],{},"A numeric readiness score is a useful supervisory tool. It makes progress measurable and comparable across banks, so both the regulator and each bank can track movement toward the 2030 target. It also makes a lagging bank visible, which creates pressure to act rather than defer, since a low score is harder to explain away than a vague assurance.",[19,1297,1298,1300],{},[383,1299,399],{}," The HKMA has quantified a problem that other regulators describe qualitatively: Hong Kong banks start from 2.3 out of 10 with a 2030 target of 10. The score and target together create clear, measurable pressure. Banks without a formal plan have the most ground to make up, and the ones that build an inventory and roadmap now will show the fastest improvement in future assessments.",{"title":8,"searchDepth":84,"depth":84,"links":1302},[1303],{"id":1280,"depth":84,"text":1281},"2026-07-27","An HKMA assessment in July 2026 scored Hong Kong banks 2.3 out of 10 on quantum readiness, targeting 10 by 2030, with about half lacking a formal plan.",[1307,1310,1313],{"q":1308,"a":1309},"What did the HKMA assessment find?","On 27 July 2026, the Hong Kong Monetary Authority scored the banking sector 2.3 out of 10 on quantum readiness and set a target of 10 by 2030. About half of the banks assessed lacked a formal plan, showing the sector is early in its preparation.",{"q":1311,"a":1312},"What is the 2030 target?","The HKMA set a target score of 10 out of 10 by 2030, meaning full readiness across the dimensions it measures. The gap between the current 2.3 and the 2030 target of 10 signals the scale of work banks must do over the remaining years.",{"q":1314,"a":1315},"Why does a readiness score matter?","A numeric score makes progress measurable and comparable across banks, so the regulator and each bank can track movement toward the 2030 target. It also makes a lagging bank visible, which creates supervisory pressure to close the gap rather than defer the work.",[1317],"hong-kong",[227,100],{},"2026-09-28","\u002Fnews\u002Fhong-kong-banks-score-2-3-quantum-readiness",[1323],{"label":1324,"url":1325},"Hong Kong Monetary Authority, \"Quantum readiness assessment of the banking sector,\" Jul. 27, 2026.","https:\u002F\u002Fwww.hkma.gov.hk\u002Feng\u002F",[1327,1330],{"label":1328,"url":1329},"Swiss FINMA Finds Banks and Insurers Lack Post-Quantum Roadmaps","\u002Fnews\u002Fswiss-finma-banks-lack-pqc-roadmaps",{"label":1331,"url":1332},"G7 Financial-Sector Post-Quantum Roadmap Targets 2030 to 2032","\u002Fnews\u002Fg7-financial-sector-post-quantum-roadmap-2030-2032",{"title":1275,"description":1305},"Hong Kong Banks Score 2.3\u002F10 on Quantum Readiness","hong-kong-banks-score-2-3-quantum-readiness","news\u002Fhong-kong-banks-score-2-3-quantum-readiness",[257,368,132,1338,260],"2030 deadline","An HKMA assessment in July 2026 scored Hong Kong banks 2.3 out of 10 on quantum readiness, set a target of 10 by 2030, and found about half lack a formal plan.","ZAXBZC8PeByMqPjLqBTq2VLxlaKWtukMN2UDvCVVcvM",{"id":1342,"title":1343,"author":7,"authorTitle":8,"authorUrl":9,"body":1344,"canonical":9,"category":220,"date":1407,"description":1408,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":1409,"image":9,"industries":1411,"keyFindings":9,"meta":1412,"modified":733,"navigation":103,"path":1413,"pullquote":9,"recommendations":9,"references":1414,"related":1422,"seo":1426,"seoTitle":1427,"signposts":9,"slug":1428,"stats":9,"stem":1429,"tags":1430,"tldr":1432,"__hash__":1433},"news\u002Fnews\u002Fenergy-grid-ot-post-quantum-2030.md","Grid Operators Face a Decade-Long OT Migration as the EU Sets 2030 for High-Risk Systems",{"type":11,"value":1345,"toc":1399},[1346,1348,1354,1358,1364,1368,1377,1381,1387,1391,1394,1396],[14,1347,17],{"id":16},[19,1349,1350,1351,1353],{},"Grid operators face one of the longest migrations in critical infrastructure, driven by equipment that outlasts the cryptography inside it. The European Commission's coordinated roadmap, as analyzed in current reporting, says high-risk systems, notably critical infrastructure, should move to post-quantum cryptography as soon as possible and no later than 2030, with utilities among the priority sectors ",[23,1352,25],{},". Because substation equipment can run for 20 to 40 years, devices installed today will still be in service when quantum attacks become feasible, which makes the planning horizon a full decade.",[14,1355,1357],{"id":1356},"the-eu-deadline","The EU deadline",[19,1359,1360,1361,1363],{},"Analysis of the EU roadmap says Member States should start the transition by the end of 2026 with national strategies, awareness work and cryptographic inventories, and finish the wider transition for as many systems as feasible by 2035 ",[23,1362,25],{},". That source is secondary analysis rather than the Commission's own text, so treat the dates as reported from the roadmap rather than quoted from it. The direction, though, is consistent across the EU's published materials: inventory and strategy first, high-risk systems by 2030.",[14,1365,1367],{"id":1366},"what-it-means-in-grid-terms","What it means in grid terms",[19,1369,1370,1371,1373,1374,1376],{},"A July 2026 piece from a security consultancy translates the deadline into grid specifics, noting that substation equipment lasts 20 to 40 years, that the DNP3 Secure Authentication version 5 protocol relies on RSA and ECDSA, and that change management for relay firmware can add three to six months for high-impact assets ",[23,1372,29],{},". The same source estimates full operational-technology migration takes a decade while IT-OT boundary and engineering-workstation upgrades can finish in 12 to 24 months, and it recommends requiring algorithm agility in new device tenders from 2026 ",[23,1375,29],{},". Those timelines are the author's estimates in a vendor-authored piece, so weigh them as informed opinion.",[14,1378,1380],{"id":1379},"the-ot-reality","The OT reality",[19,1382,1383,1384,1386],{},"US operational-technology guidance points the same way. Trade coverage of the DHS and CISA paper lists energy among the OT-dependent sectors and stresses slow patch cycles, decades-old equipment and safety testing that resists rapid updates ",[23,1385,63],{},". That coverage summarizes a government document the reporting did not read directly, so it is a secondary account.",[14,1388,1390],{"id":1389},"what-this-means-for-grid-operators","What this means for grid operators",[19,1392,1393],{},"The device lifecycle is the planning fact. Operators should inventory where RSA and ECDSA protect substation and control systems, prioritize assets that will still be in service past 2030, and write algorithm agility into procurement now so the next relay or RTU purchase does not lock in cryptography that cannot change.",[14,1395,79],{"id":78},[19,1397,1398],{},"ArcQubit treats discovery as the first move, because a decade-long migration needs an accurate map before it starts. QuCode builds the cryptographic inventory across grid OT and IT, and QuTrust holds the prioritized plan so the longest-lived assets move first and procurement carries agility requirements forward.",{"title":8,"searchDepth":84,"depth":84,"links":1400},[1401,1402,1403,1404,1405,1406],{"id":16,"depth":84,"text":17},{"id":1356,"depth":84,"text":1357},{"id":1366,"depth":84,"text":1367},{"id":1379,"depth":84,"text":1380},{"id":1389,"depth":84,"text":1390},{"id":78,"depth":84,"text":79},"2026-07-18","The EU roadmap targets 2030 for high-risk critical infrastructure. With substation gear lasting 20-40 years, grid OT migration could take a decade.",[1410],"eu",[100,522],{},"\u002Fnews\u002Fenergy-grid-ot-post-quantum-2030",[1415,1418,1421],{"label":1416,"url":1417},"M. Ivezic, \"EU Commission Roadmap Targets 2030 for Post-Quantum Cryptography Transition,\" PostQuantum.com, Jun. 24, 2025.","https:\u002F\u002Fpostquantum.com\u002Fquantum-policy\u002Feu-pqc-roadmap\u002F",{"label":1419,"url":1420},"S. Vaile, \"Quantum Security for Energy and Utilities: Protecting Operational Technology,\" Quantum Security Defence, Jul. 18, 2026.","https:\u002F\u002Fquantumsecuritydefence.com\u002Finsights\u002Fenergy-utilities-quantum-security-ot\u002F",{"label":747,"url":529},[1423,1424],{"label":444,"url":525},{"label":1425,"url":654},"EU Roadmap Sets 2026, 2030 and 2035 Milestones",{"title":1343,"description":1408},"Grid Faces Decade-Long OT Migration","energy-grid-ot-post-quantum-2030","news\u002Fenergy-grid-ot-post-quantum-2030",[548,547,1431,546,132],"EU PQC roadmap","The EU's coordinated roadmap targets 2030 for high-risk critical infrastructure, and because substation equipment lasts 20 to 40 years, grid operators that install today's cryptography now will still run it when quantum attacks become feasible.","WdcSL0vfmkOavQpQHWWYuGQMAv8hxFDd1OhUaN4V7aA",{"id":1435,"title":1436,"author":7,"authorTitle":8,"authorUrl":9,"body":1437,"canonical":9,"category":220,"date":1503,"description":1504,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":1505,"image":9,"industries":1507,"keyFindings":9,"meta":1508,"modified":1509,"navigation":103,"path":1510,"pullquote":9,"recommendations":9,"references":1511,"related":1521,"seo":1524,"seoTitle":1525,"signposts":9,"slug":1526,"stats":9,"stem":1527,"tags":1528,"tldr":1529,"__hash__":1530},"news\u002Fnews\u002Fcritical-manufacturing-supplier-post-quantum-readiness.md","Manufacturers Told to Quiz Suppliers on Post-Quantum Readiness as OT Lifecycles Stretch Decades",{"type":11,"value":1438,"toc":1495},[1439,1441,1447,1451,1457,1461,1470,1474,1483,1487,1490,1492],[14,1440,17],{"id":16},[19,1442,1443,1444,1446],{},"Manufacturers sit in long supply chains as both buyers of industrial components and suppliers to others, which puts them on both sides of the post-quantum migration. The clearest near-term signal is procurement: on July 16, 2026, the Australian Signals Directorate published guidance to help organizations judge whether their suppliers can move to quantum-resistant cryptography within recommended timeframes ",[23,1445,25],{},". No manufacturing-specific post-quantum study exists in the current reporting, so this picture draws on OT, supply-chain and cross-sector cost sources.",[14,1448,1450],{"id":1449},"vendor-readiness-becomes-a-procurement-question","Vendor readiness becomes a procurement question",[19,1452,1453,1454,1456],{},"The Australian guidance offers vendor-neutral questions for procurement, contract renewals and vendor assessments, and it also helps vendors understand customer expectations and assess their own suppliers ",[23,1455,25],{},". For a manufacturer, that is the practical mechanism by which the migration arrives: not as a single mandate, but as a question that larger customers start asking and that flows down to component suppliers.",[14,1458,1460],{"id":1459},"why-ot-lifecycles-drive-the-urgency","Why OT lifecycles drive the urgency",[19,1462,1463,1464,1466,1467,1469],{},"The Charter of Trust, a global industry body, names operational technology one of four priority areas because system lifecycles run 10 to 40 years or more, and it says manufacturing, energy, utilities and transport depend on systems that are hard to upgrade after deployment ",[23,1465,29],{},". It compares national deadlines clustering around 2030 to 2035 across the US, EU, UK, Australia and Singapore, and offers a six-step playbook from inventory through monitoring ",[23,1468,29],{},". The document carries conflicting dates between its text and filename, so cite the date with care.",[14,1471,1473],{"id":1472},"the-cost-of-waiting","The cost of waiting",[19,1475,1476,1477,1479,1480,1482],{},"Boston Consulting Group estimated in October 2025 that beginning now costs about 2.5 to 5 percent of annual IT budgets, and that waiting could double the bill ",[23,1478,63],{},". It puts the cost of upgrading connected-vehicle hardware and software at roughly 400 to 750 million dollars across global automakers, the closest manufacturing figure in the reporting, and notes that the EU's DORA and NIS2 impose strict encryption expectations on critical sectors ",[23,1481,63],{},". These are a consultancy's estimates, so treat the figures as modeled rather than measured.",[14,1484,1486],{"id":1485},"what-this-means-for-manufacturers","What this means for manufacturers",[19,1488,1489],{},"Act on both roles at once. As a buyer, add post-quantum readiness questions to tenders and renewals using the kind of vendor-neutral checklist the Australian guidance describes. As a supplier, build the cryptographic inventory and crypto agility that your own customers will soon ask you to demonstrate.",[14,1491,79],{"id":78},[19,1493,1494],{},"ArcQubit treats discovery as the foundation for both sides of the chain. QuCode builds the cryptographic inventory across IT and OT, and QuTrust holds the migration plan so a manufacturer can answer a customer's readiness questions and sequence its own long-lifecycle upgrades in a defensible order.",{"title":8,"searchDepth":84,"depth":84,"links":1496},[1497,1498,1499,1500,1501,1502],{"id":16,"depth":84,"text":17},{"id":1449,"depth":84,"text":1450},{"id":1459,"depth":84,"text":1460},{"id":1472,"depth":84,"text":1473},{"id":1485,"depth":84,"text":1486},{"id":78,"depth":84,"text":79},"2026-07-16","Australia's ASD issued vendor-readiness questions for procurement, and industry groups flag 10-40 year OT lifecycles. Manufacturers sit on both sides of the supply chain.",[1506],"canberra",[100,521],{},"2026-09-04","\u002Fnews\u002Fcritical-manufacturing-supplier-post-quantum-readiness",[1512,1515,1518],{"label":1513,"url":1514},"Australian Signals Directorate, \"New guidance helps organisations assess vendor readiness for post-quantum cryptography,\" cyber.gov.au, Jul. 16, 2026.","https:\u002F\u002Fwww.cyber.gov.au\u002Fabout-us\u002Fview-all-content\u002Fnews\u002Fnew-guidance-helps-organisations-assess-vendor-readiness-for-post-quantum-cryptography",{"label":1516,"url":1517},"Charter of Trust PQC Working Group, \"Decrypting the Future: Global Timelines for Post-Quantum Cryptography and Why They Matter,\" Apr. 7, 2026.","https:\u002F\u002Fwww.charteroftrust.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002F20260115_PQC-Decrypting-the-Future_FINAL-1.pdf",{"label":1519,"url":1520},"J.-F. Bobier et al., \"How quantum computing will upend cybersecurity,\" Boston Consulting Group, Oct. 15, 2025.","https:\u002F\u002Fwww.bcg.com\u002Fpublications\u002F2025\u002Fhow-quantum-computing-will-upend-cybersecurity",[1522,1523],{"label":444,"url":525},{"label":539,"url":540},{"title":1436,"description":1504},"Manufacturers Told to Vet Supplier PQC","critical-manufacturing-supplier-post-quantum-readiness","news\u002Fcritical-manufacturing-supplier-post-quantum-readiness",[547,759,546,132,260],"Australia's signals directorate published vendor-readiness questions for procurement, and an industry body names operational technology a priority because system lifecycles run 10 to 40 years, which puts manufacturers on both sides of the supply-chain migration problem.","EKgq0c6Yk1hehHv6oyJI4uSAklS4Uo3_fKLhzPKf88g",{"id":1532,"title":1533,"author":7,"authorTitle":8,"authorUrl":9,"body":1534,"canonical":9,"category":92,"date":1503,"description":1562,"draft":95,"extension":96,"faqs":1563,"findingsSource":9,"geo":1573,"image":417,"industries":1574,"keyFindings":9,"meta":1575,"modified":221,"navigation":103,"path":1576,"pullquote":9,"recommendations":9,"references":1577,"related":1581,"seo":1588,"seoTitle":1589,"signposts":9,"slug":1590,"stats":9,"stem":1591,"tags":1592,"tldr":1593,"__hash__":1594},"news\u002Fnews\u002Fsingapore-csa-final-migration-handbook.md","Singapore CSA Issues a Final Post-Quantum Migration Handbook and Readiness Index",{"type":11,"value":1535,"toc":1559},[1536,1540,1545,1548,1551,1554],[14,1537,1539],{"id":1538},"singapore-csa-issues-a-final-post-quantum-migration-handbook","Singapore CSA issues a final post-quantum migration handbook",[19,1541,1542],{},[383,1543,1544],{},"16 JULY 2026, SINGAPORE",[19,1546,1547],{},"The Cyber Security Agency of Singapore published a final post-quantum migration handbook and a readiness index on 16 July 2026. The documents supersede the October 2025 draft and place particular emphasis on critical information infrastructure. Together they give Singapore's organizations practical migration guidance and a way to measure their progress.",[19,1549,1550],{},"The readiness index is the notable addition. It gives organizations a standard measure of where they stand on post-quantum preparation, so an organization can track its own progress over time. It also lets the agency gauge readiness across the sector, which helps it target support and attention where organizations lag.",[19,1552,1553],{},"The handbook addresses organizations across Singapore, but it prioritises critical information infrastructure operators. Those operators run the systems whose failure would cause the greatest harm, so focusing the migration guidance on their needs first reflects a risk-based approach. Finalising the handbook after a draft period shows the guidance has absorbed feedback before taking its settled form.",[19,1555,1556,1558],{},[383,1557,399],{}," The CSA has moved from draft to final guidance and added a readiness index, giving Singapore's organizations both a method and a measuring stick for post-quantum migration. The emphasis on critical information infrastructure directs the most detailed help to the operators who need it most. Organizations can use the index to benchmark themselves now and follow the handbook to close the gaps it reveals.",{"title":8,"searchDepth":84,"depth":84,"links":1560},[1561],{"id":1538,"depth":84,"text":1539},"Singapore's CSA published a final post-quantum migration handbook and readiness index in July 2026, superseding its 2025 draft, emphasising critical infrastructure.",[1564,1567,1570],{"q":1565,"a":1566},"What did the CSA publish?","On 16 July 2026, the Cyber Security Agency of Singapore published a final post-quantum migration handbook and a readiness index. It supersedes the October 2025 draft and places particular emphasis on critical information infrastructure, giving operators practical migration guidance.",{"q":1568,"a":1569},"What is the readiness index for?","The readiness index gives organizations a way to measure where they stand on post-quantum preparation. A standard measure lets an organization track its own progress and lets the agency gauge sector readiness, which helps target support where it is most needed.",{"q":1571,"a":1572},"Who should use the handbook?","The handbook addresses organizations across Singapore, with critical information infrastructure operators as a priority. Those operators run the systems whose failure would cause the greatest harm, so the handbook focuses its migration guidance on their needs first.",[1153],[419,100],{},"\u002Fnews\u002Fsingapore-csa-final-migration-handbook",[1578],{"label":1579,"url":1580},"Cyber Security Agency of Singapore, \"Post-Quantum Cryptography Migration Handbook and Readiness Index,\" Jul. 16, 2026.","https:\u002F\u002Fwww.csa.gov.sg\u002F",[1582,1585],{"label":1583,"url":1584},"Singapore MAS Advisory Tells Financial Firms to Inventory and Plan","\u002Fnews\u002Fsingapore-mas-advisory-inventory-and-plan",{"label":1586,"url":1587},"Singapore MAS QKD Sandbox Report Favours Post-Quantum Cryptography","\u002Fnews\u002Fsingapore-mas-qkd-sandbox-report",{"title":1533,"description":1562},"Singapore CSA Issues Final PQC Migration Handbook","singapore-csa-final-migration-handbook","news\u002Fsingapore-csa-final-migration-handbook",[132,546,133,368,439],"Singapore's CSA published a final post-quantum migration handbook and readiness index in July 2026, superseding its October 2025 draft, with emphasis on critical information infrastructure.","AxYqBUOGtmPvQSiPLt0GZ0GSGP5h_HWSyf5-Wpahik0",{"id":1596,"title":1597,"author":7,"authorTitle":8,"authorUrl":9,"body":1598,"canonical":9,"category":92,"date":1626,"description":1627,"draft":95,"extension":96,"faqs":1628,"findingsSource":9,"geo":1638,"image":417,"industries":1640,"keyFindings":9,"meta":1641,"modified":339,"navigation":103,"path":1642,"pullquote":9,"recommendations":9,"references":1643,"related":1647,"seo":1653,"seoTitle":1654,"signposts":9,"slug":1655,"stats":9,"stem":1656,"tags":1657,"tldr":1658,"__hash__":1659},"news\u002Fnews\u002Fmalaysia-national-pqc-migration-plan-sandbox.md","Malaysia Launches a National Post-Quantum Migration Plan and Sandbox",{"type":11,"value":1599,"toc":1623},[1600,1604,1609,1612,1615,1618],[14,1601,1603],{"id":1602},"malaysia-launches-a-national-post-quantum-migration-plan-and-sandbox","Malaysia launches a national post-quantum migration plan and sandbox",[19,1605,1606],{},[383,1607,1608],{},"9 JULY 2026, PUTRAJAYA",[19,1610,1611],{},"Malaysia launched a national post-quantum migration plan and a sandbox on 9 July 2026, building on work from November 2025. The plan sets national direction for the transition, while the sandbox gives organizations a space to test post-quantum approaches. The plan does not attach dated deadlines, so it emphasises capability and support over compulsion.",[19,1613,1614],{},"The sandbox is the practical centrepiece. It gives organizations a controlled environment to test post-quantum cryptography before deploying it in production, which surfaces integration and performance issues early. Finding those issues in a sandbox rather than in live systems lowers the risk and cost of migration when organizations move real workloads.",[19,1616,1617],{},"By pairing a plan with a sandbox and holding off on deadlines, Malaysia takes a capability-first approach. It builds the national direction and the testing ground that organizations need, letting them gain experience before any firm timeline arrives. That sequencing suits an early-stage national program that wants adoption grounded in practical readiness.",[19,1619,1620,1622],{},[383,1621,399],{}," Malaysia's plan and sandbox give organizations both direction and a safe place to experiment, without the pressure of a dated deadline yet. The sandbox is the most useful element for practitioners, since testing post-quantum cryptography before production reduces migration risk. Organizations can use it to build hands-on experience now, so they are ready if Malaysia later attaches deadlines to the national plan.",{"title":8,"searchDepth":84,"depth":84,"links":1624},[1625],{"id":1602,"depth":84,"text":1603},"2026-07-09","Malaysia launched a national post-quantum migration plan and a sandbox in July 2026, building on earlier 2025 work, without setting dated deadlines.",[1629,1632,1635],{"q":1630,"a":1631},"What did Malaysia launch?","On 9 July 2026, building on work from November 2025, Malaysia launched a national post-quantum migration plan and a sandbox. The plan sets national direction while the sandbox gives organizations a space to test post-quantum approaches, though it does not attach dated deadlines.",{"q":1633,"a":1634},"What is the sandbox for?","The sandbox gives organizations a controlled environment to test post-quantum cryptography before deploying it in production. Testing in a sandbox surfaces integration and performance issues early, which lowers the risk of problems when organizations migrate real systems.",{"q":1636,"a":1637},"Does Malaysia set a deadline?","No. The plan sets national direction without dated deadlines. It focuses on building capability and providing a testing ground rather than compelling migration by a set date, so organizations get support and guidance ahead of any firm timeline.",[1639],"putrajaya",[419,100],{},"\u002Fnews\u002Fmalaysia-national-pqc-migration-plan-sandbox",[1644],{"label":1645,"url":1646},"Government of Malaysia, \"National post-quantum cryptography migration plan and sandbox,\" Jul. 9, 2026.","https:\u002F\u002Fwww.nacsa.gov.my\u002F",[1648,1650],{"label":1649,"url":1576},"Singapore CSA Issues a Final Post-Quantum Migration Handbook",{"label":1651,"url":1652},"India's MeitY and CERT-In Publish a Quantum Readiness White Paper","\u002Fnews\u002Findia-meity-cert-in-quantum-readiness-white-paper",{"title":1597,"description":1627},"Malaysia Launches a National PQC Plan and Sandbox","malaysia-national-pqc-migration-plan-sandbox","news\u002Fmalaysia-national-pqc-migration-plan-sandbox",[132,368,549,133,439],"Malaysia launched a national post-quantum migration plan and a sandbox in July 2026, building on November 2025 work, without setting dated deadlines.","8nIGlpNOvJaFF-PXFELxhW25-n8eCLCziZntoiJqWFI",{"id":1661,"title":1328,"author":7,"authorTitle":8,"authorUrl":9,"body":1662,"canonical":9,"category":92,"date":1626,"description":1690,"draft":95,"extension":96,"faqs":1691,"findingsSource":9,"geo":1701,"image":417,"industries":1703,"keyFindings":9,"meta":1704,"modified":1320,"navigation":103,"path":1329,"pullquote":9,"recommendations":9,"references":1705,"related":1709,"seo":1714,"seoTitle":1715,"signposts":9,"slug":1716,"stats":9,"stem":1717,"tags":1718,"tldr":1690,"__hash__":1719},"news\u002Fnews\u002Fswiss-finma-banks-lack-pqc-roadmaps.md",{"type":11,"value":1663,"toc":1687},[1664,1668,1673,1676,1679,1682],[14,1665,1667],{"id":1666},"swiss-finma-finds-banks-and-insurers-lack-post-quantum-roadmaps","Swiss FINMA finds banks and insurers lack post-quantum roadmaps",[19,1669,1670],{},[383,1671,1672],{},"9 JULY 2026, BERN",[19,1674,1675],{},"The Swiss Financial Market Supervisory Authority, FINMA, published Guidance 05\u002F2026 on 9 July 2026. The guidance reports a survey of 60 institutions and finds that banks and insurers largely lack post-quantum roadmaps. The result shows the Swiss financial sector sits early in its preparation, even as supervisory attention to quantum risk grows across jurisdictions.",[19,1677,1678],{},"FINMA pairs the finding with a clear recommendation: institutions should build a post-quantum roadmap by mid-2027. That target turns the survey's gap into a corrective step with a date attached. It gives supervised firms a concrete near-term objective, producing a plan, before any question of migrating systems.",[19,1680,1681],{},"The guidance frames post-quantum readiness as part of the risk management FINMA supervises. Because of that framing, supervised banks and insurers should expect FINMA to ask about their roadmap progress against the mid-2027 recommendation. A firm without a roadmap has a visible gap that a supervisor can raise directly.",[19,1683,1684,1686],{},[383,1685,399],{}," FINMA has measured the problem and set a response: most supervised firms lack a roadmap, and they should build one by mid-2027. For Swiss banks and insurers, that recommendation is the near-term expectation to meet. Firms that start cryptographic discovery now will be able to produce a credible roadmap by the target date, rather than scrambling to answer when their supervisor asks.",{"title":8,"searchDepth":84,"depth":84,"links":1688},[1689],{"id":1666,"depth":84,"text":1667},"A July 2026 FINMA review of 60 institutions found banks and insurers lack post-quantum roadmaps, and recommended each build one by mid-2027.",[1692,1695,1698],{"q":1693,"a":1694},"What did FINMA find?","FINMA's Guidance 05\u002F2026, dated 9 July 2026, surveyed 60 institutions and found that banks and insurers largely lack post-quantum roadmaps. The finding shows the Swiss financial sector is early in its preparation despite the growing supervisory attention to quantum risk.",{"q":1696,"a":1697},"What does FINMA recommend?","FINMA recommends that institutions build a post-quantum roadmap by mid-2027. The recommendation gives supervised firms a near-term target to produce a plan, turning the survey's finding of a gap into a concrete corrective step.",{"q":1699,"a":1700},"Does the guidance apply to all Swiss firms?","The guidance addresses the banks and insurers FINMA supervises. It frames post-quantum readiness as part of their risk management, so supervised institutions should expect FINMA to ask about their roadmap progress against the mid-2027 recommendation.",[1702],"bern",[227,100],{},[1706],{"label":1707,"url":1708},"Swiss Financial Market Supervisory Authority (FINMA), \"Guidance 05\u002F2026: Post-quantum cryptography risks,\" Jul. 9, 2026.","https:\u002F\u002Fwww.finma.ch\u002Fen\u002F",[1710,1713],{"label":1711,"url":1712},"ECB Orders Eurozone Banks to Submit AI Cyber Action Plans by 31 October","\u002Fnews\u002Fecb-eurozone-banks-ai-cyber-action-plans-october",{"label":1331,"url":1332},{"title":1328,"description":1690},"Swiss FINMA Finds Banks Lack PQC Roadmaps","swiss-finma-banks-lack-pqc-roadmaps","news\u002Fswiss-finma-banks-lack-pqc-roadmaps",[257,368,132,258,260],"rcoN43aSFclPd0JKGYIStx1ImUKXqjAFnQXvL1qNI7k",{"id":1721,"title":656,"author":7,"authorTitle":8,"authorUrl":9,"body":1722,"canonical":9,"category":220,"date":1785,"description":1786,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":1787,"image":417,"industries":1789,"keyFindings":9,"meta":1790,"modified":1785,"navigation":103,"path":657,"pullquote":9,"recommendations":9,"references":1791,"related":1801,"seo":1804,"seoTitle":1805,"signposts":9,"slug":1806,"stats":9,"stem":1807,"tags":1808,"tldr":1810,"__hash__":1811},"news\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about.md",{"type":11,"value":1723,"toc":1779},[1724,1728,1736,1740,1751,1754,1758,1761,1764,1768],[14,1725,1727],{"id":1726},"the-number-everyone-quotes-is-the-wrong-one","The number everyone quotes is the wrong one",[19,1729,1730,1731,152,1733,1735],{},"Ask a security leader when post-quantum migration is due and most will answer 2035. That date is real, and it is also the least useful one on the calendar. The deadline that governs what your team does this year is not the finish line. It is the starting gun, and two regulators have already fired it. The UK's National Cyber Security Centre expects cryptographic discovery finished by 2028, and the European Union expects Member States to publish national transition roadmaps by 2026 ",[23,1732,25],{},[23,1734,29],{},". Both dates measure the same thing: whether you know where your vulnerable cryptography lives.",[14,1737,1739],{"id":1738},"why-discovery-is-the-real-deadline","Why discovery is the real deadline",[19,1741,1742,1743,1745,1746,1748,1749,171],{},"Every credible migration plan begins with an inventory, because you cannot replace an algorithm you have not found. The NCSC makes this explicit by carving discovery out as its own phase and dating it to 2028, ahead of the high-priority upgrades it expects by 2031 and the full migration it expects by 2035 ",[23,1744,25],{},". The EU roadmap does the same thing from a different angle, requiring national plans by 2026 so that critical infrastructure can hit its 2030 target ",[23,1747,29],{},". NIST reinforces the sequencing in its transition guidance, which treats identifying and prioritizing quantum-vulnerable systems as the work that everything else depends on ",[23,1750,63],{},[19,1752,1753],{},"The reason is practical, not bureaucratic. Discovery is the slowest and least predictable part of the whole program. Vulnerable cryptography hides in source code, in dependencies, in certificates, in infrastructure configuration, in compiled binaries, and in the tokens your services issue at runtime. Teams routinely find that the real exposure lives in surfaces they never scanned, so the inventory takes longer than anyone budgets. If you wait until 2033 to start looking, you will not finish looking in time to migrate.",[14,1755,1757],{"id":1756},"the-trap-of-anchoring-on-2035","The trap of anchoring on 2035",[19,1759,1760],{},"Anchoring on 2035 creates a comfortable illusion of time, and that illusion is expensive. A leader who hears 2035 mentally schedules the work for the early 2030s. A leader who understands that discovery is due in 2028, and that a defensible EU roadmap is due in 2026, schedules the work now. The gap between those two mindsets is the difference between a migration you control and a migration that controls you.",[19,1762,1763],{},"The near-term dates also carry the audit risk. A regulator in 2029 will not ask whether you finished migrating. It will ask whether you know your exposure and whether you have a credible plan. Those are discovery questions, and you either have the inventory to answer them or you do not.",[14,1765,1767],{"id":1766},"start-the-clock-on-your-terms","Start the clock on your terms",[19,1769,1770,1771,1778],{},"Discovery is knowable today, and it is the one part of the program you can complete before any deadline forces you to. ",[1772,1773,1777],"a",{"href":1774,"rel":1775},"https:\u002F\u002Fwww.qutrust.ai\u002F",[1776],"nofollow","QuTrust"," builds your cryptographic inventory across all seven surfaces, classifies each finding by quantum risk, and turns the result into a roadmap you can defend to the NCSC, an EU supervisor, or a U.S. auditor. The finish line is 2035. The starting gun already fired. Run.",{"title":8,"searchDepth":84,"depth":84,"links":1780},[1781,1782,1783,1784],{"id":1726,"depth":84,"text":1727},{"id":1738,"depth":84,"text":1739},{"id":1756,"depth":84,"text":1757},{"id":1766,"depth":84,"text":1767},"2026-07-08","Everyone cites 2035, but the UK NCSC wants cryptographic discovery done by 2028 and the EU wants roadmaps by 2026. Here is why discovery is the real near-term deadline.",[1788,1410],"uk",[100,419],{},[1792,1795,1798],{"label":1793,"url":1794},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC (UK), 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":1796,"url":1797},"European Commission and NIS Cooperation Group, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" Jun. 2025.","https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcoordinated-implementation-roadmap-transition-post-quantum-cryptography",{"label":1799,"url":1800},"National Institute of Standards and Technology, \"NIST IR 8547: Transition to Post-Quantum Cryptography Standards,\" NIST, 2024.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fir\u002F8547\u002Fipd",[1802,1803],{"label":123,"url":124},{"label":653,"url":654},{"title":656,"description":1786},"2028 Is the Post-Quantum Deadline No One Discusses","2028-the-post-quantum-deadline-nobody-is-talking-about","news\u002F2028-the-post-quantum-deadline-nobody-is-talking-about",[133,132,1809,1431,368],"NCSC PQC timelines","While the headlines fixate on 2035, the UK expects cryptographic discovery finished by 2028 and the EU expects national roadmaps by 2026, which makes discovery the deadline that actually starts the clock.","ie2JuhmyKJS3ghp_eQwBQIw3rzfPVwqalclwvy4Ef78",{"id":1813,"title":1711,"author":7,"authorTitle":8,"authorUrl":9,"body":1814,"canonical":9,"category":92,"date":1842,"description":1843,"draft":95,"extension":96,"faqs":1844,"findingsSource":9,"geo":1854,"image":417,"industries":1855,"keyFindings":9,"meta":1856,"modified":339,"navigation":103,"path":1712,"pullquote":9,"recommendations":9,"references":1857,"related":1861,"seo":1866,"seoTitle":1867,"signposts":9,"slug":1868,"stats":9,"stem":1869,"tags":1870,"tldr":1871,"__hash__":1872},"news\u002Fnews\u002Fecb-eurozone-banks-ai-cyber-action-plans-october.md",{"type":11,"value":1815,"toc":1839},[1816,1820,1825,1828,1831,1834],[14,1817,1819],{"id":1818},"ecb-orders-eurozone-banks-to-submit-ai-cyber-action-plans-by-31-october","ECB orders eurozone banks to submit AI cyber action plans by 31 October",[19,1821,1822],{},[383,1823,1824],{},"7 JULY 2026, FRANKFURT",[19,1826,1827],{},"The European Central Bank issued supervisory communication SSM-2026-0301 on 7 July 2026, ordering eurozone banks to submit AI cyber action plans to their Joint Supervisory Teams by 31 October 2026. The communication, associated with Supervisory Board Chair Claudia Buch, builds on DORA and reflects closer supervisory attention to the risks that emerging technology brings to the banking sector.",[19,1829,1830],{},"The order's reach extends past artificial intelligence. The communication closes by saying that post-quantum adoption must start now, and signals that a separate quantum supervisory letter will follow. That pairing tells banks the ECB treats post-quantum readiness as a near-term supervisory concern, not a distant one, even though the October deadline itself applies to the AI cyber plans.",[19,1832,1833],{},"Because the plans go to the Joint Supervisory Teams that oversee each bank, the exercise feeds directly into ongoing supervision. A bank's answer becomes part of how its supervisor judges its technology risk management, so the quality of the plan carries supervisory weight rather than serving as a one-off submission.",[19,1835,1836,1838],{},[383,1837,399],{}," The ECB has tied artificial intelligence and quantum together as supervisory priorities and set a firm October 2026 date for the AI cyber plans. Its statement that post-quantum adoption must start now, plus the promise of a dedicated quantum letter, tells eurozone banks to begin cryptographic discovery and planning without waiting for that letter. Banks that start now will be ready to answer when the quantum-specific expectations arrive.",{"title":8,"searchDepth":84,"depth":84,"links":1840},[1841],{"id":1818,"depth":84,"text":1819},"2026-07-07","The ECB ordered eurozone banks to submit AI cyber action plans to supervisory teams by 31 October 2026, and said post-quantum adoption must start now.",[1845,1848,1851],{"q":1846,"a":1847},"What did the ECB order?","In communication SSM-2026-0301, dated 7 July 2026, the ECB ordered eurozone banks to submit AI cyber action plans to their Joint Supervisory Teams by 31 October 2026. The order builds on DORA and signals closer supervisory attention to emerging technology risk.",{"q":1849,"a":1850},"What did the ECB say about post-quantum cryptography?","The communication closes by saying post-quantum adoption must start now. The ECB also indicated that a separate quantum supervisory letter will follow, so banks should expect dedicated post-quantum expectations beyond the AI cyber action plans due in October.",{"q":1852,"a":1853},"Who signed the communication?","The communication, SSM-2026-0301, is associated with ECB Supervisory Board Chair Claudia Buch. It directs banks to submit their plans to the Joint Supervisory Teams that oversee them under the Single Supervisory Mechanism.",[634],[227,100],{},[1858],{"label":1859,"url":1860},"European Central Bank, \"Supervisory communication SSM-2026-0301,\" ECB Banking Supervision, Jul. 7, 2026.","https:\u002F\u002Fwww.bankingsupervision.europa.eu\u002F",[1862,1865],{"label":1863,"url":1864},"EU DORA Governs Financial Firms' Technology Risk","\u002Fnews\u002Feu-dora-financial-ict-risk-quantum",{"label":1331,"url":1332},{"title":1711,"description":1843},"ECB Orders Eurozone Banks' AI Cyber Plans by Oct 31","ecb-eurozone-banks-ai-cyber-action-plans-october","news\u002Fecb-eurozone-banks-ai-cyber-action-plans-october",[257,663,368,134,260],"The ECB ordered eurozone banks to submit AI cyber action plans to their supervisory teams by 31 October 2026, and said post-quantum adoption must start now.","P7h4BmIUqee34AjmHWVJxqJByFlN9y-f_nGVvAh2Zhs",{"id":1874,"title":1875,"author":7,"authorTitle":8,"authorUrl":9,"body":1876,"canonical":9,"category":92,"date":1904,"description":1905,"draft":95,"extension":96,"faqs":1906,"findingsSource":9,"geo":1916,"image":417,"industries":1918,"keyFindings":9,"meta":1919,"modified":1920,"navigation":103,"path":1921,"pullquote":9,"recommendations":9,"references":1922,"related":1926,"seo":1933,"seoTitle":1934,"signposts":9,"slug":1935,"stats":9,"stem":1936,"tags":1937,"tldr":1938,"__hash__":1939},"news\u002Fnews\u002Fmexico-biometric-bank-rules-2026.md","Mexico Sets Biometric Bank Rules With Late-2026 Compliance",{"type":11,"value":1877,"toc":1901},[1878,1882,1887,1890,1893,1896],[14,1879,1881],{"id":1880},"mexico-sets-biometric-bank-rules-with-late-2026-compliance","Mexico sets biometric bank rules with late-2026 compliance",[19,1883,1884],{},[383,1885,1886],{},"1 JULY 2026, MEXICO CITY",[19,1888,1889],{},"Mexico set biometric bank rules through Annex 71, effective 1 July 2026, requiring banks to handle biometric data such as face and fingerprint with isolated encrypted storage. Compliance falls due around October or November 2026. The rules address how banks protect biometric data; they are not a post-quantum instrument and do not mandate quantum-resistant algorithms.",[19,1891,1892],{},"The focus is on encryption and isolation rather than specific algorithms. By requiring isolated encrypted storage, the rules raise the protection around biometric data without dictating which cryptography banks use. That leaves post-quantum obligations unchanged, so the rules neither require nor preclude quantum-resistant algorithms for the data they cover.",[19,1894,1895],{},"The nature of the data still connects to quantum concerns. Biometric data is highly sensitive and effectively permanent, since a person cannot change their fingerprint or face. That makes it a strong candidate for harvest-now-decrypt-later worries, where long-lived data recorded today could be decrypted later. The rules protect exactly the kind of data that benefits from quantum-resistant encryption over time.",[19,1897,1898,1900],{},[383,1899,399],{}," Mexico's biometric rules tighten how banks store sensitive personal data, with compliance due in late 2026, but they stop short of requiring post-quantum cryptography. Because biometric data is permanent and highly sensitive, it is a prime target for harvest-now-decrypt-later. Banks meeting the encryption requirement can reasonably look ahead to quantum-resistant algorithms for this data, even though the rules do not yet demand them.",{"title":8,"searchDepth":84,"depth":84,"links":1902},[1903],{"id":1880,"depth":84,"text":1881},"2026-07-01","Mexico set biometric bank rules in July 2026 requiring isolated encrypted storage of face and fingerprint data, with compliance due around late 2026.",[1907,1910,1913],{"q":1908,"a":1909},"What do Mexico's biometric bank rules require?","The rules, in Annex 71 effective 1 July 2026, require banks to handle biometric data such as face and fingerprint with isolated encrypted storage. Compliance is due around October or November 2026. The rules are not a post-quantum instrument.",{"q":1911,"a":1912},"Are these rules about post-quantum cryptography?","No. The rules address biometric data handling and encryption, not post-quantum migration specifically. They require encrypted storage without mandating quantum-resistant algorithms, so they do not change post-quantum obligations.",{"q":1914,"a":1915},"How do biometric encryption rules relate to quantum risk?","Biometric data is highly sensitive and long-lived, which makes it a strong candidate for harvest-now-decrypt-later concerns. Although the rules do not require post-quantum cryptography, the data they protect is exactly the kind that benefits from quantum-resistant encryption over time.",[1917],"mexico-city",[227,100],{},"2026-09-24","\u002Fnews\u002Fmexico-biometric-bank-rules-2026",[1923],{"label":1924,"url":1925},"Comisión Nacional Bancaria y de Valores, \"Annex 71 on biometric data handling,\" Jul. 1, 2026.","https:\u002F\u002Fwww.gob.mx\u002Fcnbv",[1927,1930],{"label":1928,"url":1929},"Bank of Israel Orders Banks to Submit Quantum Preparedness Plans","\u002Fnews\u002Fbank-of-israel-orders-quantum-preparedness-plans",{"label":1931,"url":1932},"Colombia's Supervisor Flags Quantum Among Emerging Risks","\u002Fnews\u002Fcolombia-supervisor-flags-quantum-risk",{"title":1875,"description":1905},"Mexico Sets Biometric Bank Rules for Late 2026","mexico-biometric-bank-rules-2026","news\u002Fmexico-biometric-bank-rules-2026",[257,134,258,368,260],"Mexico set biometric bank rules in July 2026 requiring isolated encrypted storage of face and fingerprint data, with compliance due around late 2026; the rules are not post-quantum.","BSj69rvCGZ3hhGRipiBTk-rbmsS7Q1ClprYYOhwW8Bw",{"id":1941,"title":1942,"author":7,"authorTitle":8,"authorUrl":9,"body":1943,"canonical":9,"category":92,"date":1904,"description":1971,"draft":95,"extension":96,"faqs":1972,"findingsSource":9,"geo":1982,"image":417,"industries":1983,"keyFindings":9,"meta":1984,"modified":1985,"navigation":103,"path":1986,"pullquote":9,"recommendations":9,"references":1987,"related":1991,"seo":1996,"seoTitle":1997,"signposts":9,"slug":1998,"stats":9,"stem":1999,"tags":2000,"tldr":2001,"__hash__":2002},"news\u002Fnews\u002Fpentagon-cmmc-nist-sp-800-171-rev-3.md","Pentagon CMMC Moves to NIST SP 800-171 Revision 3, With Post-Quantum Requirements to Follow",{"type":11,"value":1944,"toc":1968},[1945,1949,1954,1957,1960,1963],[14,1946,1948],{"id":1947},"pentagon-cmmc-moves-to-nist-sp-800-171-revision-3","Pentagon CMMC moves to NIST SP 800-171 Revision 3",[19,1950,1951],{},[383,1952,1953],{},"1 JULY 2026, WASHINGTON",[19,1955,1956],{},"The Department of Defense is updating the Cybersecurity Maturity Model Certification program to align with NIST SP 800-171 Revision 3. The rulemaking carries RIN 0790-AM01, and the department targeted a July 2026 interim final rule. An interim final rule can take effect before its comment period closes, so defense contractors should watch for the published date rather than wait for a final rule.",[19,1958,1959],{},"SP 800-171 Revision 3 is a general security-controls baseline, not a post-quantum instrument. The alignment updates the controls that defense contractors must meet to protect controlled unclassified information. On its own, the move does not require quantum-resistant cryptography.",[19,1961,1962],{},"The department has said separately that CMMC must add post-quantum requirements. That signals a later step rather than part of the Revision 3 alignment, and it fits the broader defense timeline that requires systems to support post-quantum cryptography by the end of 2030. Contractors reading the Revision 3 changes should therefore expect post-quantum controls to appear in a future CMMC update.",[19,1964,1965,1967],{},[383,1966,399],{}," CMMC decides who can win defense work, so changes to its control baseline reach the whole defense industrial base. The Revision 3 alignment is a security update now, but the department's statement that CMMC must add post-quantum requirements tells contractors where the program is heading. Organizations that fold a cryptographic inventory into their CMMC preparation will be ready when post-quantum controls follow.",{"title":8,"searchDepth":84,"depth":84,"links":1969},[1970],{"id":1947,"depth":84,"text":1948},"The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 via a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.",[1973,1976,1979],{"q":1974,"a":1975},"Is CMMC a post-quantum requirement?","Not yet. The update aligns CMMC with NIST SP 800-171 Revision 3, which is a general security-controls baseline rather than a post-quantum instrument. The Department of Defense has said CMMC must add post-quantum requirements in a later step.",{"q":1977,"a":1978},"When does the Revision 3 alignment take effect?","The Department of Defense targeted a July 2026 interim final rule under RIN 0790-AM01. An interim final rule can take effect before the comment period closes, so defense contractors should track the published date rather than wait for a final rule.",{"q":1980,"a":1981},"Who does CMMC affect?","CMMC applies to the defense industrial base, the contractors and subcontractors that handle controlled unclassified information for the Department of Defense. The move to Revision 3 updates the security controls those organizations must meet to win and keep defense work.",[342],[101,100],{},"2026-09-23","\u002Fnews\u002Fpentagon-cmmc-nist-sp-800-171-rev-3",[1988],{"label":1989,"url":1990},"U.S. Department of Defense, \"Cybersecurity Maturity Model Certification Program,\" rulemaking RIN 0790-AM01, targeted interim final rule, 2026.","https:\u002F\u002Fwww.reginfo.gov\u002Fpublic\u002Fdo\u002FeAgendaViewRule?RIN=0790-AM01",[1992,1993],{"label":429,"url":430},{"label":1994,"url":1995},"Executive Order 14412 Directs Post-Quantum Contractor Rules Under the FAR by 2030","\u002Fnews\u002Feo-14412-contractor-far-rules-2030",{"title":1942,"description":1971},"Pentagon CMMC Moves to NIST SP 800-171 Rev. 3","pentagon-cmmc-nist-sp-800-171-rev-3","news\u002Fpentagon-cmmc-nist-sp-800-171-rev-3",[130,134,438,759,439],"The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 through a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.","zfHbwJLGPQYp5Ewj8vJQQZxb4gaVp_kmHw-D-5lzj2g",{"id":2004,"title":2005,"author":7,"authorTitle":8,"authorUrl":9,"body":2006,"canonical":9,"category":92,"date":1904,"description":2034,"draft":95,"extension":96,"faqs":2035,"findingsSource":9,"geo":2045,"image":417,"industries":2047,"keyFindings":9,"meta":2048,"modified":1320,"navigation":103,"path":2049,"pullquote":9,"recommendations":9,"references":2050,"related":2054,"seo":2059,"seoTitle":2060,"signposts":9,"slug":2061,"stats":9,"stem":2062,"tags":2063,"tldr":2064,"__hash__":2065},"news\u002Fnews\u002Fswift-cscf-2026-no-mandatory-pq-control.md","Swift's CSCF 2026 Adds No Mandatory Post-Quantum Control",{"type":11,"value":2007,"toc":2031},[2008,2012,2017,2020,2023,2026],[14,2009,2011],{"id":2010},"swifts-cscf-2026-adds-no-mandatory-post-quantum-control","Swift's CSCF 2026 adds no mandatory post-quantum control",[19,2013,2014],{},[383,2015,2016],{},"1 JULY 2026, LA HULPE",[19,2018,2019],{},"Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, according to analysis of the framework. Quantum readiness therefore remains outside the framework's required controls for this cycle, so Swift users face no obligation to meet a post-quantum control through the CSCF yet.",[19,2021,2022],{},"The CSCF matters because of its reach. It sets security controls that Swift users must meet, forming a baseline across the global messaging network that connects a large share of the world's financial institutions. When the CSCF mandates a control, that control propagates widely, which is exactly why the absence of a post-quantum control draws attention.",[19,2024,2025],{},"That absence does not remove the underlying risk. Other supervisors already expect financial institutions to act on quantum, and projects like the BIS Innovation Hub's Project Leap show the sector testing post-quantum cryptography in live systems. Swift users should continue their own planning rather than read the framework's silence as permission to defer.",[19,2027,2028,2030],{},[383,2029,399],{}," The CSCF 2026 leaves post-quantum readiness as a user responsibility rather than a mandated control, so Swift users cannot rely on the framework to drive their migration this year. Given the risk and the expectations other supervisors set, institutions should keep advancing their own post-quantum work. Watching future CSCF cycles is worthwhile, since a mandated control would quickly reach the whole network when it arrives.",{"title":8,"searchDepth":84,"depth":84,"links":2032},[2033],{"id":2010,"depth":84,"text":2011},"Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, leaving quantum readiness outside the required controls for now.",[2036,2039,2042],{"q":2037,"a":2038},"Does Swift's CSCF 2026 require post-quantum controls?","No. According to analysis of the framework, the Customer Security Controls Framework for 2026 adds no mandatory post-quantum control. Quantum readiness therefore sits outside the framework's required controls for now, so Swift users are not obliged to meet a PQ control through the CSCF this cycle.",{"q":2040,"a":2041},"What does the CSCF do?","The CSCF sets security controls that Swift users must meet, forming a baseline across the global messaging network. Because so many financial institutions connect to Swift, the controls it mandates have wide reach, which is why the absence of a PQ control is notable.",{"q":2043,"a":2044},"Should Swift users wait on post-quantum work?","No. The absence of a mandatory CSCF control does not remove the underlying quantum risk, and other supervisors already expect action. Swift users should continue their own post-quantum planning rather than treat the framework's silence as a reason to defer.",[2046],"la-hulpe",[227,228],{},"\u002Fnews\u002Fswift-cscf-2026-no-mandatory-pq-control",[2051],{"label":2052,"url":2053},"SWIFT, \"Customer Security Controls Framework (CSCF) v2026,\" Jul. 2026.","https:\u002F\u002Fwww.swift.com\u002Fmyswift\u002Fcustomer-security-programme-csp",[2055,2058],{"label":2056,"url":2057},"Project Leap Tests Post-Quantum Signatures in Live Payment Systems","\u002Fnews\u002Fproject-leap-tests-pq-signatures-payments",{"label":1331,"url":1332},{"title":2005,"description":2034},"Swift CSCF 2026 Adds No Mandatory PQ Control","swift-cscf-2026-no-mandatory-pq-control","news\u002Fswift-cscf-2026-no-mandatory-pq-control",[257,134,368,258,260],"Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, so quantum readiness remains outside the framework's required controls for now.","-DWxZfN3crTVRt5CdMOvGPxi2X_5RVtRQlL-et620rM",{"id":2067,"title":2068,"author":7,"authorTitle":8,"authorUrl":9,"body":2069,"canonical":9,"category":220,"date":1904,"description":2136,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":2137,"image":417,"industries":2138,"keyFindings":9,"meta":2139,"modified":421,"navigation":103,"path":654,"pullquote":9,"recommendations":9,"references":2140,"related":2146,"seo":2151,"seoTitle":2152,"signposts":9,"slug":2153,"stats":9,"stem":2154,"tags":2155,"tldr":2158,"__hash__":2159},"news\u002Fnews\u002Fus-uk-eu-post-quantum-deadlines-aligned.md","One Clock, Three Jurisdictions: How the U.S., UK, and EU Post-Quantum Deadlines Line Up",{"type":11,"value":2070,"toc":2130},[2071,2075,2078,2082,2091,2100,2109,2113,2116,2119,2123],[14,2072,2074],{"id":2073},"three-governments-one-window","Three governments, one window",[19,2076,2077],{},"For years, teams treated post-quantum migration as an American problem with a distant 2035 date. That framing no longer holds. The United States, the United Kingdom, and the European Union have each published concrete timelines, and they converge on the same window of 2030 to 2035. A multinational enterprise does not face three separate programs. It faces one overlapping clock, and the earliest milestone on that clock now sits inside this decade.",[14,2079,2081],{"id":2080},"how-the-three-timelines-line-up","How the three timelines line up",[19,2083,2084,2087,2088,2090],{},[383,2085,2086],{},"The United States"," moved first and hardest. Executive Order 14412 requires post-quantum key establishment on high-impact federal systems by 2030 and digital signatures by 2031, and it extends a 2030 date to covered contractors through federal acquisition rules ",[23,2089,25],{},". The contractor clause reaches the commercial supply chain, so the American date behaves like a market standard rather than a government-only rule.",[19,2092,2093,2096,2097,2099],{},[383,2094,2095],{},"The United Kingdom"," set a three-phase path through its National Cyber Security Centre. Organizations should complete cryptographic discovery and a migration plan by 2028, finish high-priority upgrades by 2031, and complete migration by 2035 ",[23,2098,29],{},". The NCSC frames discovery as the first hard milestone, not a preliminary step.",[19,2101,2102,2105,2106,2108],{},[383,2103,2104],{},"The European Union"," published a coordinated roadmap through the NIS Cooperation Group. Member States should take first steps and set initial national roadmaps by 2026, secure critical infrastructure by 2030, and complete the transition by 2035 ",[23,2107,63],{},". The roadmap ties directly to NIS2 and to the financial-sector resilience rules under DORA, which pulls regulated industries onto the same schedule.",[14,2110,2112],{"id":2111},"what-the-alignment-means-for-enterprises","What the alignment means for enterprises",[19,2114,2115],{},"The convergence is good news disguised as bad news. Because the three regimes point at the same cryptographic problem and the same replacement standards, the discovery work you do once satisfies all of them. You do not run a separate inventory for Washington, London, and Brussels. You build one complete cryptographic inventory, map each finding to the post-quantum standards, and then report against whichever regulator asks.",[19,2117,2118],{},"The trap is treating the deadlines as far away because 2035 anchors the conversation. The binding near-term dates already landed. U.S. federal civilian systems answer to 2030, UK organizations answer to a 2028 discovery milestone, and EU Member States answer to 2026 for their first steps and initial national roadmaps. A migration of this scale takes years, so the enterprises that start discovery now will meet every one of these dates from the same body of work.",[14,2120,2122],{"id":2121},"one-inventory-every-jurisdiction","One inventory, every jurisdiction",[19,2124,2125,2126,2129],{},"This is exactly why ",[1772,2127,1777],{"href":1774,"rel":2128},[1776]," builds a single cryptographic inventory across all seven surfaces and maps every finding to the standards each regulator recognizes. One analysis, one roadmap, and evidence you can hand to a U.S. auditor, a UK regulator, or an EU supervisor without translating it three times. The clock is one clock. Your migration should be one program.",{"title":8,"searchDepth":84,"depth":84,"links":2131},[2132,2133,2134,2135],{"id":2073,"depth":84,"text":2074},{"id":2080,"depth":84,"text":2081},{"id":2111,"depth":84,"text":2112},{"id":2121,"depth":84,"text":2122},"The U.S. (EO 14412), UK (NCSC), and the EU roadmap now set post-quantum deadlines converging on 2030 to 2035. Here is how the three timelines line up for enterprises.",[736,1788,1410],[100,419,227],{},[2141,2144,2145],{"label":2142,"url":2143},"The White House, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, Washington, DC, USA, Jun. 22, 2026.","https:\u002F\u002Fwww.whitehouse.gov\u002Fpresidential-actions\u002F2026\u002F06\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks\u002F",{"label":1793,"url":1794},{"label":1796,"url":1797},[2147,2148,2149],{"label":123,"url":124},{"label":656,"url":657},{"label":2150,"url":121},"Global Post-Quantum Mandates and Deadlines: US, EU, UK, Canada, Australia",{"title":2068,"description":2136},"U.S., UK, and EU Post-Quantum Deadlines Aligned","us-uk-eu-post-quantum-deadlines-aligned","news\u002Fus-uk-eu-post-quantum-deadlines-aligned",[132,2156,1809,1431,2157,368],"EO 14412","2035 deadline","The U.S., UK, and EU have set post-quantum deadlines that converge between 2030 and 2035, so a multinational enterprise faces one overlapping clock rather than three separate programs.","kC32WqV_ui7YvC99oGkIQ0G73iSbPNkyWJVuW8OJKis",{"id":2161,"title":2162,"author":7,"authorTitle":8,"authorUrl":9,"body":2163,"canonical":9,"category":92,"date":2191,"description":2192,"draft":95,"extension":96,"faqs":2193,"findingsSource":9,"geo":2203,"image":417,"industries":2205,"keyFindings":9,"meta":2206,"modified":421,"navigation":103,"path":2207,"pullquote":9,"recommendations":9,"references":2208,"related":2212,"seo":2219,"seoTitle":2220,"signposts":9,"slug":2221,"stats":9,"stem":2222,"tags":2223,"tldr":2224,"__hash__":2225},"news\u002Fnews\u002Fbermuda-digital-asset-licensees-grow-to-49.md","Bermuda's Digital Asset Licensees Grow to 49 Under Binding Cyber Rules",{"type":11,"value":2164,"toc":2188},[2165,2169,2174,2177,2180,2183],[14,2166,2168],{"id":2167},"bermudas-digital-asset-licensees-grow-to-49-under-binding-cyber-rules","Bermuda's digital asset licensees grow to 49 under binding cyber rules",[19,2170,2171],{},[383,2172,2173],{},"26 JUNE 2026, HAMILTON",[19,2175,2176],{},"Bermuda had 49 digital asset licensees as of 26 June 2026, a growing roster operating under binding cyber-risk and custody rules. Those rules make cryptographic security a supervised matter for the firms rather than an optional practice, since the Bermuda Monetary Authority oversees how licensees manage cyber-risk and safeguard the assets they hold.",[19,2178,2179],{},"Custody rules are where cryptography sits most directly. They govern how firms protect the digital assets in their care, and that protection depends on cryptographic keys and algorithms. By supervising custody, Bermuda brings the cryptography behind asset safekeeping into regulatory scope, so a weakness there becomes a supervisory concern, not just a technical one.",[19,2181,2182],{},"That scope gives quantum risk a regulatory home. Digital assets rely on cryptography for custody and transactions, so quantum-vulnerable algorithms pose a direct threat to the assets licensees hold. Because Bermuda already supervises cyber-risk and custody, its licensees have a clear basis to account for quantum risk within rules they must already follow.",[19,2184,2185,2187],{},[383,2186,399],{}," Bermuda's growing roster of 49 digital asset licensees operates under binding rules that already cover the cryptography protecting customer assets. That gives quantum risk a supervisory anchor, since custody and cyber-risk obligations extend naturally to the threat quantum computers pose to cryptographic keys. Licensees that fold quantum into their cyber-risk and custody practices align with rules they are already bound to meet.",{"title":8,"searchDepth":84,"depth":84,"links":2189},[2190],{"id":2167,"depth":84,"text":2168},"2026-06-26","Bermuda's digital asset licensees grew to 49 by June 2026, under binding cyber-risk and custody rules that make cryptographic security a supervised matter.",[2194,2197,2200],{"q":2195,"a":2196},"How many digital asset licensees does Bermuda have?","As of 26 June 2026, Bermuda had 49 digital asset licensees. They operate under binding cyber-risk and custody rules, so cryptographic security is a supervised matter for them rather than an optional practice.",{"q":2198,"a":2199},"What do Bermuda's binding rules cover?","The rules cover cyber-risk and custody for digital asset businesses. Custody rules govern how firms safeguard the assets they hold, which depends heavily on cryptography, so the rules bring cryptographic security into the scope of supervision.",{"q":2201,"a":2202},"Why does this matter for post-quantum readiness?","Digital assets rely on cryptography for custody and transactions, so quantum-vulnerable algorithms are a direct risk. Because Bermuda supervises cyber-risk and custody, its licensees have a regulatory reason to account for quantum risk in how they protect assets.",[2204],"hamilton",[227,100],{},"\u002Fnews\u002Fbermuda-digital-asset-licensees-grow-to-49",[2209],{"label":2210,"url":2211},"Bermuda Monetary Authority, \"Digital asset business licensees update,\" Jun. 26, 2026.","https:\u002F\u002Fwww.bma.bm\u002F",[2213,2216],{"label":2214,"url":2215},"Cayman Moves Virtual Asset Service Providers to Licensing","\u002Fnews\u002Fcayman-moves-vasps-to-licensing",{"label":2217,"url":2218},"The Bahamas DARE Act 2024 Regulates Digital Assets","\u002Fnews\u002Fbahamas-dare-act-2024-digital-assets",{"title":2162,"description":2192},"Bermuda Digital Asset Licensees Grow to 49","bermuda-digital-asset-licensees-grow-to-49","news\u002Fbermuda-digital-asset-licensees-grow-to-49",[256,257,258,368,260],"Bermuda's digital asset licensees grew to 49 by June 2026, operating under binding cyber-risk and custody rules that make cryptographic security a supervised matter.","WMOxFRCOWRTQpZM8dsKUBohGl1GZhxTYqcdYZYDzsQk",{"id":2227,"title":2228,"author":7,"authorTitle":8,"authorUrl":9,"body":2229,"canonical":9,"category":92,"date":2257,"description":2258,"draft":95,"extension":96,"faqs":2259,"findingsSource":9,"geo":2269,"image":417,"industries":2271,"keyFindings":9,"meta":2272,"modified":1985,"navigation":103,"path":2273,"pullquote":9,"recommendations":9,"references":2274,"related":2278,"seo":2283,"seoTitle":2284,"signposts":9,"slug":2285,"stats":9,"stem":2286,"tags":2287,"tldr":2288,"__hash__":2289},"news\u002Fnews\u002Faustralia-apra-signals-tougher-quantum-supervision.md","Australia's APRA Signals Tougher Quantum Supervision for Financial Firms",{"type":11,"value":2230,"toc":2254},[2231,2235,2240,2243,2246,2249],[14,2232,2234],{"id":2233},"australias-apra-signals-tougher-quantum-supervision","Australia's APRA signals tougher quantum supervision",[19,2236,2237],{},[383,2238,2239],{},"24 JUNE 2026, SYDNEY",[19,2241,2242],{},"The Australian Prudential Regulation Authority signalled tougher quantum supervision on 24 June 2026. It told regulated financial firms to map their cryptographic dependencies, including those of third parties. Rather than issue a new quantum-specific rule, APRA uses its existing prudential standards CPS 234 and CPS 230 as the hooks for the expectation.",[19,2244,2245],{},"Those two standards already bind regulated firms. CPS 234 covers information security and CPS 230 covers operational risk, so APRA can supervise quantum readiness through them without waiting for a dedicated regulation. This mirrors how other supervisors, such as those using DORA in Europe, anchor cryptographic expectations in standing operational-resilience rules.",[19,2247,2248],{},"The emphasis on third parties is deliberate. A firm's cryptographic risk extends to the vendors and services it relies on, so mapping only internal systems would miss exposure that sits with external providers. Because financial firms depend heavily on third parties for critical functions, APRA wants that dependency chain included in the cryptographic picture.",[19,2250,2251,2253],{},[383,2252,399],{}," APRA has put quantum readiness squarely inside its existing supervision, using CPS 234 and CPS 230 so firms cannot treat it as a future concern without a current hook. The focus on third-party dependencies means a firm's inventory must reach beyond its own systems. Regulated firms that map their full cryptographic footprint, vendors included, will be ready to answer APRA's questions as supervision tightens.",{"title":8,"searchDepth":84,"depth":84,"links":2255},[2256],{"id":2233,"depth":84,"text":2234},"2026-06-24","Australia's APRA signalled tougher quantum supervision in June 2026, telling firms to map cryptographic dependencies including third parties, via CPS 234 and 230.",[2260,2263,2266],{"q":2261,"a":2262},"What did APRA signal?","On 24 June 2026, APRA signalled tougher quantum supervision, telling regulated financial firms to map their cryptographic dependencies, including those of third parties. It uses existing prudential standards CPS 234 and CPS 230 as the hooks rather than issuing a new quantum-specific rule.",{"q":2264,"a":2265},"Which standards does APRA use as hooks?","APRA points to CPS 234, its information security standard, and CPS 230, its operational risk standard. Both already apply to regulated firms, so APRA can supervise quantum readiness through them without waiting for a dedicated quantum regulation.",{"q":2267,"a":2268},"Why map third-party dependencies?","A firm's cryptographic risk extends to the vendors and services it relies on, so mapping only internal systems misses exposure that sits with third parties. APRA's emphasis on third parties reflects how much financial firms depend on external providers for critical functions.",[2270],"sydney",[227,100],{},"\u002Fnews\u002Faustralia-apra-signals-tougher-quantum-supervision",[2275],{"label":2276,"url":2277},"Australian Prudential Regulation Authority, \"Supervisory statement on quantum computing risk,\" Jun. 24, 2026.","https:\u002F\u002Fwww.apra.gov.au\u002F",[2279,2282],{"label":2280,"url":2281},"Australia's ASD Sets End-2026, End-2028 and End-2030 Planning Milestones","\u002Fnews\u002Faustralia-asd-latice-planning-guidance",{"label":1328,"url":1329},{"title":2228,"description":2258},"Australia's APRA Signals Tougher Quantum Supervision","australia-apra-signals-tougher-quantum-supervision","news\u002Faustralia-apra-signals-tougher-quantum-supervision",[257,133,759,368,260],"Australia's APRA signalled tougher quantum supervision in June 2026, telling firms to map cryptographic dependencies including third parties, using CPS 234 and CPS 230 as hooks.","ISEe3M99g0JoPB0UA0yWAbn2utPQWQYEHlALkbpsvGU",{"id":2291,"title":2292,"author":7,"authorTitle":8,"authorUrl":9,"body":2293,"canonical":9,"category":92,"date":2257,"description":2324,"draft":95,"extension":96,"faqs":2325,"findingsSource":9,"geo":2332,"image":417,"industries":2333,"keyFindings":9,"meta":2334,"modified":2335,"navigation":103,"path":2336,"pullquote":9,"recommendations":9,"references":2337,"related":2347,"seo":2353,"seoTitle":2354,"signposts":9,"slug":2355,"stats":9,"stem":2356,"tags":2357,"tldr":2358,"__hash__":2359},"news\u002Fnews\u002Fomb-m-26-15-120-day-pqc-plans.md","OMB Gives Agencies 120 Days to Submit Post-Quantum Migration Plans",{"type":11,"value":2294,"toc":2321},[2295,2299,2304,2307,2310,2313,2316],[14,2296,2298],{"id":2297},"omb-gives-agencies-120-days-to-submit-post-quantum-migration-plans","OMB gives agencies 120 days to submit post-quantum migration plans",[19,2300,2301],{},[383,2302,2303],{},"24 JUNE 2026, WASHINGTON",[19,2305,2306],{},"OMB issued memorandum M-26-15, \"Execution of the Migration to Post-Quantum Cryptography,\" two days after Executive Order 14412. HSToday reports it was signed by OMB Director Russell Vought and serves as the operational roadmap that follows the order. It applies to civilian executive agencies.",[19,2308,2309],{},"HSToday says the memorandum covers approved algorithms, hybrid architectures (which combine a classical and a post-quantum algorithm), crypto agility and integration of post-quantum cryptography into zero trust, a security model that trusts no user or system by default.",[19,2311,2312],{},"Agencies must submit migration plans to OMB and the Office of the National Cyber Director within 120 days, about 22 October 2026. As of 2 October 2026 the plan deadline had not yet passed.",[19,2314,2315],{},"OpenSSL Corporation says the memorandum emphasizes folding post-quantum work into existing cloud and hardware refresh cycles and that agencies were to name migration leads by late July 2026. GovCIO Media reported on 19 June 2026, before issuance, that implementation was uneven across agencies.",[19,2317,2318,2320],{},[383,2319,399],{}," The 22 October 2026 plan deadline is the nearest dated step in the federal migration. Vendors to civilian agencies should expect requests for roadmaps and technical details in the weeks before and after it. The emphasis on existing refresh cycles suggests organizations can reduce cost by timing post-quantum upgrades to planned hardware and cloud renewals.",{"title":8,"searchDepth":84,"depth":84,"links":2322},[2323],{"id":2297,"depth":84,"text":2298},"OMB M-26-15 gives civilian agencies 120 days, about 22 October 2026, to submit post-quantum migration plans. Vendors should expect roadmap requests.",[2326,2329],{"q":2327,"a":2328},"Had the plan deadline passed?","Not as of 2 October 2026. The 120-day deadline falls around 22 October 2026, so it is the nearest dated step in the federal migration.",{"q":2330,"a":2331},"How can organizations cut migration cost?","OpenSSL Corporation says the memorandum emphasizes folding post-quantum work into existing cloud and hardware refresh cycles. Timing upgrades to planned renewals can reduce cost, and vendors to civilian agencies should expect roadmap requests.",[342],[100,419],{},"2026-09-25","\u002Fnews\u002Fomb-m-26-15-120-day-pqc-plans",[2338,2341,2344],{"label":2339,"url":2340},"HSToday, \"OMB Issues Federal Roadmap for Post-Quantum Cryptography Migration,\" Jun. 2026.","https:\u002F\u002Fwww.hstoday.us\u002Fsubject-matter-areas\u002Fcybersecurity\u002Fomb-issues-federal-roadmap-for-post-quantum-cryptography-migration\u002F",{"label":2342,"url":2343},"OpenSSL Corporation, \"Post-Quantum Cryptography Now Has Deadlines,\" 2026.","https:\u002F\u002Fopenssl-corporation.org\u002Fblog\u002Fpost-quantum-cryptography-now-has-deadlines.html",{"label":2345,"url":2346},"GovCIO Media, \"Agencies Go Beyond Planning as Post-Quantum Deadlines Near,\" Jun. 19, 2026.","https:\u002F\u002Fgovciomedia.com\u002Fagencies-go-beyond-planning-as-post-quantum-deadlines-near\u002F",[2348,2350],{"label":2349,"url":124},"Executive Order 14412: The New Post-Quantum Deadline",{"label":2351,"url":2352},"OMB M-23-02 Orders Quantum-Vulnerable Crypto Inventory","\u002Fnews\u002Fomb-m-23-02-inventory-quantum-vulnerable-cryptography",{"title":2292,"description":2324},"OMB M-26-15 Sets 120-Day Post-Quantum Plan Deadline","omb-m-26-15-120-day-pqc-plans","news\u002Fomb-m-26-15-120-day-pqc-plans",[438,132,549,2156,134],"OMB M-26-15 gives civilian agencies 120 days, about 22 October 2026, to submit post-quantum migration plans, so vendors should expect roadmap requests.","jEAoroiGjkf8Ey9MKkLis7TH3iKRzqWCwJJLtcrPmQk",{"id":2361,"title":2362,"author":7,"authorTitle":8,"authorUrl":9,"body":2363,"canonical":9,"category":92,"date":2257,"description":2394,"draft":95,"extension":96,"faqs":2395,"findingsSource":9,"geo":2402,"image":417,"industries":2403,"keyFindings":9,"meta":2404,"modified":339,"navigation":103,"path":430,"pullquote":9,"recommendations":9,"references":2405,"related":2413,"seo":2416,"seoTitle":429,"signposts":9,"slug":2417,"stats":9,"stem":2418,"tags":2419,"tldr":2420,"__hash__":2421},"news\u002Fnews\u002Fpentagon-post-quantum-cryptography-strategy-2030-2031.md","The Pentagon Sets 2030 and 2031 Deadlines for Post-Quantum Cryptography",{"type":11,"value":2364,"toc":2391},[2365,2369,2374,2377,2380,2383,2386],[14,2366,2368],{"id":2367},"pentagon-sets-2030-and-2031-deadlines-for-post-quantum-cryptography","Pentagon sets 2030 and 2031 deadlines for post-quantum cryptography",[19,2370,2371],{},[383,2372,2373],{},"23 JUNE 2026, ARLINGTON",[19,2375,2376],{},"The Department of War, formerly the Department of Defense, released its post-quantum cryptography strategy. Defense One reports the release as Tuesday, 23 June, and its story ran on 24 June.",[19,2378,2379],{},"Defense One reports that all Pentagon systems must support post-quantum cryptography by the end of 2030 or face phase-out, and that all systems must use the new standards by the end of 2031. Skadden's alert gives the same two gates and quotes the strategy as saying the shift touches nearly every deployed military asset in some way.",[19,2381,2382],{},"The strategy reaches all department IT systems and, according to Defense One, the defense industrial base and supply chains, since it stresses integrating secure commercial products and developing post-quantum algorithms and protocols. Skadden and OpenSSL Corporation say the requirements flow to contractors and the defense industrial base.",[19,2384,2385],{},"Defense One quotes DoD Chief Information Officer Kirsten Davies describing the strategy as only a first step in readying the military and as concerning the integrity of systems for decades to come. She placed it within broader modernization priorities, including artificial intelligence and workforce development, and said network modernization alone is insufficient.",[19,2387,2388,2390],{},[383,2389,399],{}," Defense contractors and suppliers should expect post-quantum requirements to reach them through contracts, with end-2030 and end-2031 as the reference dates. The Pentagon can phase out products that do not support the new standards, which suggests vendors need product roadmaps now. The CIO's own description of the strategy as a first step indicates more detailed requirements may follow.",{"title":8,"searchDepth":84,"depth":84,"links":2392},[2393],{"id":2367,"depth":84,"text":2368},"The Department of War's June 2026 strategy says systems must support post-quantum cryptography or be phased out by end-2030. Contractors should plan now.",[2396,2399],{"q":2397,"a":2398},"How will the strategy reach contractors?","Skadden and OpenSSL Corporation say the requirements flow to contractors and the defense industrial base. Products that cannot support the new standards risk being phased out of Pentagon use, so vendors need roadmaps.",{"q":2400,"a":2401},"Is this the final word on requirements?","Probably not. DoD CIO Kirsten Davies described the strategy as only a first step in readying the military, which suggests more detailed requirements may follow.",[98],[101,419],{},[2406,2409,2412],{"label":2407,"url":2408},"Defense One, \"Pentagon post-quantum cryptography strategy (DoD CIO),\" Jun. 24, 2026.","https:\u002F\u002Fwww.defenseone.com\u002Fpolicy\u002F2026\u002F06\u002Fquantum-strategy-cio\u002F414409\u002F",{"label":2410,"url":2411},"Skadden, \"New Executive Orders and Government Strategy Advance US Quantum Innovation and Mandate Post-Quantum Cryptography Transition,\" Jun. 2026.","https:\u002F\u002Fwww.skadden.com\u002Finsights\u002Fpublications\u002F2026\u002F06\u002Fnew-executive-orders-and-government-strategy",{"label":2342,"url":2343},[2414,2415],{"label":126,"url":104},{"label":2349,"url":124},{"title":2362,"description":2394},"pentagon-post-quantum-cryptography-strategy-2030-2031","news\u002Fpentagon-post-quantum-cryptography-strategy-2030-2031",[130,438,1338,132,439],"The Department of War's June 2026 strategy says systems must support post-quantum cryptography or be phased out by end-2030, so contractors should plan now.","X-XFw-NArgaaj1N9ETmOHUwqSRfqkkJPMSvFUYT3GYM",{"id":2423,"title":2424,"author":7,"authorTitle":8,"authorUrl":9,"body":2425,"canonical":9,"category":92,"date":2257,"description":2485,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":2486,"image":417,"industries":2487,"keyFindings":9,"meta":2488,"modified":421,"navigation":103,"path":124,"pullquote":9,"recommendations":9,"references":2489,"related":2497,"seo":2501,"seoTitle":2349,"signposts":9,"slug":2502,"stats":9,"stem":2503,"tags":2504,"tldr":2505,"__hash__":2506},"news\u002Fnews\u002Fus-executive-order-14412-post-quantum-deadline.md","The U.S. Just Moved the Post-Quantum Deadline Up: What Executive Order 14412 Requires",{"type":11,"value":2426,"toc":2479},[2427,2431,2443,2447,2452,2458,2462,2465,2469,2472],[14,2428,2430],{"id":2429},"the-deadline-moved-and-it-moved-forward","The deadline moved, and it moved forward",[19,2432,2433,2434,2436,2437,2439,2440,2442],{},"On June 22, 2026, the White House signed Executive Order 14412, and it pulled the U.S. federal post-quantum timeline forward in a way that reaches well past federal agencies ",[23,2435,25],{},". The order directs OMB to require agencies to move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum digital signatures by December 31, 2031 ",[23,2438,25],{},". It excludes National Security Systems. The order also directs the Federal Acquisition Regulatory Council to propose a rule requiring covered contractors to meet, by the end of 2030, the National Institute of Standards and Technology standards that include the post-quantum algorithms ",[23,2441,29],{},". If your company sells to the government, or sells to anyone who does, the order now sets your clock too.",[14,2444,2446],{"id":2445},"what-the-order-actually-requires","What the order actually requires",[19,2448,2449,2450,171],{},"The order splits the migration into two phases that mirror how cryptography actually breaks. Key establishment comes first, because an adversary who records encrypted traffic today can decrypt it later once a large quantum computer exists. That threat, known as harvest now, decrypt later, does not wait for the migration to finish. Authentication comes second, because forged signatures let an attacker impersonate a server or sign malicious code after quantum computers arrive. NIST already published the algorithms that answer both needs, starting with FIPS 203 for key encapsulation ",[23,2451,63],{},[19,2453,2454,2455,2457],{},"The operational requirements matter as much as the dates. Within 30 days, each agency names a migration lead who owns the cryptographic inventory and the migration plan. Within 90 days, the Office of Management and Budget issues guidance that requires agencies to review their inventories of high-value assets and high-impact systems and submit a plan ",[23,2456,25],{},". The order treats the cryptographic inventory as the first deliverable, not the last, and that ordering is the tell for everyone else.",[14,2459,2461],{"id":2460},"why-this-reaches-the-private-sector","Why this reaches the private sector",[19,2463,2464],{},"Read the contractor clause carefully, because it changes the calculus for commercial teams that assumed 2035 gave them room. When federal buyers require post-quantum readiness in procurement, that requirement flows down every tier of the supply chain. A software vendor, a cloud provider, and a managed service that all touch federal data now inherit a 2030 date whether or not they consider themselves a government contractor. Markets tend to standardize on the strictest live requirement, and Executive Order 14412 just made 2030 the number that matters in the United States.",[14,2466,2468],{"id":2467},"what-to-do-now","What to do now",[19,2470,2471],{},"Start where the order starts: with discovery. You cannot plan a migration you cannot see, and a plan you submit against a stale inventory will not survive an audit. Build a complete cryptographic inventory across every surface where vulnerable algorithms hide, classify each finding by quantum risk, and map it to the standard that replaces it. Then turn that inventory into a prioritized roadmap with dates your leadership can track.",[19,2473,2474,2475,2478],{},"This is the work ",[1772,2476,1777],{"href":1774,"rel":2477},[1776]," does. It analyzes the seven cryptographic surfaces in one engine, maps every finding to FIPS 203, 204, and 205, and builds the migration roadmap for you, in our cloud or inside your own perimeter. Executive Order 14412 did not create the quantum threat. It removed the excuse to wait.",{"title":8,"searchDepth":84,"depth":84,"links":2480},[2481,2482,2483,2484],{"id":2429,"depth":84,"text":2430},{"id":2445,"depth":84,"text":2446},{"id":2460,"depth":84,"text":2461},{"id":2467,"depth":84,"text":2468},"Executive Order 14412 sets 2030 and 2031 post-quantum deadlines for U.S. federal high-impact systems and covered contractors. Here is what changes and what to do now.",[342],[100,419],{},[2490,2491,2494],{"label":2142,"url":2143},{"label":2492,"url":2493},"\"Trump sets new deadlines for agencies and contractors to adopt post-quantum cryptography,\" Cybersecurity Dive, Jun. 2026.","https:\u002F\u002Fwww.cybersecuritydive.com\u002Fnews\u002Fquantum-cryptography-white-house-executive-order\u002F823530\u002F",{"label":2495,"url":2496},"National Institute of Standards and Technology, \"FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard,\" NIST, Aug. 2024.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F203\u002Ffinal",[2498,2499,2500],{"label":653,"url":654},{"label":656,"url":657},{"label":2150,"url":121},{"title":2424,"description":2485},"us-executive-order-14412-post-quantum-deadline","news\u002Fus-executive-order-14412-post-quantum-deadline",[438,132,2156,1338,134,260],"Executive Order 14412 directs OMB to require U.S. federal high-impact systems to adopt post-quantum key establishment by 2030 and digital signatures by 2031, and it directs a rule that would put covered contractors on the same clock.","Wb0hzB6U7U61ows4_c99Nk7Vconq03rFeZjt8IR31rU",{"id":2508,"title":2509,"author":7,"authorTitle":8,"authorUrl":9,"body":2510,"canonical":9,"category":92,"date":2538,"description":2539,"draft":95,"extension":96,"faqs":2540,"findingsSource":9,"geo":2550,"image":417,"industries":2551,"keyFindings":9,"meta":2552,"modified":1920,"navigation":103,"path":2553,"pullquote":9,"recommendations":9,"references":2554,"related":2558,"seo":2563,"seoTitle":2564,"signposts":9,"slug":2565,"stats":9,"stem":2566,"tags":2567,"tldr":2568,"__hash__":2569},"news\u002Fnews\u002Feo-14412-cbom-standard-2027.md","Executive Order 14412 Orders a Cryptography Bill of Materials Standard by 2027",{"type":11,"value":2511,"toc":2535},[2512,2516,2521,2524,2527,2530],[14,2513,2515],{"id":2514},"executive-order-14412-orders-a-cryptography-bill-of-materials-standard-by-2027","Executive Order 14412 orders a cryptography bill of materials standard by 2027",[19,2517,2518],{},[383,2519,2520],{},"22 JUNE 2026, WASHINGTON",[19,2522,2523],{},"Executive Order 14412 directs CISA and NIST to publish the minimum elements of a cryptography bill of materials within 270 days of the order. Counting from 22 June 2026, that points to roughly 19 March 2027. A cryptography bill of materials, or CBOM, is a structured inventory of the cryptographic algorithms, protocols and key lengths a product uses, so a buyer can see which components depend on quantum-vulnerable cryptography.",[19,2525,2526],{},"The order tasks the two agencies with defining what a conforming CBOM must contain rather than prescribing one file format. That mirrors how the software bill of materials guidance developed, where minimum elements set a baseline and tools filled in the detail. The CBOM gives agencies a way to track cryptographic dependencies across their estates and to compare suppliers on a consistent basis.",[19,2528,2529],{},"Vendors should expect CBOMs to appear in procurement questionnaires. Once agencies can ask for a cryptography inventory and check it, post-quantum readiness becomes a verifiable supplier attribute instead of a marketing claim. Suppliers that already maintain a cryptographic inventory of their own products will find the request straightforward to answer.",[19,2531,2532,2534],{},[383,2533,399],{}," The CBOM requirement turns cryptographic transparency into a procurement expectation. Buyers gain a repeatable way to ask suppliers what algorithms their products use, and suppliers gain a clear reason to inventory their own cryptography before the questions arrive. Organizations that build a product-level cryptographic inventory ahead of the 2027 standard will be ready to respond when federal buyers start asking.",{"title":8,"searchDepth":84,"depth":84,"links":2536},[2537],{"id":2514,"depth":84,"text":2515},"2026-06-22","Executive Order 14412 directs CISA and NIST to publish cryptography bill of materials minimum elements within 270 days, pointing to roughly March 2027.",[2541,2544,2547],{"q":2542,"a":2543},"What is a cryptography bill of materials?","A cryptography bill of materials, or CBOM, is a machine-readable inventory of the cryptographic algorithms, protocols and key lengths a product uses. It lets buyers see which components rely on quantum-vulnerable cryptography without reverse-engineering the product.",{"q":2545,"a":2546},"When is the CBOM standard due?","The order gives CISA and NIST 270 days from 22 June 2026 to publish the minimum elements, which points to roughly 19 March 2027. The agencies define what a conforming CBOM must contain rather than mandating a single file format.",{"q":2548,"a":2549},"How will CBOMs affect procurement?","Buyers are expected to add CBOM requests to procurement questionnaires, so vendors should be ready to supply a cryptography inventory for their products. A CBOM makes post-quantum readiness a checkable supplier attribute rather than a claim.",[342],[100,228],{},"\u002Fnews\u002Feo-14412-cbom-standard-2027",[2555],{"label":2556,"url":2557},"The White House, \"Executive Order 14412,\" Federal Register, vol. 91, p. 38483, Jun. 22, 2026.","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F22",[2559,2562],{"label":2560,"url":2561},"Executive Order 14412 Sets 2030 and 2031 Post-Quantum Deadlines for Federal Systems","\u002Fnews\u002Feo-14412-federal-pqc-deadlines-2030-2031",{"label":815,"url":816},{"title":2509,"description":2539},"EO 14412 Orders a CBOM Standard by 2027","eo-14412-cbom-standard-2027","news\u002Feo-14412-cbom-standard-2027",[2156,133,134,759,439],"Executive Order 14412 directs CISA and NIST to publish cryptography bill of materials minimum elements within 270 days, pointing to a March 2027 standard.","z9X11twBXcAwG2pBiqkjfgwyk1ly3hw3eeIH1IBl1EU",{"id":2571,"title":1994,"author":7,"authorTitle":8,"authorUrl":9,"body":2572,"canonical":9,"category":92,"date":2538,"description":2599,"draft":95,"extension":96,"faqs":2600,"findingsSource":9,"geo":2610,"image":417,"industries":2611,"keyFindings":9,"meta":2612,"modified":517,"navigation":103,"path":1995,"pullquote":9,"recommendations":9,"references":2613,"related":2615,"seo":2618,"seoTitle":2619,"signposts":9,"slug":2620,"stats":9,"stem":2621,"tags":2622,"tldr":2623,"__hash__":2624},"news\u002Fnews\u002Feo-14412-contractor-far-rules-2030.md",{"type":11,"value":2573,"toc":2596},[2574,2578,2582,2585,2588,2591],[14,2575,2577],{"id":2576},"executive-order-14412-directs-post-quantum-contractor-rules-under-the-far-by-2030","Executive Order 14412 directs post-quantum contractor rules under the FAR by 2030",[19,2579,2580],{},[383,2581,2520],{},[19,2583,2584],{},"Executive Order 14412 directs a proposed Federal Acquisition Regulation rule within 180 days of the order, which points to roughly 19 December 2026. The proposal opens the rulemaking that converts the order's post-quantum requirements into contract terms, so federal buyers can require quantum-resistant cryptography through the contracts they sign.",[19,2586,2587],{},"Covered contractors must comply by 31 December 2030, matching the federal key-establishment deadline the order sets elsewhere. The requirements flow down to subcontractors, so a prime contractor must pass the obligations to the suppliers it depends on. That flow-down means the deadline reaches well beyond the companies that hold federal contracts directly.",[19,2589,2590],{},"The 180-day proposal is the start of a public process, not the final rule. Contractors can read the proposed text when it appears, comment during the rulemaking, and plan against the end-2030 compliance date. The order gives them roughly four years from the proposal to migrate the products and services they sell to the government.",[19,2592,2593,2595],{},[383,2594,399],{}," The FAR route gives the executive order teeth in the private sector. Once post-quantum requirements sit in contract clauses, winning or keeping federal work depends on meeting them, and the flow-down pulls subcontractors into the same timeline. Contractors that inventory their cryptography and plan replacements now will avoid a scramble as the proposed rule firms up and the end-2030 deadline approaches.",{"title":8,"searchDepth":84,"depth":84,"links":2597},[2598],{"id":2576,"depth":84,"text":2577},"Executive Order 14412 directs a FAR proposal within 180 days; covered contractors must meet post-quantum obligations by end-2030, with flow-down to subcontractors.",[2601,2604,2607],{"q":2602,"a":2603},"When does the FAR proposed rule appear?","Executive Order 14412 directs a proposed Federal Acquisition Regulation rule within 180 days of the order, which points to roughly 19 December 2026. The proposal starts the public rulemaking process that turns the order's requirements into contract terms.",{"q":2605,"a":2606},"Who counts as a covered contractor?","The rulemaking defines the exact scope, but the order aims the obligations at contractors whose products or services touch federal systems. Covered contractors must comply by 31 December 2030 and flow the requirements down to their subcontractors.",{"q":2608,"a":2609},"What should contractors do now?","Contractors can start a cryptographic inventory of the products and services they sell to the government, identify quantum-vulnerable components, and plan replacements. Early discovery gives the most time to migrate before the end-2030 deadline arrives.",[342],[100,101],{},[2614],{"label":2556,"url":2557},[2616,2617],{"label":2560,"url":2561},{"label":429,"url":430},{"title":1994,"description":2599},"EO 14412 Directs Contractor FAR Rules by 2030","eo-14412-contractor-far-rules-2030","news\u002Feo-14412-contractor-far-rules-2030",[2156,134,759,1338,439],"Executive Order 14412 directs a Federal Acquisition Regulation proposal within 180 days, requiring covered contractors to meet post-quantum obligations by the end of 2030.","WxQyB9tjdI5S_aneex9aEjNXm-O-IaqfvagSQTSeHp4",{"id":2626,"title":2560,"author":7,"authorTitle":8,"authorUrl":9,"body":2627,"canonical":9,"category":92,"date":2538,"description":2654,"draft":95,"extension":96,"faqs":2655,"findingsSource":9,"geo":2665,"image":417,"industries":2666,"keyFindings":9,"meta":2667,"modified":1920,"navigation":103,"path":2561,"pullquote":9,"recommendations":9,"references":2668,"related":2670,"seo":2675,"seoTitle":2676,"signposts":9,"slug":2677,"stats":9,"stem":2678,"tags":2679,"tldr":2680,"__hash__":2681},"news\u002Fnews\u002Feo-14412-federal-pqc-deadlines-2030-2031.md",{"type":11,"value":2628,"toc":2651},[2629,2633,2637,2640,2643,2646],[14,2630,2632],{"id":2631},"executive-order-14412-sets-2030-and-2031-federal-post-quantum-deadlines","Executive Order 14412 sets 2030 and 2031 federal post-quantum deadlines",[19,2634,2635],{},[383,2636,2520],{},[19,2638,2639],{},"Executive Order 14412, published at 91 FR 38483, directs federal systems to adopt post-quantum cryptography on a fixed schedule. Agencies must deploy post-quantum key establishment by 31 December 2030 and post-quantum digital signatures by 31 December 2031. The order separates the two dates because key establishment carries the more urgent harvest-now-decrypt-later risk, where an adversary records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists.",[19,2641,2642],{},"The order also lays out a sequence of near-term milestones. It gives agencies 30 days to designate a migration lead, 90 days for the Office of Management and Budget to issue guidance, and 180 days for NIST to complete validation work and for a Federal Acquisition Regulation proposal to appear. Within 270 days, CISA and NIST must publish the minimum elements of a cryptography bill of materials.",[19,2644,2645],{},"These deadlines reach beyond federal agencies. The FAR proposal flows the requirements to covered contractors, who must meet the same end-2030 obligation and pass the duties down to their subcontractors. Vendors that sell to the federal government therefore inherit the timeline, even where they operate under private contracts.",[19,2647,2648,2650],{},[383,2649,399],{}," The order converts years of voluntary guidance into dated obligations with a procurement lever behind them. Agencies and their vendors now have a hard end-2030 target for key establishment and end-2031 for signatures, and the cryptography bill of materials requirement means buyers will ask suppliers to prove what algorithms their products use. Organizations that start cryptographic discovery and inventory now have the most room to plan an orderly migration.",{"title":8,"searchDepth":84,"depth":84,"links":2652},[2653],{"id":2631,"depth":84,"text":2632},"Executive Order 14412 directs federal systems to adopt post-quantum key establishment by end-2030 and post-quantum signatures by end-2031, flowing to contractors.",[2656,2659,2662],{"q":2657,"a":2658},"What are the two deadlines in EO 14412?","Federal systems must adopt post-quantum key establishment by 31 December 2030 and post-quantum digital signatures by 31 December 2031. The order separates the two because key establishment faces the more urgent harvest-now-decrypt-later threat.",{"q":2660,"a":2661},"Does EO 14412 reach private contractors?","Yes. The order directs a Federal Acquisition Regulation proposal within 180 days, and the resulting rules flow the post-quantum requirements to covered contractors, who must comply by the end of 2030 and pass obligations to subcontractors.",{"q":2663,"a":2664},"What are the near-term milestones?","The order sets a 30-day migration-lead designation, 90-day OMB guidance, 180-day NIST validation work plus a FAR proposal, and a 270-day deadline for CISA and NIST to publish cryptography bill of materials minimum elements.",[342],[100,419],{},[2669],{"label":2556,"url":2557},[2671,2672],{"label":432,"url":124},{"label":2673,"url":2674},"NIST Approves First Three Post-Quantum Standards","\u002Fnews\u002Fnist-approves-first-three-post-quantum-standards",{"title":2560,"description":2654},"EO 14412 Sets Federal PQC Deadlines for 2030, 2031","eo-14412-federal-pqc-deadlines-2030-2031","news\u002Feo-14412-federal-pqc-deadlines-2030-2031",[2156,438,134,1338,439],"Executive Order 14412 directs federal systems to adopt post-quantum key establishment by the end of 2030 and post-quantum signatures by the end of 2031.","1OknP3g9mZTNpF7S4Ehfeq4S6FTBkNwzqOCQpfKeUzg",{"id":2683,"title":2684,"author":7,"authorTitle":8,"authorUrl":9,"body":2685,"canonical":9,"category":92,"date":2538,"description":2715,"draft":95,"extension":96,"faqs":2716,"findingsSource":9,"geo":2723,"image":417,"industries":2724,"keyFindings":9,"meta":2725,"modified":339,"navigation":103,"path":2726,"pullquote":9,"recommendations":9,"references":2727,"related":2729,"seo":2732,"seoTitle":2733,"signposts":9,"slug":2734,"stats":9,"stem":2735,"tags":2736,"tldr":2737,"__hash__":2738},"news\u002Fnews\u002Fexecutive-order-14413-quantum-innovation-no-encryption-deadlines.md","The Companion Executive Order on Quantum Innovation Sets No Encryption Deadlines",{"type":11,"value":2686,"toc":2712},[2687,2691,2695,2698,2701,2704,2707],[14,2688,2690],{"id":2689},"companion-executive-order-on-quantum-innovation-sets-no-encryption-deadlines","Companion executive order on quantum innovation sets no encryption deadlines",[19,2692,2693],{},[383,2694,2520],{},[19,2696,2697],{},"President Trump signed Executive Order 14413, \"Ushering in the Next Frontier of Quantum Innovation,\" the same day as Executive Order 14412. It is a distinct order, with Federal Register document number 2026-12910. It is a companion on quantum research and commercialization, not a migration instrument.",[19,2699,2700],{},"According to Skadden's June 2026 client alert, it establishes a whole-of-government approach to speed the development of quantum computing, sensing and networking in the United States while restricting adversary access, including through export controls. Skadden presents it together with EO 14412 and the Department of War's post-quantum strategy as one package, titled around advancing quantum innovation and mandating the post-quantum transition.",[19,2702,2703],{},"The innovation order does not set cryptographic migration deadlines. Those sit in EO 14412 and the OMB memorandum M-26-15. Readers who search for \"the quantum executive order\" may land on either.",[19,2705,2706],{},"The order reaches the quantum technology industry, research institutions and agencies that fund or regulate quantum work, plus companies that trade quantum items under export-control restrictions.",[19,2708,2709,2711],{},[383,2710,399],{}," Executives should not confuse the two orders: this one concerns research, commercialization and export controls, while EO 14412 carries the encryption migration dates. Companies that make or trade quantum technology should expect tighter export-control attention. Security teams should read EO 14412 and M-26-15 for migration obligations.",{"title":8,"searchDepth":84,"depth":84,"links":2713},[2714],{"id":2689,"depth":84,"text":2690},"Executive Order 14413 targets quantum research, commercialization and export controls, not migration. Encryption deadlines sit in EO 14412 and OMB M-26-15.",[2717,2720],{"q":2718,"a":2719},"Who is affected by EO 14413?","The quantum technology industry, research institutions, agencies that fund or regulate quantum work, and companies exposed to export-control restrictions on quantum items. Export-control attention may tighten for firms trading quantum items.",{"q":2721,"a":2722},"Which order should security teams read?","Security teams should read EO 14412 and OMB memorandum M-26-15 for migration obligations. People searching for the quantum executive order may land on either, so confirm which order a source describes.",[342],[100,419],{},"\u002Fnews\u002Fexecutive-order-14413-quantum-innovation-no-encryption-deadlines",[2728],{"label":2410,"url":2411},[2730,2731],{"label":2349,"url":124},{"label":2354,"url":2336},{"title":2684,"description":2715},"EO 14413 on Quantum Innovation Sets No PQC Deadlines","executive-order-14413-quantum-innovation-no-encryption-deadlines","news\u002Fexecutive-order-14413-quantum-innovation-no-encryption-deadlines",[438,2156,1078,439],"Executive Order 14413 targets quantum research, commercialization and export controls, not migration, so encryption deadlines sit in EO 14412 and OMB M-26-15.","_QPcmuBjwfP5vD-p2ipyOsLWbRnONfOYq2osqEh9e5I",{"id":2740,"title":2741,"author":7,"authorTitle":8,"authorUrl":9,"body":2742,"canonical":9,"category":92,"date":2770,"description":2771,"draft":95,"extension":96,"faqs":2772,"findingsSource":9,"geo":2779,"image":417,"industries":2780,"keyFindings":9,"meta":2781,"modified":2782,"navigation":103,"path":2783,"pullquote":9,"recommendations":9,"references":2784,"related":2789,"seo":2794,"seoTitle":2795,"signposts":9,"slug":2796,"stats":9,"stem":2797,"tags":2798,"tldr":2799,"__hash__":2800},"news\u002Fnews\u002Fgsa-post-quantum-cryptography-buyers-guide.md","GSA Issues a Buyer's Guide for Post-Quantum Cryptography",{"type":11,"value":2743,"toc":2767},[2744,2748,2753,2756,2759,2762],[14,2745,2747],{"id":2746},"gsa-issues-a-buyers-guide-for-post-quantum-cryptography","GSA issues a buyer's guide for post-quantum cryptography",[19,2749,2750],{},[383,2751,2752],{},"2025, WASHINGTON",[19,2754,2755],{},"The General Services Administration publishes a Post-Quantum Cryptography Buyer's Guide dated 2025. GSA's own page describes it as a resource to help federal agencies and procurement professionals navigate acquisition of quantum-resistant cryptography. The page frames the aim as making post-quantum protection \"buyable and adaptable\" by building quantum-resistance expectations into IT contracts and vehicles such as the Multiple Award Schedule and governmentwide acquisition contracts. It says the guide explains what to ask for when selecting post-quantum tools and services.",[19,2757,2758],{},"The guide addresses the federal acquisition workforce, industry vendors and contractors, agency procurement officials, and organizations evaluating post-quantum-capable products. GSA lists selection criteria such as accuracy and speed, user experience and compatibility, compliance support, risk-based prioritization, and strong remediation guidance and vendor support. A PQC Roadmap, also dated 2025, sits alongside the guide, and both live on GSA's buy.gsa.gov documentation system.",[19,2760,2761],{},"GovCIO Media, in an article of 19 June 2026, says GSA offers the buyer's guide through buy.gsa.gov and also a quantum information science and technology guidebook, so that agencies can write technical requirements and ensure acquisitions support crypto agile approaches. In the same article, GSA's Rosa Underwood describes agency readiness as running from not prepared to partially prepared. GovCIO also reports that larger departments such as the Pentagon command more resources for finding cryptographic assets, while smaller agencies struggle with staff, funding and expertise.",[19,2763,2764,2766],{},[383,2765,399],{}," Vendors selling to federal agencies should expect procurement language to reflect the criteria in this guide. Any organization buying security products can borrow the guide's questions to test vendor claims. The GovCIO reporting suggests smaller agencies may lean heavily on such resources, so vendors should expect questions from buyers with limited in-house expertise.",{"title":8,"searchDepth":84,"depth":84,"links":2768},[2769],{"id":2746,"depth":84,"text":2747},"2026-06-19","GSA's 2025 buyer's guide helps agencies buy quantum-resistant cryptography and write crypto agile requirements. Vendors should expect matching language.",[2773,2776],{"q":2774,"a":2775},"Who is the guide for?","The federal acquisition workforce, agency procurement officials, industry vendors and contractors, and organizations evaluating post-quantum-capable products. GSA lists criteria such as accuracy, speed, compatibility, compliance support and vendor support.",{"q":2777,"a":2778},"How should vendors respond?","Expect procurement language to reflect the guide's criteria. GovCIO reports smaller agencies struggle with staff, funding and expertise, so vendors should expect detailed questions from buyers with limited in-house post-quantum knowledge.",[342],[100,419],{},"2026-09-18","\u002Fnews\u002Fgsa-post-quantum-cryptography-buyers-guide",[2785,2788],{"label":2786,"url":2787},"General Services Administration, \"Post-quantum cryptography (agency page),\" accessed Oct. 2, 2026.","https:\u002F\u002Fwww.gsa.gov\u002Ftechnology\u002Fit-contract-vehicles-and-purchasing-programs\u002Fit-security\u002Fpostquantum-cryptography",{"label":2345,"url":2346},[2790,2793],{"label":2791,"url":2792},"CISA Lists Product Categories for Post-Quantum Support","\u002Fnews\u002Fcisa-post-quantum-product-categories-list",{"label":2349,"url":124},{"title":2741,"description":2771},"GSA Issues Post-Quantum Cryptography Buyer's Guide","gsa-post-quantum-cryptography-buyers-guide","news\u002Fgsa-post-quantum-cryptography-buyers-guide",[438,549,134,439],"GSA's 2025 buyer's guide helps federal agencies acquire quantum-resistant cryptography and write crypto agile selection criteria, so vendors should expect matching language in procurement.","97RXSr2ZHIRS-FZl9jSctWbMsxKfStIIAd2CzBU1SPQ",{"id":2802,"title":2803,"author":7,"authorTitle":8,"authorUrl":9,"body":2804,"canonical":9,"category":220,"date":2832,"description":2833,"draft":95,"extension":96,"faqs":2834,"findingsSource":9,"geo":2844,"image":417,"industries":2845,"keyFindings":9,"meta":2846,"modified":1985,"navigation":103,"path":2847,"pullquote":9,"recommendations":9,"references":2848,"related":2852,"seo":2857,"seoTitle":2858,"signposts":9,"slug":2859,"stats":9,"stem":2860,"tags":2861,"tldr":2863,"__hash__":2864},"news\u002Fnews\u002Fietf-rfc-9958-pqc-for-engineers.md","IETF RFC 9958 Explains Post-Quantum Cryptography for Engineers",{"type":11,"value":2805,"toc":2829},[2806,2810,2815,2818,2821,2824],[14,2807,2809],{"id":2808},"ietf-rfc-9958-explains-post-quantum-cryptography-for-engineers","IETF RFC 9958 explains post-quantum cryptography for engineers",[19,2811,2812],{},[383,2813,2814],{},"18 JUNE 2026, GLOBAL",[19,2816,2817],{},"The Internet Engineering Task Force published RFC 9958, \"Post-Quantum Cryptography for Engineers,\" on 18 June 2026. The document explains post-quantum cryptography for the engineers who must implement it, and its central message is blunt: migrating may require redesigning protocols, not simply swapping one algorithm for another.",[19,2819,2820],{},"The reason lies in how post-quantum algorithms differ. They often have larger keys and signatures than the algorithms they replace, which can break assumptions that existing protocols build in, such as the size of a field or a packet. Fitting the new algorithms in sometimes means changing how a protocol works, so engineers cannot always treat migration as a drop-in replacement.",[19,2822,2823],{},"That distinction is why the RFC exists. Engineers and architects implementing post-quantum cryptography need to understand the practical implications beyond choosing an algorithm. By spelling out where protocol-level work is required, the RFC helps teams plan for it in advance rather than discovering mid-migration that a protocol cannot carry the new cryptography unchanged.",[19,2825,2826,2828],{},[383,2827,399],{}," RFC 9958 corrects a common misconception that post-quantum migration is just an algorithm swap. Because post-quantum algorithms can force protocol redesign, teams that plan only for a drop-in replacement may hit surprises. Engineers can use the RFC to identify where their protocols need redesign and budget for that work, which makes crypto agility at the protocol level as valuable as agility at the algorithm level.",{"title":8,"searchDepth":84,"depth":84,"links":2830},[2831],{"id":2808,"depth":84,"text":2809},"2026-06-18","IETF RFC 9958, published in June 2026, explains post-quantum cryptography for engineers and warns migration may need protocol redesign, not just a swap.",[2835,2838,2841],{"q":2836,"a":2837},"What does RFC 9958 cover?","Published on 18 June 2026, RFC 9958 explains post-quantum cryptography for engineers. Its key message is that migrating may require redesigning protocols, not simply swapping one algorithm for another, because post-quantum algorithms differ in ways that affect how protocols carry them.",{"q":2839,"a":2840},"Why might protocol redesign be needed?","Post-quantum algorithms often have larger keys and signatures than the ones they replace, which can break assumptions built into existing protocols. Fitting them in sometimes requires changing how a protocol works, so engineers cannot always treat migration as a drop-in replacement.",{"q":2842,"a":2843},"Who should read RFC 9958?","Engineers and architects implementing post-quantum cryptography are the primary audience. The RFC helps them understand the practical implications beyond algorithm choice, so they plan for protocol-level work where it is needed rather than being surprised by it.",[225],[228,100],{},"\u002Fnews\u002Fietf-rfc-9958-pqc-for-engineers",[2849],{"label":2850,"url":2851},"Internet Engineering Task Force, \"Post-Quantum Cryptography for Engineers,\" RFC 9958, Jun. 18, 2026.","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9958",[2853,2856],{"label":2854,"url":2855},"NIST Issues Final Guidance on Key Establishment Mechanisms in SP 800-227","\u002Fnews\u002Fnist-sp-800-227-kem-guidance",{"label":818,"url":819},{"title":2803,"description":2833},"IETF RFC 9958: PQC for Engineers","ietf-rfc-9958-pqc-for-engineers","news\u002Fietf-rfc-9958-pqc-for-engineers",[438,132,549,2862,260],"industry analysis","IETF RFC 9958, published in June 2026, explains post-quantum cryptography for engineers and warns that migration may need protocol redesign, not just an algorithm swap.","e2FJsCDcuI_7ypMltxvCAPMv7kSvJw9gC5n-TR3xN2I",{"id":2866,"title":2867,"author":7,"authorTitle":8,"authorUrl":9,"body":2868,"canonical":9,"category":92,"date":2896,"description":2897,"draft":95,"extension":96,"faqs":2898,"findingsSource":9,"geo":2908,"image":417,"industries":2909,"keyFindings":9,"meta":2910,"modified":2782,"navigation":103,"path":2911,"pullquote":9,"recommendations":9,"references":2912,"related":2916,"seo":2921,"seoTitle":2922,"signposts":9,"slug":2923,"stats":9,"stem":2924,"tags":2925,"tldr":2926,"__hash__":2927},"news\u002Fnews\u002Fg7-central-banks-first-shared-quantum-report.md","G7 Central Banks Publish Their First Shared Quantum Report",{"type":11,"value":2869,"toc":2893},[2870,2874,2879,2882,2885,2888],[14,2871,2873],{"id":2872},"g7-central-banks-publish-their-first-shared-quantum-report","G7 central banks publish their first shared quantum report",[19,2875,2876],{},[383,2877,2878],{},"11 MAY 2026, BASEL",[19,2880,2881],{},"G7 central banks published their first shared report on quantum computing and the financial system on 11 May 2026. The report marks coordinated attention among the group to how quantum computing affects finance, building on the work of their joint quantum working group that the Bank of Japan and others take part in.",[19,2883,2884],{},"The report informs rather than mandates. As a shared document by central banks, it shapes the participants' thinking instead of imposing requirements on commercial banks. Its influence reaches the wider sector indirectly, through how each member central bank reflects the thinking in its own supervision and operations.",[19,2886,2887],{},"A first shared report carries significance beyond its contents. It shows G7 central banks treating quantum as a collective concern worth coordinating on, not merely an issue for individual institutions. That coordination raises the chance of consistent expectations across major markets, which matters for internationally active banks that would otherwise face divergent approaches.",[19,2889,2890,2892],{},[383,2891,399],{}," The first shared G7 central bank report signals that quantum risk has become a coordinated priority among the world's leading central banks. It binds no commercial bank directly, but it points to where consistent supervisory thinking is forming. Internationally active banks should expect the ideas developed in this forum to shape the expectations their own central banks eventually set, so early preparation stays prudent.",{"title":8,"searchDepth":84,"depth":84,"links":2894},[2895],{"id":2872,"depth":84,"text":2873},"2026-05-11","G7 central banks published their first shared quantum report in May 2026, marking coordinated attention to how quantum computing affects finance.",[2899,2902,2905],{"q":2900,"a":2901},"What is the G7 central banks' shared quantum report?","Published on 11 May 2026, it is the first shared report by G7 central banks on quantum computing and the financial system. It marks coordinated attention among the group to how quantum computing affects finance, reflecting work by their joint quantum working group.",{"q":2903,"a":2904},"Does the report impose requirements on banks?","No. As a shared report by central banks, it informs the participants' thinking rather than imposing requirements on commercial banks. Its influence runs through how member central banks shape their own supervision and operations.",{"q":2906,"a":2907},"Why is a shared report significant?","A first shared report shows G7 central banks treating quantum as a collective concern worth coordinating on, not just an individual-institution issue. Coordination raises the chance of consistent expectations across major markets, which matters for internationally active banks.",[1152],[227,100],{},"\u002Fnews\u002Fg7-central-banks-first-shared-quantum-report",[2913],{"label":2914,"url":2915},"G7 central banks, \"Shared report on quantum computing and the financial system,\" May 11, 2026.","https:\u002F\u002Fwww.bis.org\u002F",[2917,2920],{"label":2918,"url":2919},"Bank of Japan Joins the G7 Central Bank Quantum Working Group","\u002Fnews\u002Fbank-of-japan-joins-g7-central-bank-quantum-group",{"label":1331,"url":1332},{"title":2867,"description":2897},"G7 Central Banks Publish First Shared Quantum Report","g7-central-banks-first-shared-quantum-report","news\u002Fg7-central-banks-first-shared-quantum-report",[257,368,2862,258,260],"G7 central banks published their first shared quantum report in May 2026, marking coordinated attention to how quantum computing affects the financial system.","L5xiQZp65wNmHlOgN_OxB8GP6YR7ms29x9W1uG6sRKI",{"id":2929,"title":2930,"author":7,"authorTitle":8,"authorUrl":9,"body":2931,"canonical":9,"category":92,"date":2896,"description":2959,"draft":95,"extension":96,"faqs":2960,"findingsSource":9,"geo":2970,"image":417,"industries":2972,"keyFindings":9,"meta":2973,"modified":1920,"navigation":103,"path":2974,"pullquote":9,"recommendations":9,"references":2975,"related":2979,"seo":2984,"seoTitle":2985,"signposts":9,"slug":2986,"stats":9,"stem":2987,"tags":2988,"tldr":2989,"__hash__":2990},"news\u002Fnews\u002Fuae-national-cryptography-discovery-platform.md","UAE Launches a National Cryptography Discovery Platform for Post-Quantum Readiness",{"type":11,"value":2932,"toc":2956},[2933,2937,2942,2945,2948,2951],[14,2934,2936],{"id":2935},"uae-launches-a-national-cryptography-discovery-platform","UAE launches a national cryptography discovery platform",[19,2938,2939],{},[383,2940,2941],{},"11 MAY 2026, ABU DHABI",[19,2943,2944],{},"The UAE launched a national cryptography discovery platform on 11 May 2026, through the Advanced Technology Research Council, the Technology Innovation Institute and QuantumGate. The platform brings together a Crypto Discovery Tool, entanglement-based quantum key distribution and national cryptographic libraries, and it feeds a national post-quantum readiness index.",[19,2946,2947],{},"The discovery tool is the practical core. It helps organizations find where they use cryptography across their systems, which is the first step of any migration. An organization cannot replace cryptography it has not located, so a national tool that lowers the barrier to discovery helps organizations begin the work they might otherwise defer.",[19,2949,2950],{},"The readiness index gives the effort a national dimension. By feeding organization-level discovery into a national index, the UAE gains a view of how prepared the country is as a whole. That national measure lets authorities track collective progress and direct support to where readiness lags, turning individual discovery exercises into a coordinated national picture.",[19,2952,2953,2955],{},[383,2954,399],{}," The UAE has built national infrastructure for the hardest first step of migration, discovery, and tied it to a readiness index that measures progress across the country. Providing the tooling centrally lowers the barrier for organizations to start, and the index gives authorities visibility into where help is needed. Organizations in the UAE can use the platform to begin discovery now rather than building their own tooling from scratch.",{"title":8,"searchDepth":84,"depth":84,"links":2957},[2958],{"id":2935,"depth":84,"text":2936},"The UAE launched a national cryptography discovery platform in May 2026, pairing a discovery tool and national libraries with a national post-quantum index.",[2961,2964,2967],{"q":2962,"a":2963},"What did the UAE launch?","On 11 May 2026, the UAE's ATRC, TII and QuantumGate launched a national cryptography discovery platform. It includes a Crypto Discovery Tool, entanglement-based quantum key distribution and national cryptographic libraries, and it feeds a national post-quantum readiness index.",{"q":2965,"a":2966},"What does the discovery tool do?","The Crypto Discovery Tool helps organizations find where they use cryptography across their systems. Discovery is the first step of any migration, because an organization cannot replace cryptography it has not located, so a national tool lowers the barrier to starting.",{"q":2968,"a":2969},"What is the national readiness index for?","The platform feeds a national post-quantum readiness index, giving the UAE a view of how prepared organizations are across the country. A national measure lets authorities track collective progress and target support where readiness lags.",[2971],"abu-dhabi",[419,100],{},"\u002Fnews\u002Fuae-national-cryptography-discovery-platform",[2976],{"label":2977,"url":2978},"Advanced Technology Research Council (ATRC), Technology Innovation Institute (TII) and QuantumGate, \"National cryptography discovery platform,\" May 11, 2026.","https:\u002F\u002Fatrc.ae\u002F",[2980,2983],{"label":2981,"url":2982},"Central Bank of Jordan Issues a Post-Quantum Roadmap for Banks","\u002Fnews\u002Fcentral-bank-of-jordan-pqc-roadmap-for-banks",{"label":815,"url":816},{"title":2930,"description":2959},"UAE Launches a Crypto Discovery Platform","uae-national-cryptography-discovery-platform","news\u002Fuae-national-cryptography-discovery-platform",[133,368,132,438,439],"The UAE launched a national cryptography discovery platform in May 2026, pairing a discovery tool and national libraries with a national post-quantum readiness index.","-mDUpubcMmQbMpNwZ3baEB9-HlmfLiLjtiO1y-gN2IU",{"id":2992,"title":2993,"author":7,"authorTitle":8,"authorUrl":9,"body":2994,"canonical":9,"category":220,"date":3059,"description":3060,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3061,"image":9,"industries":3062,"keyFindings":9,"meta":3064,"modified":793,"navigation":103,"path":3065,"pullquote":9,"recommendations":9,"references":3066,"related":3079,"seo":3086,"seoTitle":3087,"signposts":9,"slug":3088,"stats":9,"stem":3089,"tags":3090,"tldr":3091,"__hash__":3092},"news\u002Fnews\u002Fcommunications-telecom-quantum-trust-anchors.md","Telecom Operators Race to Replace Trust Anchors Before Quantum Computers Arrive",{"type":11,"value":2995,"toc":3051},[2996,2998,3004,3008,3020,3024,3032,3036,3041,3043,3046,3048],[14,2997,17],{"id":16},[19,2999,3000,3001,3003],{},"Telecom networks carry the traffic every other sector depends on, and their operators are among the furthest along in planning the post-quantum migration. Ericsson researchers recommend that high-priority telecom systems migrate before 2031 and that the full transition finish by 2035, with long-lived trust anchors built into infrastructure today posing the hardest problem ",[23,3002,25],{},". This is the best-covered sector in the current reporting, drawing on vendor research, an industry body, a space agency, and a national program.",[14,3005,3007],{"id":3006},"the-ericsson-view","The Ericsson view",[19,3009,3010,3011,3013,3014,3016,3017,3019],{},"Ericsson's May 2026 paper highlights two concerns: confidentiality through key-exchange migration, and the long-lived trust anchors embedded in infrastructure ",[23,3012,25],{},". The authors argue that ML-KEM performs comparably to current methods, with larger keys adding only modest overhead at connection setup, and they flag devices with non-updatable bootstrap trust anchors as critical risks that need post-quantum algorithms installed at manufacture ",[23,3015,25],{},". The GSMA's PQ.03 guidelines, version 2.0 from November 2024, offer a phased approach so operators can prioritize use cases ",[23,3018,29],{},". The current reporting reflects the PQ.03 landing page rather than the full document, so treat the detail as a summary.",[14,3021,3023],{"id":3022},"satellite-programs","Satellite programs",[19,3025,3026,3027,3029,3030,171],{},"Europe's space sector is moving. In March 2025 the European Space Agency selected a Polish technology company for its PQC ASTrAL project under the ARTES Space Systems for Safety and Security programme ",[23,3028,63],{},". The solution targets encryption, authentication and digital signatures using post-quantum algorithms and will work with the SpaceWire and SpaceFibre protocols, and ESA's connectivity director notes that European national security agencies are urging critical infrastructure to move to post-quantum cryptography ",[23,3031,63],{},[14,3033,3035],{"id":3034},"southeast-asia","Southeast Asia",[19,3037,3038,3039,171],{},"CRN Asia reported in October 2025 that Singapore's Cyber Security Agency released a handbook on migrating to quantum-resistant cryptography and a Quantum Readiness Index, and that Singtel launched what it calls the region's first hybrid quantum network, combining quantum key distribution with post-quantum cryptography and offered as a managed security service through an MOU with Palo Alto Networks ",[23,3040,67],{},[14,3042,500],{"id":499},[19,3044,3045],{},"The trust-anchor problem is the one to plan around. Keys and roots embedded in deployed devices cannot be swapped like a software library, so operators should inventory where non-updatable trust anchors live, require post-quantum support at manufacture for new equipment, and phase key-exchange migration into normal network upgrades.",[14,3047,79],{"id":78},[19,3049,3050],{},"ArcQubit treats the inventory as the starting point, especially for the embedded trust anchors that are hardest to change later. QuCode discovers where vulnerable cryptography and trust roots sit across the network, and QuTrust holds the phased migration plan so key-exchange and device-level work proceed in a defensible order.",{"title":8,"searchDepth":84,"depth":84,"links":3052},[3053,3054,3055,3056,3057,3058],{"id":16,"depth":84,"text":17},{"id":3006,"depth":84,"text":3007},{"id":3022,"depth":84,"text":3023},{"id":3034,"depth":84,"text":3035},{"id":499,"depth":84,"text":500},{"id":78,"depth":84,"text":79},"2026-05-07","Ericsson urges telecom to migrate high-priority systems before 2031 and finish by 2035. Long-lived trust anchors are the hard part. ESA and Singapore show work underway.",[1788,1410],[100,3063],"Communications",{},"\u002Fnews\u002Fcommunications-telecom-quantum-trust-anchors",[3067,3070,3073,3076],{"label":3068,"url":3069},"J. P. Mattsson, E. Thormarker, M. Asadi, and S. Ruohomaa, \"Migrating telecom to quantum-resistant cryptography on a global scale,\" Ericsson Technology Review, May 7, 2026.","https:\u002F\u002Fwww.ericsson.com\u002Fen\u002Freports-and-papers\u002Fericsson-technology-review\u002Farticles\u002Fmigrating-telecom-to-quantum-resistant-cryptography",{"label":3071,"url":3072},"GSMA, \"PQ.03 Post-Quantum Cryptography Guidelines for Telecom Use Cases, version 2.0,\" Nov. 30, 2024.","https:\u002F\u002Fwww.gsma.com\u002Fsolutions-and-impact\u002Ftechnologies\u002Fsecurity\u002Fgsma_resources\u002Fpost-quantum-cryptography-guidelines-for-telecom-use-cases-pq-03-2\u002F",{"label":3074,"url":3075},"European Space Agency, \"ESA partners with Polish technology company to develop a satcom security solution using post-quantum algorithms,\" ESA Connectivity and Secure Communications, Mar. 13, 2025.","https:\u002F\u002Fresilience.esa.int\u002Farchives\u002Fnews\u002Fesa-partners-polish-technology-company-develop-satcom-security-solution-using-postquantum-algorithms",{"label":3077,"url":3078},"A. Raj, \"Singapore gears up for post-quantum cryptography threats,\" CRN Asia, Oct. 24, 2025.","https:\u002F\u002Fwww.crnasia.com\u002Fnews\u002F2025\u002Fcybersecurity\u002Fsingapore-gears-up-for-post-quantum-cryptography-threats",[3080,3083],{"label":3081,"url":3082},"Cloud Providers Ship Hybrid Post-Quantum Encryption as Regulators Set Milestones","\u002Fnews\u002Finformation-technology-cloud-hybrid-post-quantum",{"label":3084,"url":3085},"Hybrid vs Pure Post-Quantum","\u002Fblog\u002Fhybrid-vs-pure-post-quantum",{"title":2993,"description":3060},"Telecom Races to Replace Trust Anchors","communications-telecom-quantum-trust-anchors","news\u002Fcommunications-telecom-quantum-trust-anchors",[546,132,368,549,260],"Ericsson researchers urge telecom operators to migrate high-priority systems before 2031 and finish by 2035, with long-lived trust anchors built into infrastructure today posing the hardest problem, while ESA and Singapore show the work already underway.","57dmRJE6C5AoQn6uiHgYiNu0RHf3kTptgGnxexEL9Ts",{"id":3094,"title":3095,"author":7,"authorTitle":8,"authorUrl":9,"body":3096,"canonical":9,"category":92,"date":3124,"description":3125,"draft":95,"extension":96,"faqs":3126,"findingsSource":9,"geo":3136,"image":417,"industries":3138,"keyFindings":9,"meta":3139,"modified":1920,"navigation":103,"path":3140,"pullquote":9,"recommendations":9,"references":3141,"related":3145,"seo":3152,"seoTitle":3153,"signposts":9,"slug":3154,"stats":9,"stem":3155,"tags":3156,"tldr":3157,"__hash__":3158},"news\u002Fnews\u002Fsouth-korea-widens-pqc-pilots-five-sectors.md","South Korea Widens Post-Quantum Pilots Across Five Sectors",{"type":11,"value":3097,"toc":3121},[3098,3102,3107,3110,3113,3116],[14,3099,3101],{"id":3100},"south-korea-widens-post-quantum-pilots-across-five-sectors","South Korea widens post-quantum pilots across five sectors",[19,3103,3104],{},[383,3105,3106],{},"6 MAY 2026, SEOUL",[19,3108,3109],{},"South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space on 6 May 2026. Expanding across five sectors tests migration in varied real-world settings rather than in a single domain, which surfaces sector-specific challenges early and builds practical experience ahead of a wider rollout.",[19,3111,3112],{},"The expansion aims at cryptographic self-reliance by 2030. South Korea wants the national capability to migrate its critical sectors without depending entirely on foreign technology, a goal that connects to its earlier choice of home-grown algorithms. Pilots across diverse sectors generate the experience that a credible self-reliance target requires.",[19,3114,3115],{},"Running pilots in parallel is deliberate. Each sector has different systems, equipment lifespans and operational constraints, so a telecom pilot reveals different lessons than one in defense or space. Testing five sectors at once builds a fuller picture of what migration demands, which helps the national program avoid surprises when it scales the work beyond the pilots.",[19,3117,3118,3120],{},[383,3119,399],{}," South Korea's five-sector pilot program turns its national plan into hands-on practice and ties the work to a 2030 self-reliance target. The breadth of sectors means the lessons will apply widely across the economy. Organizations in the piloted sectors, and their suppliers, should expect the experience gained here to shape the requirements and timelines of South Korea's broader migration.",{"title":8,"searchDepth":84,"depth":84,"links":3122},[3123],{"id":3100,"depth":84,"text":3101},"2026-05-06","South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space in May 2026, aiming for self-reliance by 2030.",[3127,3130,3133],{"q":3128,"a":3129},"Which sectors do the pilots now cover?","On 6 May 2026, South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space. Expanding across five sectors tests migration in varied real-world settings rather than in a single domain, which surfaces sector-specific challenges early.",{"q":3131,"a":3132},"What is the goal of the expansion?","The expansion aims at cryptographic self-reliance by 2030, building national capability to migrate critical sectors without depending entirely on foreign technology. Pilots across diverse sectors generate practical experience that informs the broader national transition.",{"q":3134,"a":3135},"Why pilot across different sectors?","Each sector has different systems, lifespans and constraints, so a pilot in telecom reveals different lessons than one in defense or space. Running pilots in parallel across five sectors builds a fuller picture of what migration demands before a wider rollout.",[3137],"seoul",[419,3063],{},"\u002Fnews\u002Fsouth-korea-widens-pqc-pilots-five-sectors",[3142],{"label":3143,"url":3144},"Ministry of Science and ICT, Republic of Korea, \"Expansion of post-quantum cryptography pilots,\" May 6, 2026.","https:\u002F\u002Fwww.msit.go.kr\u002Feng\u002Findex.do",[3146,3149],{"label":3147,"url":3148},"South Korea Picks Four Home-Grown Post-Quantum Algorithms","\u002Fnews\u002Fsouth-korea-picks-four-home-grown-pqc-algorithms",{"label":3150,"url":3151},"South Korea Plans a Staged National Post-Quantum Master Plan to 2035","\u002Fnews\u002Fsouth-korea-national-pqc-master-plan",{"title":3095,"description":3125},"South Korea Widens PQC Pilots Across Five Sectors","south-korea-widens-pqc-pilots-five-sectors","news\u002Fsouth-korea-widens-pqc-pilots-five-sectors",[132,546,368,1338,439],"South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space in May 2026, aiming for cryptographic self-reliance by 2030.","9dZDzxDp5-uFpDKe2a8yONhi-POJzm8XmCgc0CcjuOU",{"id":3160,"title":3161,"author":7,"authorTitle":8,"authorUrl":9,"body":3162,"canonical":9,"category":220,"date":3190,"description":3191,"draft":95,"extension":96,"faqs":3192,"findingsSource":9,"geo":3202,"image":417,"industries":3204,"keyFindings":9,"meta":3205,"modified":3206,"navigation":103,"path":3207,"pullquote":9,"recommendations":9,"references":3208,"related":3212,"seo":3219,"seoTitle":3220,"signposts":9,"slug":3221,"stats":9,"stem":3222,"tags":3223,"tldr":3224,"__hash__":3225},"news\u002Fnews\u002Fenisa-reviews-hybrid-pqc-standardization-status.md","ENISA Reviews the State of Hybrid Post-Quantum Standardization",{"type":11,"value":3163,"toc":3187},[3164,3168,3173,3176,3179,3182],[14,3165,3167],{"id":3166},"enisa-reviews-the-state-of-hybrid-post-quantum-standardization","ENISA reviews the state of hybrid post-quantum standardization",[19,3169,3170],{},[383,3171,3172],{},"30 APRIL 2026, ATHENS",[19,3174,3175],{},"The European Union Agency for Cybersecurity, ENISA, reviewed the state of hybrid post-quantum standardization on 30 April 2026. A hybrid scheme combines a classical algorithm with a post-quantum one, so a system stays secure if either later proves weak. The review assessed how far the standardization of two hybrid approaches has progressed.",[19,3177,3178],{},"The headline finding is a gap between the two. Hybrid key agreement is more mature in its standardization, while hybrid signatures lag behind. That distinction matters for organizations weighing hybrid options, because the readiness of a standard affects how confidently they can deploy it and expect interoperability with others.",[19,3180,3181],{},"ENISA frames the document as a status check rather than a recommendation. It describes where standardization stands without telling organizations which scheme to adopt or when. That restraint fits the agency's role here: it informs the European debate on hybrids rather than setting a rule, leaving adoption choices to member states and organizations.",[19,3183,3184,3186],{},[383,3185,399],{}," The review gives European organizations an evidence base for judging hybrid options, confirming that key agreement is further along than signatures. It stops short of a recommendation, so it informs rather than directs. Teams considering hybrid deployments can use it to set realistic expectations about which parts of the hybrid picture are ready and which still need standardization work.",{"title":8,"searchDepth":84,"depth":84,"links":3188},[3189],{"id":3166,"depth":84,"text":3167},"2026-04-30","An April 2026 ENISA review found hybrid key agreement more mature than hybrid signatures, offering a status check rather than a formal recommendation.",[3193,3196,3199],{"q":3194,"a":3195},"What did the ENISA review find?","The April 2026 review found that hybrid key agreement is more mature in its standardization than hybrid signatures, which lag. It describes the state of standardization rather than telling organizations which scheme to adopt, so it is a status check, not a recommendation.",{"q":3197,"a":3198},"What is a hybrid scheme?","A hybrid scheme combines a classical algorithm with a post-quantum one, so a system stays secure if either proves weak. ENISA assessed how far the standardization of hybrid key agreement and hybrid signatures has progressed, which differs between the two.",{"q":3200,"a":3201},"Should organizations act on the review?","The review is informational, not prescriptive. Organizations can use it to understand where hybrid standardization stands, which helps them judge the maturity of options they are considering, but ENISA does not direct a particular choice in this document.",[3203],"athens",[100,228],{},"2026-09-17","\u002Fnews\u002Fenisa-reviews-hybrid-pqc-standardization-status",[3209],{"label":3210,"url":3211},"European Union Agency for Cybersecurity (ENISA), \"Post-Quantum Cryptography: Hybrid Schemes Standardization Status,\" Apr. 30, 2026.","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications",[3213,3216],{"label":3214,"url":3215},"EU Roadmap Sets 2026, 2030 and 2035 Post-Quantum Milestones","\u002Fnews\u002Feu-roadmap-2026-2030-2035-milestones",{"label":3217,"url":3218},"European Commission Recommendation 2024\u002F1101 Urges Coordinated Migration","\u002Fnews\u002Feu-commission-recommendation-2024-1101-coordinated-migration",{"title":3161,"description":3191},"ENISA Reviews Hybrid Post-Quantum Standardization","enisa-reviews-hybrid-pqc-standardization-status","news\u002Fenisa-reviews-hybrid-pqc-standardization-status",[1431,549,438,368,260],"An April 2026 ENISA review found hybrid key agreement more mature than hybrid signatures, offering a status check rather than a recommendation on which to adopt.","x-FYAwOH_2-YWjdf3_kuCbNoB9u3zBpQG5mfxL1yYBo",{"id":3227,"title":3228,"author":7,"authorTitle":8,"authorUrl":9,"body":3229,"canonical":9,"category":220,"date":3288,"description":3289,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3290,"image":9,"industries":3291,"keyFindings":9,"meta":3293,"modified":3294,"navigation":103,"path":3295,"pullquote":9,"recommendations":9,"references":3296,"related":3306,"seo":3310,"seoTitle":3311,"signposts":9,"slug":3312,"stats":9,"stem":3313,"tags":3314,"tldr":3315,"__hash__":3316},"news\u002Fnews\u002Fdams-hydropower-post-quantum-guidance-gap.md","Dam and Hydropower Operators Have Little Dedicated Post-Quantum Guidance",{"type":11,"value":3230,"toc":3280},[3231,3233,3236,3240,3249,3253,3262,3264,3270,3272,3275,3277],[14,3232,17],{"id":16},[19,3234,3235],{},"Dam and hydropower operators have almost no post-quantum guidance written for them. No 2024 to 2026 source in the current reporting discusses post-quantum cryptography for dams directly, and the one dam-specific paper, from December 2023, covers quantum key distribution rather than post-quantum algorithms. Operators therefore have to reason across adjacent critical-infrastructure analysis, that older paper, and European regulation. The honest conclusion is that the sector's control systems carry the same long-lifecycle exposure as other operational technology, but with less tailored advice to lean on.",[14,3237,3239],{"id":3238},"the-critical-infrastructure-read","The critical-infrastructure read",[19,3241,3242,3243,3245,3246,3248],{},"The Bloomsbury Intelligence and Security Institute argued in March 2026 that the quantum debate centers on IT while the larger risk sits in operational technology that still uses RSA ",[23,3244,25],{},". It says resource-constrained devices with long service lives make post-quantum deployment technically and financially hard, that adversaries can collect encrypted OT traffic now and decrypt it later, and that quantum attacks on critical infrastructure look unlikely before 2030 but highly likely over the long term without proactive migration ",[23,3247,25],{},". The report does not name dams, so applying it to them is an inference.",[14,3250,3252],{"id":3251},"the-one-dam-specific-paper","The one dam-specific paper",[19,3254,3255,3256,3258,3259,3261],{},"The only dam-specific work predates the current window. Researchers from Oak Ridge and partner institutions wrote in Sensors in December 2023 that fewer than 3 percent of roughly 80,000 US dams generate power, and that modernization and remote network control widen the attack surface ",[23,3257,29],{},". They propose quantum key distribution as a defense and note that fiber loss and dam noise sources such as turbine vibration complicate deployment, but they do not evaluate post-quantum cryptography ",[23,3260,29],{},". Quantum key distribution is a physics-based approach, distinct from the algorithm migration that NIST standards describe.",[14,3263,1216],{"id":1215},[19,3265,3266,3267,3269],{},"European regulation supplies the supervisory context. An October 2025 International Water Power Magazine analysis says NIS2 places hydropower and dams under critical-infrastructure obligations and requires water utilities to run OT risk management, and it finds interconnected systems 15 to 20 years old carry the highest risk, with smaller utilities disproportionately exposed ",[23,3268,63],{},". That article never mentions quantum, so it supports the legacy-system picture only.",[14,3271,500],{"id":499},[19,3273,3274],{},"With no tailored standard, the defensible path is the general one: inventory where public-key cryptography lives across dam control and monitoring systems, rank by data sensitivity and device replaceability, segment networks to narrow what must migrate first, and require crypto agility in new equipment so a future change does not mean replacing hardware in a live facility.",[14,3276,79],{"id":78},[19,3278,3279],{},"ArcQubit treats discovery as the first move where guidance is thin, because an operator cannot plan around cryptography it has not located. QuCode builds the inventory across OT and IT surfaces, and QuTrust holds the prioritized plan so segmentation and phased upgrades proceed in a defensible order.",{"title":8,"searchDepth":84,"depth":84,"links":3281},[3282,3283,3284,3285,3286,3287],{"id":16,"depth":84,"text":17},{"id":3238,"depth":84,"text":3239},{"id":3251,"depth":84,"text":3252},{"id":1215,"depth":84,"text":1216},{"id":499,"depth":84,"text":500},{"id":78,"depth":84,"text":79},"2026-03-02","No current reporting covers post-quantum cryptography for dams directly. Operators must read across OT analysis, a 2023 QKD paper, and NIS2 to judge their systems.",[736],[100,3292],"Dams",{},"2026-09-05","\u002Fnews\u002Fdams-hydropower-post-quantum-guidance-gap",[3297,3300,3303],{"label":3298,"url":3299},"A. Bamford, \"Assessing Quantum's Risk on Critical Infrastructure,\" Bloomsbury Intelligence and Security Institute, Mar. 2, 2026.","https:\u002F\u002Fbisi.org.uk\u002Freports\u002Fassessing-quantums-risk-on-critical-infrastructure",{"label":3301,"url":3302},"A. Green, J. Lawrence, G. Siopsis, N. A. Peters, and A. Passian, \"Quantum Key Distribution for Critical Infrastructures: Towards Cyber-Physical Security for Hydropower and Dams,\" Sensors, vol. 23, no. 24, Dec. 14, 2023.","https:\u002F\u002Fpar.nsf.gov\u002Fservlets\u002Fpurl\u002F10516696",{"label":3304,"url":3305},"Carrieann, \"Cyber security for water and power: overcoming legacy systems and regulatory pressure,\" International Water Power Magazine, Oct. 1, 2025.","https:\u002F\u002Fwww.waterpowermagazine.com\u002Fanalysis\u002Fcyber-security-for-water-and-power-overcoming-legacy-systems-and-regulatory-pressure\u002F",[3307,3308],{"label":444,"url":525},{"label":3309,"url":1413},"Grid Operators Face a Decade-Long OT Migration",{"title":3228,"description":3289},"Dam Operators Lack Post-Quantum Guidance","dams-hydropower-post-quantum-guidance-gap","news\u002Fdams-hydropower-post-quantum-guidance-gap",[547,546,259,1270,368],"No current reporting addresses post-quantum cryptography for dams directly, so operators must read across critical-infrastructure OT analysis, a 2023 quantum-key-distribution paper, and NIS2 obligations to judge their own long-lived control systems.","wZxrFDfnPgWEkixwO48vIM1XntMcVNtMooV75pOufSM",{"id":3318,"title":3319,"author":7,"authorTitle":8,"authorUrl":9,"body":3320,"canonical":9,"category":220,"date":3288,"description":3375,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3376,"image":9,"industries":3377,"keyFindings":9,"meta":3378,"modified":3379,"navigation":103,"path":3380,"pullquote":9,"recommendations":9,"references":3381,"related":3388,"seo":3391,"seoTitle":3392,"signposts":9,"slug":3393,"stats":9,"stem":3394,"tags":3395,"tldr":3396,"__hash__":3397},"news\u002Fnews\u002Fwater-wastewater-utilities-post-quantum-roadmap.md","Water Utilities Urged to Build Post-Quantum Roadmaps Despite Thin Sector Guidance",{"type":11,"value":3321,"toc":3367},[3322,3324,3327,3331,3340,3342,3348,3350,3355,3359,3362,3364],[14,3323,17],{"id":16},[19,3325,3326],{},"Water and wastewater utilities are being urged to build post-quantum roadmaps, but the sector has thin, mostly adjacent guidance to work from. One source is water-specific but US-only with unconfirmed metadata, and the others cover critical-infrastructure operational technology in general. The practical message is consistent across them: utilities run long-lived operational systems whose cryptography will one day be breakable, so they should start a transition plan aligned to NIST standards now, even without sector-specific rules.",[14,3328,3330],{"id":3329},"the-senate-testimony","The Senate testimony",[19,3332,3333,3334,3336,3337,3339],{},"Written testimony prepared for a US Senate Environment and Public Works hearing on the cybersecurity state of the water sector says advances in quantum computing will make conventional asymmetric cryptography unsafe, and it urges utilities to build a post-quantum transition plan and roadmap aligned to NIST standards and to accelerate compliance with zero-trust and post-quantum expectations ",[23,3335,25],{},". It lists sector weaknesses including tens of thousands of fragmented systems, internet-exposed operational interfaces and legacy operational technology with tight patch windows ",[23,3338,25],{},". The document gives no author or date in its text; both were inferred from the file name, so confirm them before citing.",[14,3341,3239],{"id":3238},[19,3343,3344,3345,3347],{},"The UK's Bloomsbury Intelligence and Security Institute names water-treatment plants among exposed systems in its March 2026 report, arguing that post-quantum deployment is hard on resource-constrained legacy systems with long lifespans, and that quantum attacks on critical infrastructure look unlikely before 2030 but highly likely over the long term without proactive migration ",[23,3346,29],{},". That report addresses critical infrastructure broadly rather than water specifically, so it supports the picture rather than providing sector guidance.",[14,3349,1380],{"id":1379},[19,3351,3352,3353,1386],{},"Trade coverage of the DHS and CISA operational-technology guidance supplies the operating reality. Water appears among OT-reliant sectors, and the guidance points to slow patch cycles, decades-old equipment, unsupported operating systems and strong network segmentation as an effective way to narrow what must migrate first ",[23,3354,63],{},[14,3356,3358],{"id":3357},"what-this-means-for-water-utilities","What this means for water utilities",[19,3360,3361],{},"With little tailored guidance, the defensible path is the general one applied to safety-critical service: inventory where public-key cryptography protects control, monitoring and billing systems, segment networks to narrow the first wave of migration, prioritize internet-exposed interfaces, and write crypto agility into new equipment so a future change does not require replacing hardware across many small sites.",[14,3363,79],{"id":78},[19,3365,3366],{},"ArcQubit treats discovery as the first move for a sector with fragmented systems and thin guidance. QuCode builds the cryptographic inventory across water OT and IT, and QuTrust holds the prioritized plan so segmentation and phased upgrades proceed in a defensible order a regulator or board can follow.",{"title":8,"searchDepth":84,"depth":84,"links":3368},[3369,3370,3371,3372,3373,3374],{"id":16,"depth":84,"text":17},{"id":3329,"depth":84,"text":3330},{"id":3238,"depth":84,"text":3239},{"id":1379,"depth":84,"text":1380},{"id":3357,"depth":84,"text":3358},{"id":78,"depth":84,"text":79},"Testimony for a US Senate hearing urges water utilities to build post-quantum roadmaps aligned to NIST, but dedicated sector guidance remains thin.",[342],[100,523],{},"2026-09-16","\u002Fnews\u002Fwater-wastewater-utilities-post-quantum-roadmap",[3382,3385,3387],{"label":3383,"url":3384},"Written testimony (author and date inferred from file name; unconfirmed), \"The Cybersecurity State of the Water Sector,\" U.S. Senate Committee on Environment and Public Works, Feb. 4, 2026.","https:\u002F\u002Fwww.epw.senate.gov\u002Fpublic\u002F_cache\u002Ffiles\u002F5\u002F3\u002F53d93dfe-ed8c-4e48-b705-0b16cb92c90a\u002FFA38A32EE48D7F3D4B0C069FDC08A69E6327376EB85838A03310B2E91C8582C1.02-04-2026-dr.-simonton-testimony.pdf",{"label":3386,"url":3299},"A. Bamford, \"Assessing Quantum Risk on Critical Infrastructure,\" Bloomsbury Intelligence and Security Institute, Mar. 2, 2026.",{"label":747,"url":529},[3389,3390],{"label":444,"url":525},{"label":3309,"url":1413},{"title":3319,"description":3375},"Water Utilities Urged to Plan for PQC","water-wastewater-utilities-post-quantum-roadmap","news\u002Fwater-wastewater-utilities-post-quantum-roadmap",[547,546,259,132,439],"Testimony prepared for a US Senate hearing urges water utilities to build a post-quantum transition plan aligned to NIST standards, but dedicated sector guidance is thin and most sources address critical-infrastructure operational technology in general.","Zrx7OlGBRink39jBN9geUMQFGN8m8E-KMxsFnD7ati4",{"id":3399,"title":3400,"author":7,"authorTitle":8,"authorUrl":9,"body":3401,"canonical":9,"category":220,"date":3458,"description":3459,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3460,"image":9,"industries":3461,"keyFindings":9,"meta":3463,"modified":3464,"navigation":103,"path":3465,"pullquote":9,"recommendations":9,"references":3466,"related":3476,"seo":3479,"seoTitle":3480,"signposts":9,"slug":3481,"stats":9,"stem":3482,"tags":3483,"tldr":3484,"__hash__":3485},"news\u002Fnews\u002Fnuclear-sector-quantum-resistant-links-research.md","Nuclear Operators Explore Quantum-Resistant Links as Researchers Map Attack Paths",{"type":11,"value":3402,"toc":3450},[3403,3405,3408,3412,3418,3422,3428,3432,3438,3442,3445,3447],[14,3404,17],{"id":16},[19,3406,3407],{},"The nuclear sector has little dedicated post-quantum guidance, and the current reporting is thin and mixed: one preprint models attacks on nuclear plants, one demonstration tests quantum key distribution rather than post-quantum algorithms, and one think-tank piece focuses more on defense and diplomatic systems than civil reactors. The honest read is that researchers are mapping the risk and running early field work, while a sector-wide post-quantum migration plan is not yet visible.",[14,3409,3411],{"id":3410},"modeled-attack-paths","Modeled attack paths",[19,3413,3414,3415,3417],{},"A February 2026 arXiv preprint analyzes quantum attacks on nuclear power plants and reports estimated attack success of 8 to 78 percent under current security postures, falling below 1 percent when full post-quantum migration is combined with a high operational-technology security level ",[23,3416,25],{},". These are the authors' modeled estimates in a preprint that is not peer reviewed, so treat the percentages as illustrative of the direction rather than as measured results. The useful point is relative: strong post-quantum migration plus layered OT security sharply reduces the modeled feasibility.",[14,3419,3421],{"id":3420},"field-work-tests-a-different-technology","Field work tests a different technology",[19,3423,3424,3425,3427],{},"Field demonstrations so far use quantum key distribution, a physics-based approach distinct from post-quantum algorithms. Purdue University, Oak Ridge National Laboratory and Toshiba announced in June 2025 a demonstration of quantum-secured communications at Purdue's research reactor, described as the first US nuclear reactor to integrate such communications, aimed at data exchange for monitoring, control and safety in advanced reactors, especially remote microreactors ",[23,3426,29],{},". Because this is quantum key distribution, it addresses a different part of the problem from the algorithm migration that NIST standards describe, and the two should not be conflated.",[14,3429,3431],{"id":3430},"the-policy-view","The policy view",[19,3433,3434,3435,3437],{},"India offers a regional policy perspective. An Observer Research Foundation piece in April 2025 argued that quantum computers could break the public-key encryption protecting nuclear-related systems, described store-now-decrypt-later collection, and recommended transition to post-quantum standards, dual-layer security and indigenous quantum-resistant infrastructure ",[23,3436,63],{},". Parts of that argument concern weapons command systems and apply only loosely to civil reactors, materials and waste, so read it as adjacent rather than directly on point.",[14,3439,3441],{"id":3440},"what-this-means-for-nuclear-operators","What this means for nuclear operators",[19,3443,3444],{},"With guidance thin, the defensible path is the general one applied carefully to safety-critical systems: inventory where public-key cryptography protects monitoring, control and safety communications, treat quantum key distribution demonstrations as complementary research rather than the migration itself, and plan post-quantum work into the long qualification cycles these facilities already run.",[14,3446,79],{"id":78},[19,3448,3449],{},"ArcQubit treats discovery as the first move where sector guidance is thin and safety margins are tight. QuCode maps where vulnerable cryptography sits across reactor monitoring and control systems, and QuTrust holds the migration plan so changes proceed through the sector's qualification processes in a defensible order.",{"title":8,"searchDepth":84,"depth":84,"links":3451},[3452,3453,3454,3455,3456,3457],{"id":16,"depth":84,"text":17},{"id":3410,"depth":84,"text":3411},{"id":3420,"depth":84,"text":3421},{"id":3430,"depth":84,"text":3431},{"id":3440,"depth":84,"text":3441},{"id":78,"depth":84,"text":79},"2026-02-25","Research models significant quantum-attack success against nuclear plants and reports full PQC migration cuts it sharply. Field demos so far test QKD, not PQC algorithms.",[225],[100,3462],"Nuclear Reactors, Materials, and Waste",{},"2026-09-14","\u002Fnews\u002Fnuclear-sector-quantum-resistant-links-research",[3467,3470,3473],{"label":3468,"url":3469},"Y. Baseri and E. Waller, \"Quantum attacks targeting nuclear power plants: threat analysis, defense and mitigation strategies,\" arXiv:2602.21524v1, Feb. 25, 2026.","https:\u002F\u002Farxiv.org\u002Fpdf\u002F2602.21524v1",{"label":3471,"url":3472},"Toshiba, Purdue University, and Oak Ridge National Laboratory, \"Demonstration of quantum secure communications in a reactor using quantum key distribution,\" Toshiba press release, Jun. 3, 2025.","https:\u002F\u002Fnews.toshiba.com\u002Fpress-releases\u002Fpress-release-details\u002F2025\u002FDemonstration-of-Quantum-Secure-Communications-in-a-Reactor-Using-Quantum-Key-Distribution\u002Fdefault.aspx",{"label":3474,"url":3475},"K. Wadhwa, \"Nuclear security at risk: quantum computing's silent attack,\" Observer Research Foundation, Expert Speak, Apr. 11, 2025.","https:\u002F\u002Fwww.orfonline.org\u002Fexpert-speak\u002Fnuclear-security-at-risk-quantum-computing-s-silent-attack",[3477,3478],{"label":444,"url":525},{"label":246,"url":247},{"title":3400,"description":3459},"Nuclear Sector Explores Quantum-Safe Links","nuclear-sector-quantum-resistant-links-research","news\u002Fnuclear-sector-quantum-resistant-links-research",[546,547,438,259,368],"Research models significant quantum-attack success against nuclear plants under current postures and reports that full post-quantum migration cuts residual feasibility sharply, while field demonstrations so far test quantum key distribution rather than post-quantum algorithms.","kGeaNePKjiUrT1z8RYvXHGHVB1y8vH3jP2FztDSNsbY",{"id":3487,"title":3488,"author":7,"authorTitle":8,"authorUrl":9,"body":3489,"canonical":9,"category":220,"date":3551,"description":3552,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3553,"image":9,"industries":3554,"keyFindings":9,"meta":3555,"modified":3556,"navigation":103,"path":3082,"pullquote":9,"recommendations":9,"references":3557,"related":3570,"seo":3575,"seoTitle":3576,"signposts":9,"slug":3577,"stats":9,"stem":3578,"tags":3579,"tldr":3580,"__hash__":3581},"news\u002Fnews\u002Finformation-technology-cloud-hybrid-post-quantum.md","Cloud Providers Ship Hybrid Post-Quantum Encryption as Regulators Set 2030 and 2035 Milestones",{"type":11,"value":3490,"toc":3543},[3491,3493,3499,3503,3511,3515,3524,3528,3531,3535,3538,3540],[14,3492,17],{"id":16},[19,3494,3495,3496,3498],{},"The information-technology sector owns the cryptography the rest of the economy runs on, and it is already shipping post-quantum protection at scale. Cloudflare reported in February 2026 that more than 60 percent of human-generated TLS traffic to its network already uses hybrid ML-KEM protection ",[23,3497,25],{},". At the same time, UK and EU timelines put the weight of the migration on software, cloud and managed-service providers, because smaller organizations will largely migrate through the products they buy. Cloudflare is a vendor reporting its own deployment data, so read its figures as self-reported.",[14,3500,3502],{"id":3501},"cloud-providers-are-deploying","Cloud providers are deploying",[19,3504,3505,3506,3508,3509,171],{},"Cloudflare announced in February 2026 that it extended hybrid ML-KEM post-quantum key exchange to its IPsec service and the Cloudflare One Appliance, covering its full SASE platform, following the IETF-standardized hybrid model that runs post-quantum key exchange alongside classical Diffie-Hellman ",[23,3507,25],{},". A July 2025 TechTarget survey describes a phased approach at AWS, investment in key-management and HSM services at Google, and post-quantum TLS tunnels at Cloudflare, and it names four obstacles: legacy hardcoded cryptography, missing cryptographic inventories, third-party library and HSM dependencies, and integration complexity ",[23,3510,29],{},[14,3512,3514],{"id":3513},"regulators-set-the-pace","Regulators set the pace",[19,3516,3517,3518,3520,3521,3523],{},"The UK's NCSC sets discovery by 2028, high-priority migration by 2031, and full migration by 2035, and it notes that small and medium enterprises typically migrate through vendor and service upgrades, which puts weight on software vendors and cloud and managed-service providers ",[23,3519,63],{},". The EU applies similar pressure: Member States should start national strategies by the end of 2026, move high-risk use cases by the end of 2030, and finish by 2035 where feasible, with first steps including cryptographic asset management and supply-chain coordination and next steps tied to the Cyber Resilience Act and NIS2 ",[23,3522,67],{},". The EU detail comes from trade coverage rather than the primary text.",[14,3525,3527],{"id":3526},"why-it-carries-the-load","Why IT carries the load",[19,3529,3530],{},"Because so many organizations will migrate through their vendors, the IT sector effectively carries the migration for everyone downstream. That is why the four obstacles the TechTarget survey names, especially missing cryptographic inventories and hardcoded cryptography, matter beyond IT: an unresolved dependency in a widely used product propagates to every customer.",[14,3532,3534],{"id":3533},"what-this-means-for-it-providers","What this means for IT providers",[19,3536,3537],{},"Software, cloud and managed-service providers should expect customers to ask what post-quantum support their products carry and when. The practical steps are to inventory cryptography across the product estate, remove hardcoded algorithms in favor of agile interfaces, and publish a clear post-quantum roadmap customers can plan against.",[14,3539,79],{"id":78},[19,3541,3542],{},"ArcQubit treats discovery and crypto agility as the core problem for IT providers. QuCode builds the cryptographic inventory across the product and infrastructure estate, and QuTrust holds the migration plan so a provider can show customers a current, defensible roadmap rather than a one-off attestation.",{"title":8,"searchDepth":84,"depth":84,"links":3544},[3545,3546,3547,3548,3549,3550],{"id":16,"depth":84,"text":17},{"id":3501,"depth":84,"text":3502},{"id":3513,"depth":84,"text":3514},{"id":3526,"depth":84,"text":3527},{"id":3533,"depth":84,"text":3534},{"id":78,"depth":84,"text":79},"2026-02-23","Cloudflare reports 60%+ of human TLS traffic already uses hybrid post-quantum protection. UK and EU timelines put the migration weight on software and cloud vendors.",[1788,1410,225],[100,228],{},"2026-09-13",[3558,3561,3564,3567],{"label":3559,"url":3560},"S. Goldberg, A. Paul, and D. Gauch, \"Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform,\" Cloudflare Blog, Feb. 23, 2026.","https:\u002F\u002Fblog.cloudflare.com\u002Fpost-quantum-sase\u002F",{"label":3562,"url":3563},"G. Lawton, \"The cloud's role in PQC migration,\" TechTarget, Jul. 7, 2025.","https:\u002F\u002Fwww.techtarget.com\u002Fsearchcloudcomputing\u002Ftip\u002FThe-clouds-role-in-PQC-migration",{"label":3565,"url":3566},"UK National Cyber Security Centre, \"Setting direction for the UK's migration to post-quantum cryptography,\" NCSC blog, Mar. 20, 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsites\u002Fdefault\u002Ffiles\u002Fpdfs\u002Fblog\u002Fsetting-direction-uk-migration-to-pqc.pdf",{"label":3568,"url":3569},"A. Ribeiro, \"EU begins coordinated effort for Member States to switch critical infrastructure to quantum-resistant encryption by 2030,\" Industrial Cyber, Jun. 24, 2025.","https:\u002F\u002Findustrialcyber.co\u002Fregulation-standards-and-compliance\u002Feu-begins-coordinated-effort-for-member-states-to-switch-critical-infrastructure-to-quantum-resistant-encryption-by-2030\u002F",[3571,3574],{"label":3572,"url":3573},"Does Chrome Support Post-Quantum Cryptography?","\u002Fblog\u002Fdoes-chrome-support-post-quantum-cryptography",{"label":3084,"url":3085},{"title":3488,"description":3552},"Cloud Ships Hybrid Post-Quantum TLS","information-technology-cloud-hybrid-post-quantum","news\u002Finformation-technology-cloud-hybrid-post-quantum",[547,132,1809,1431,260],"Cloudflare reports that more than 60 percent of human-generated TLS traffic to its network already uses hybrid post-quantum protection, while UK and EU timelines put weight on software and cloud vendors to carry smaller customers through the migration.","-J7WIAqIxNisOMvpZDCN1iUyPGlW1uWOWfXQ9wLYiNI",{"id":3583,"title":3584,"author":7,"authorTitle":8,"authorUrl":9,"body":3585,"canonical":9,"category":92,"date":3647,"description":3648,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":3649,"image":9,"industries":3651,"keyFindings":9,"meta":3652,"modified":3653,"navigation":103,"path":3654,"pullquote":9,"recommendations":9,"references":3655,"related":3666,"seo":3671,"seoTitle":3672,"signposts":9,"slug":3673,"stats":9,"stem":3674,"tags":3675,"tldr":3676,"__hash__":3677},"news\u002Fnews\u002Fgovernment-facilities-india-eu-singapore-pqc-paths.md","India, the EU, and Singapore Set Public-Sector Paths to Post-Quantum Cryptography",{"type":11,"value":3586,"toc":3639},[3587,3589,3592,3596,3607,3610,3619,3622,3627,3631,3634,3636],[14,3588,17],{"id":16},[19,3590,3591],{},"Governments on three continents have published concrete public-sector paths to post-quantum cryptography, and the dates cluster around the end of the decade. India's task force set 2027 to 2029 milestones for critical information infrastructure, the European Union's coordinated roadmap targets 2030 for high-risk systems, and Singapore released practical tools for agencies and critical-infrastructure owners. This is a well-covered sector with direct, primary-source material from India and the EU alongside trade coverage of Singapore.",[14,3593,3595],{"id":3594},"india","India",[19,3597,3598,3599,3601,3602,3604,3605,171],{},"India's Department of Science and Technology released a task force report in February 2026 covering digital identity, e-governance services, banking, telecom and critical infrastructure ",[23,3600,25],{},". The roadmap has critical information infrastructure sectors such as defense, power and telecom lay foundations by 2027 and finish migration by 2029, with other enterprises following between 2028 and 2033 ",[23,3603,25],{},". It defines four assurance levels and three laboratory tiers for testing post-quantum products, and it prefers indigenously developed solutions while keeping interoperability with global standards ",[23,3606,25],{},[14,3608,2104],{"id":3609},"the-european-union",[19,3611,3612,3613,3615,3616,3618],{},"The EU took a coordinated approach. The Commission's April 2024 recommendation asked Member States to adopt a harmonized transition strategy and a coordinated roadmap within two years, and it explicitly addresses the digital infrastructure and services of public administrations, with progress to be assessed within three years in a way that could lead to binding Union law ",[23,3614,29],{},". The roadmap that followed asks all Member States to start the transition and national strategies by the end of 2026, migrate high-risk critical-infrastructure use cases by the end of 2030, and complete the transition by 2035 where feasible ",[23,3617,63],{},". Both EU sources are trade coverage of the Commission's work, so the dates are reported rather than quoted from the primary text.",[14,3620,3621],{"id":1153},"Singapore",[19,3623,3624,3625,171],{},"Singapore published practical tools. The World Economic Forum reported in November 2025 that the Cyber Security Agency released a handbook on moving to quantum-resistant cryptography and a Quantum Readiness Index self-assessment, built with GovTech Singapore, the Infocomm Media Development Authority and industry, and aimed at critical-infrastructure owners and government agencies ",[23,3626,67],{},[14,3628,3630],{"id":3629},"what-this-means-for-public-sector-bodies","What this means for public-sector bodies",[19,3632,3633],{},"The dates are close enough to act on. Agencies and their suppliers should build a cryptographic inventory now, align migration plans to the relevant national timeline, and use self-assessment tools like Singapore's index to brief leadership. Vendors selling into these governments should expect procurement to ask for cryptographic inventories, crypto agility and testing against the named assurance levels.",[14,3635,79],{"id":78},[19,3637,3638],{},"ArcQubit treats discovery as the first deliverable each of these programs assumes. QuCode builds the cryptographic inventory across public-sector systems, and QuTrust holds the migration plan so an agency can show a current, defensible posture against its national timeline.",{"title":8,"searchDepth":84,"depth":84,"links":3640},[3641,3642,3643,3644,3645,3646],{"id":16,"depth":84,"text":17},{"id":3594,"depth":84,"text":3595},{"id":3609,"depth":84,"text":2104},{"id":1153,"depth":84,"text":3621},{"id":3629,"depth":84,"text":3630},{"id":78,"depth":84,"text":79},"2026-02-04","India's task force sets 2027-2029 milestones, the EU roadmap targets 2030 for high-risk systems, and Singapore published a migration handbook and readiness index.",[3650,1410,1153],"new-delhi",[100,419],{},"2026-09-11","\u002Fnews\u002Fgovernment-facilities-india-eu-singapore-pqc-paths",[3656,3659,3662,3663],{"label":3657,"url":3658},"Department of Science and Technology, Government of India, \"Implementation of Quantum Safe Ecosystem in India: Report of the Task Force,\" Feb. 2026.","https:\u002F\u002Fdst.gov.in\u002Fsites\u002Fdefault\u002Ffiles\u002FReport_TaskForce_PQMigration_4Feb26%20(v1).pdf",{"label":3660,"url":3661},"A. Ribeiro, \"European Commission recommends coordinated implementation roadmap for transition to post-quantum cryptography,\" Industrial Cyber, Apr. 12, 2024.","https:\u002F\u002Findustrialcyber.co\u002Fcritical-infrastructure\u002Feuropean-commission-recommends-coordinated-implementation-roadmap-for-transition-to-post-quantum-cryptography\u002F",{"label":3568,"url":3569},{"label":3664,"url":3665},"A. Joshi, \"Singapore releases quantum readiness tools, and other cybersecurity news,\" World Economic Forum, Nov. 28, 2025.","https:\u002F\u002Fweforum.org\u002Fstories\u002F2025\u002F11\u002Fsingapore-quantum-tools-and-other-cybersecurity-news",[3667,3668],{"label":123,"url":124},{"label":3669,"url":3670},"The US Post-Quantum Cryptography Migration Plan","\u002Fblog\u002Fus-post-quantum-cryptography-migration-plan",{"title":3584,"description":3648},"Public-Sector Post-Quantum Paths Set","government-facilities-india-eu-singapore-pqc-paths","news\u002Fgovernment-facilities-india-eu-singapore-pqc-paths",[439,1431,546,132,368],"India's task force set 2027 to 2029 milestones for critical information infrastructure, the EU coordinated roadmap targets 2030 for high-risk systems, and Singapore published a migration handbook and readiness index for agencies and critical infrastructure.","jJGZMCpGghoQNRrBh-y5MJkfaNnPFi4jjuFUzkHdmJk",{"id":3679,"title":3680,"author":7,"authorTitle":8,"authorUrl":9,"body":3681,"canonical":9,"category":92,"date":3647,"description":3709,"draft":95,"extension":96,"faqs":3710,"findingsSource":9,"geo":3720,"image":417,"industries":3721,"keyFindings":9,"meta":3722,"modified":517,"navigation":103,"path":3723,"pullquote":9,"recommendations":9,"references":3724,"related":3728,"seo":3731,"seoTitle":3732,"signposts":9,"slug":3733,"stats":9,"stem":3734,"tags":3735,"tldr":3736,"__hash__":3737},"news\u002Fnews\u002Findia-task-force-2029-critical-infrastructure-deadline.md","India Task Force Sets a 2029 Deadline for Critical Infrastructure Post-Quantum Migration",{"type":11,"value":3682,"toc":3706},[3683,3687,3692,3695,3698,3701],[14,3684,3686],{"id":3685},"india-task-force-sets-a-2029-critical-infrastructure-deadline","India task force sets a 2029 critical-infrastructure deadline",[19,3688,3689],{},[383,3690,3691],{},"4 FEBRUARY 2026, NEW DELHI",[19,3693,3694],{},"A task force under India's Department of Science and Technology set a staged post-quantum schedule on 4 February 2026. For critical infrastructure, it calls for foundations by 2027, high-priority systems by 2028, and full migration by 2029. Other systems follow on a 2028, 2030 and 2033 schedule, so the national transition proceeds by priority rather than all at once.",[19,3696,3697],{},"The task force also sets expectations for procurement. It calls for a cryptography bill of materials and for crypto agility in purchased systems. That means buyers should ask suppliers for a cryptographic inventory of their products and favour systems that can swap algorithms, embedding post-quantum readiness into purchasing decisions rather than leaving it to later retrofits.",[19,3699,3700],{},"India's 2029 critical-infrastructure target sits earlier than the 2035 horizon several jurisdictions use. The earlier date reflects a focus on protecting the most sensitive systems sooner, while the staged schedule still gives lower-priority systems until 2033. That balance pushes urgency where the risk is highest without demanding the impossible everywhere at once.",[19,3702,3703,3705],{},[383,3704,399],{}," India's task force has set one of the earlier critical-infrastructure deadlines, 2029, and tied readiness to procurement through a cryptography bill of materials and crypto agility. For operators of Indian critical infrastructure, the 2027 foundations milestone is the near-term checkpoint. Suppliers should prepare to provide a cryptographic inventory of their products, since buyers will increasingly ask for one.",{"title":8,"searchDepth":84,"depth":84,"links":3707},[3708],{"id":3685,"depth":84,"text":3686},"An India task force set a 2029 critical-infrastructure post-quantum deadline in February 2026, with foundations by 2027 and crypto agility in procurement.",[3711,3714,3717],{"q":3712,"a":3713},"What deadlines did the India task force set?","The Department of Science and Technology task force set critical-infrastructure foundations by 2027, high-priority systems by 2028, and full critical-infrastructure migration by 2029. Other systems follow on a 2028, 2030 and 2033 schedule, staging the national transition by priority.",{"q":3715,"a":3716},"What does the task force expect in procurement?","The task force calls for a cryptography bill of materials and crypto agility in procurement. That means buyers should ask suppliers for a cryptographic inventory of their products and favour systems that can swap algorithms, embedding readiness into purchasing decisions.",{"q":3718,"a":3719},"Why is 2029 earlier than many other deadlines?","India's 2029 critical-infrastructure target is earlier than the 2035 horizon several jurisdictions use, reflecting a focus on protecting the most sensitive systems sooner. The staged dates still give lower-priority systems until 2033, balancing urgency with practicality.",[3650],[419,100],{},"\u002Fnews\u002Findia-task-force-2029-critical-infrastructure-deadline",[3725],{"label":3726,"url":3727},"Department of Science and Technology, Government of India, \"Task force report on post-quantum cryptography transition,\" Feb. 4, 2026.","https:\u002F\u002Fdst.gov.in\u002F",[3729,3730],{"label":1651,"url":1652},{"label":432,"url":124},{"title":3680,"description":3709},"India Task Force Sets a 2029 PQC Deadline","india-task-force-2029-critical-infrastructure-deadline","news\u002Findia-task-force-2029-critical-infrastructure-deadline",[132,546,133,549,439],"An India task force set a 2029 deadline for critical infrastructure post-quantum migration in February 2026, with foundations by 2027 and crypto agility in procurement.","PT1h8VoDuceJfuIUuwvoEPfO2ErwYSHn4ncvbkJ154k",{"id":3739,"title":3740,"author":7,"authorTitle":8,"authorUrl":9,"body":3741,"canonical":9,"category":92,"date":3769,"description":3770,"draft":95,"extension":96,"faqs":3771,"findingsSource":9,"geo":3781,"image":417,"industries":3783,"keyFindings":9,"meta":3784,"modified":3206,"navigation":103,"path":3785,"pullquote":9,"recommendations":9,"references":3786,"related":3790,"seo":3793,"seoTitle":3794,"signposts":9,"slug":3795,"stats":9,"stem":3796,"tags":3797,"tldr":3798,"__hash__":3799},"news\u002Fnews\u002Fbrazil-adds-pqc-to-icp-brasil-certificates.md","Brazil Adds Post-Quantum Algorithms to Its National Certificate System",{"type":11,"value":3742,"toc":3766},[3743,3747,3752,3755,3758,3761],[14,3744,3746],{"id":3745},"brazil-adds-post-quantum-algorithms-to-its-national-certificate-system","Brazil adds post-quantum algorithms to its national certificate system",[19,3748,3749],{},[383,3750,3751],{},"3 FEBRUARY 2026, BRASILIA",[19,3753,3754],{},"Brazil added post-quantum algorithms to its national certificate system, ICP-Brasil, through Normative Instruction 35, dated 30 January 2026 and published on 3 February 2026. The instruction brings ML-DSA and ML-KEM into the system, and GOV.BR targeted its first advanced signatures using them in the first half of 2026. The change moves Brazil from discussing post-quantum cryptography to embedding it in national infrastructure.",[19,3756,3757],{},"The step carries legal force. Adding the algorithms to ICP-Brasil makes them part of a binding national standard rather than voluntary guidance. Because ICP-Brasil underpins digital signatures and certificates across Brazilian government and commerce, the change reaches a broad base of users who rely on the system for trusted digital identity.",[19,3759,3760],{},"Certificate systems are a natural place to add post-quantum support. ICP-Brasil anchors digital identity and signatures, so enabling it to issue quantum-resistant certificates protects the signatures and identities that depend on it. By making the algorithms available in the national system, Brazil gives its public and private sectors a sanctioned path to quantum-resistant certificates.",[19,3762,3763,3765],{},[383,3764,399],{}," Brazil has made post-quantum algorithms part of a binding national certificate standard, one of the more concrete regulatory steps in the region. Because ICP-Brasil underpins trusted digital identity across the country, the change gives organizations a sanctioned route to quantum-resistant signatures. Entities that rely on ICP-Brasil certificates can plan to adopt the new algorithms as the system and GOV.BR roll them out.",{"title":8,"searchDepth":84,"depth":84,"links":3767},[3768],{"id":3745,"depth":84,"text":3746},"2026-02-03","Brazil added post-quantum algorithms ML-DSA and ML-KEM to its national ICP-Brasil certificate system in early 2026, as a binding national standard.",[3772,3775,3778],{"q":3773,"a":3774},"What did Brazil add to ICP-Brasil?","Through Normative Instruction 35, dated 30 January 2026 and published on 3 February 2026, Brazil added the post-quantum algorithms ML-DSA and ML-KEM to its national certificate system, ICP-Brasil. GOV.BR targeted its first advanced signatures using them in the first half of 2026.",{"q":3776,"a":3777},"Is this a binding standard?","Yes. Adding the algorithms to ICP-Brasil makes them part of a binding national standard, not voluntary guidance. ICP-Brasil underpins digital signatures and certificates across Brazilian government and commerce, so the change carries legal weight.",{"q":3779,"a":3780},"Why does adding PQC to a certificate system matter?","Certificate systems like ICP-Brasil anchor digital identity and signatures. Adding post-quantum algorithms lets the system issue quantum-resistant certificates, which is a concrete step toward protecting the signatures and identities that depend on it against future quantum attack.",[3782],"brasilia",[419,228],{},"\u002Fnews\u002Fbrazil-adds-pqc-to-icp-brasil-certificates",[3787],{"label":3788,"url":3789},"Instituto Nacional de Tecnologia da Informação (ITI), \"Normative Instruction 35 on post-quantum algorithms in ICP-Brasil,\" dated Jan. 30, 2026, published Feb. 3, 2026.","https:\u002F\u002Fwww.gov.br\u002Fiti\u002F",[3791,3792],{"label":2673,"url":2674},{"label":1931,"url":1932},{"title":3740,"description":3770},"Brazil Adds PQC to Its ICP-Brasil Certificate System","brazil-adds-pqc-to-icp-brasil-certificates","news\u002Fbrazil-adds-pqc-to-icp-brasil-certificates",[438,134,132,368,439],"Brazil added post-quantum algorithms ML-DSA and ML-KEM to its national ICP-Brasil certificate system in early 2026, making it a binding national standard.","RjZAAGvycGrsp137v35MV_4XNrmXV8gMy15_dSEUPMQ",{"id":3801,"title":3802,"author":7,"authorTitle":8,"authorUrl":9,"body":3803,"canonical":9,"category":92,"date":3834,"description":3835,"draft":95,"extension":96,"faqs":3836,"findingsSource":9,"geo":3843,"image":417,"industries":3844,"keyFindings":9,"meta":3845,"modified":3846,"navigation":103,"path":2792,"pullquote":9,"recommendations":9,"references":3847,"related":3858,"seo":3861,"seoTitle":2791,"signposts":9,"slug":3862,"stats":9,"stem":3863,"tags":3864,"tldr":3865,"__hash__":3866},"news\u002Fnews\u002Fcisa-post-quantum-product-categories-list.md","CISA Publishes a List of Product Categories That Should Support Post-Quantum Cryptography",{"type":11,"value":3804,"toc":3831},[3805,3809,3814,3817,3820,3823,3826],[14,3806,3808],{"id":3807},"cisa-publishes-a-list-of-product-categories-that-should-support-post-quantum-cryptography","CISA publishes a list of product categories that should support post-quantum cryptography",[19,3810,3811],{},[383,3812,3813],{},"JANUARY 2026, ARLINGTON",[19,3815,3816],{},"CISA released \"Product Categories for Technologies That Use Post-Quantum Cryptography Standards\" in January 2026. Industrial Cyber and Infosecurity Magazine give 26 January 2026. Executive Order 14306, signed 6 June 2025, directed the list. The order kept the CISA product-category list, now due 1 December 2025, and kept the TLS 1.3 deadline of 2 January 2030, but dropped the requirement that agencies write post-quantum support into solicitations for listed categories. WilmerHale's alert agrees that the list obligation survived while the procurement trigger did not. That makes the list advisory in procurement terms.",[19,3818,3819],{},"Industrial Cyber reports categories including cloud services, networking, endpoint security, collaboration, identity and access, enterprise security, computing, data systems and telecommunications. MeriTalk says products must implement FIPS 203, 204 and 205 to qualify. Infosecurity Magazine says the NSA helped compile the list, that the list will be updated regularly, and that automated discovery tools and IoT or operational technology devices fall outside it for now.",[19,3821,3822],{},"MeriTalk and Industrial Cyber quote Acting Director Madhu Gottumukkala saying organizations must prioritize procurement of post-quantum-capable technologies. MeriTalk also quotes former CISA official Garfield Jones predicting that non-post-quantum products will struggle in government sales. CyberScoop reports that experts doubted the list's usefulness, because most listed products address key establishment but not signatures.",[19,3824,3825],{},"Executive Order 14412 of June 2026 later raised the stakes for the same vendors, as covered in its own entry.",[19,3827,3828,3830],{},[383,3829,399],{}," Vendors in the listed categories should expect federal buyers to ask about post-quantum support, even though the order dropped the formal requirement to write it into solicitations. Buyers can use the list as a starting checklist, but the criticism that it covers key establishment more than signatures suggests they should ask vendors about both. Organizations should expect updates.",{"title":8,"searchDepth":84,"depth":84,"links":3832},[3833],{"id":3807,"depth":84,"text":3808},"2026-01-26","CISA's January 2026 list names technology categories that should support post-quantum standards. It is advisory in procurement terms.",[3837,3840],{"q":3838,"a":3839},"Is the list a binding procurement requirement?","Not in procurement terms. The list obligation survived, but the order dropped the requirement that agencies write post-quantum support into solicitations, so the list is advisory. Experts also noted it covers key establishment more than signatures.",{"q":3841,"a":3842},"What should vendors and buyers do?","Vendors in listed categories should expect federal buyers to ask about post-quantum support. Buyers can use the list as a starting checklist, ask vendors about both key establishment and signatures, and expect updates.",[98],[100,419,228],{},"2026-09-21",[3848,3851,3852,3855],{"label":3849,"url":3850},"CyberScoop, \"CISA publishes a post-quantum shopping list for agencies. Security professionals aren't sold,\" Jan. 26, 2026.","https:\u002F\u002Fcyberscoop.com\u002Fcisa-post-quantum-cryptography-procurement-guide-expert-criticism\u002F",{"label":531,"url":532},{"label":3853,"url":3854},"MeriTalk, \"CISA Releases List of Post-Quantum Cryptography Tech Product Categories,\" Jan. 23, 2026.","https:\u002F\u002Fwww.meritalk.com\u002Farticles\u002Fcisa-releases-list-of-post-quantum-cryptography-tech-product-categories\u002F",{"label":3856,"url":3857},"WilmerHale, \"New Executive Order Modifies Cybersecurity Requirements to Be Imposed on Federal Contractors and Subcontractors,\" Jun. 13, 2025.","https:\u002F\u002Fwww.wilmerhale.com\u002Fen\u002Finsights\u002Fclient-alerts\u002F20250613-new-executive-order-modifies-cybersecurity-requirements-to-be-imposed-on-federal-contractors-and-subcontractors",[3859,3860],{"label":2795,"url":2783},{"label":2349,"url":124},{"title":3802,"description":3835},"cisa-post-quantum-product-categories-list","news\u002Fcisa-post-quantum-product-categories-list",[438,134,1338,439],"CISA's January 2026 list names the technology categories that should support post-quantum standards such as FIPS 203, 204 and 205, serving as advisory guidance for procurement.","J2TURze_PvE0gn3RR8JikKKSt_FjSWIwSLmPD4yV92k",{"id":3868,"title":3869,"author":7,"authorTitle":8,"authorUrl":9,"body":3870,"canonical":9,"category":92,"date":3898,"description":3899,"draft":95,"extension":96,"faqs":3900,"findingsSource":9,"geo":3910,"image":417,"industries":3912,"keyFindings":9,"meta":3913,"modified":631,"navigation":103,"path":3914,"pullquote":9,"recommendations":9,"references":3915,"related":3919,"seo":3924,"seoTitle":3925,"signposts":9,"slug":3926,"stats":9,"stem":3927,"tags":3928,"tldr":3929,"__hash__":3930},"news\u002Fnews\u002Fgermany-bsi-advises-against-classic-mceliece.md","Germany's BSI Advises Against Classic McEliece for New Systems",{"type":11,"value":3871,"toc":3895},[3872,3876,3881,3884,3887,3890],[14,3873,3875],{"id":3874},"germanys-bsi-advises-against-classic-mceliece-for-new-systems","Germany's BSI advises against Classic McEliece for new systems",[19,3877,3878],{},[383,3879,3880],{},"23 JANUARY 2026, BONN",[19,3882,3883],{},"Germany's Federal Office for Information Security, the BSI, advised against using Classic McEliece in new systems in the January 2026 update to its Technical Guideline TR-02102-1. The agency cited progress in cryptanalysis as the reason and framed the advice as precautionary. It does not declare the algorithm broken; it steers new systems toward other options as a matter of caution.",[19,3885,3886],{},"The distinction matters. A precautionary warning reflects the BSI's judgment that cryptanalytic progress warrants caution, not a demonstrated break of the scheme. For organizations, that means the guidance shapes forward-looking choices for new systems rather than forcing an emergency replacement of existing ones.",[19,3888,3889],{},"The episode illustrates why crypto agility matters. Guidance about specific algorithms changes as cryptanalysis advances, and an organization that hard-codes one algorithm into its systems must re-engineer them when advice shifts. A system built to swap algorithms can absorb a change like this with far less effort, which is the practical lesson behind the BSI's update.",[19,3891,3892,3894],{},[383,3893,399],{}," The BSI's advice shows that even post-quantum candidates are subject to ongoing scrutiny, and that national agencies will update their recommendations as cryptanalysis progresses. Organizations should read it as a reminder to favour mainstream, well-supported algorithms for new systems and to build crypto agility so that future guidance changes cost less. The precautionary framing means existing Classic McEliece uses need review, not panic.",{"title":8,"searchDepth":84,"depth":84,"links":3896},[3897],{"id":3874,"depth":84,"text":3875},"2026-01-23","Germany's BSI advised in January 2026 against Classic McEliece for new systems, citing cryptanalysis progress, in a precautionary TR-02102-1 update.",[3901,3904,3907],{"q":3902,"a":3903},"What did the BSI advise?","In the January 2026 update to Technical Guideline TR-02102-1, the BSI advised against using Classic McEliece in new systems. The agency cited progress in cryptanalysis and framed the advice as precautionary rather than a response to a broken scheme.",{"q":3905,"a":3906},"Does this mean Classic McEliece is broken?","No. The BSI's advice is precautionary. It reflects caution about cryptanalysis progress rather than a demonstrated break, so the agency steers new systems toward other options without declaring the algorithm insecure for existing uses.",{"q":3908,"a":3909},"What should organizations use instead?","The guidance points organizations toward the mainstream post-quantum choices the BSI supports for new systems. The broader lesson is crypto agility: a system that can swap algorithms can respond to advice like this without a costly re-engineering effort.",[3911],"bonn",[100,228],{},"\u002Fnews\u002Fgermany-bsi-advises-against-classic-mceliece",[3916],{"label":3917,"url":3918},"Bundesamt für Sicherheit in der Informationstechnik (BSI), \"Cryptographic Mechanisms: Recommendations and Key Lengths,\" Technical Guideline TR-02102-1, version 2026-01, Jan. 23, 2026.","https:\u002F\u002Fwww.bsi.bund.de\u002FEN\u002FThemen\u002FUnternehmen-und-Organisationen\u002FStandards-und-Zertifizierung\u002FTechnische-Richtlinien\u002FTR-nach-Thema-sortiert\u002Ftr02102\u002Ftr02102_node.html",[3920,3923],{"label":3921,"url":3922},"France's ANSSI Sets a Phased Hybrid Path to Post-Quantum Cryptography","\u002Fnews\u002Ffrance-anssi-phased-hybrid-path",{"label":2673,"url":2674},{"title":3869,"description":3899},"Germany's BSI Advises Against Classic McEliece","germany-bsi-advises-against-classic-mceliece","news\u002Fgermany-bsi-advises-against-classic-mceliece",[438,549,258,368,260],"Germany's BSI advised in January 2026 against using Classic McEliece in new systems, citing cryptanalysis progress, as a precautionary update to its TR-02102-1 guidance.","A2gvG9CIfOCNGC_3y5zj4itj26FGFJ3D8XxNDyuoHJ8",{"id":3932,"title":3933,"author":7,"authorTitle":8,"authorUrl":9,"body":3934,"canonical":9,"category":220,"date":3962,"description":3963,"draft":95,"extension":96,"faqs":3964,"findingsSource":9,"geo":3974,"image":417,"industries":3976,"keyFindings":9,"meta":3977,"modified":2782,"navigation":103,"path":3978,"pullquote":9,"recommendations":9,"references":3979,"related":3983,"seo":3988,"seoTitle":3989,"signposts":9,"slug":3990,"stats":9,"stem":3991,"tags":3992,"tldr":3993,"__hash__":3994},"news\u002Fnews\u002Feuropol-post-quantum-prioritization-method.md","Europol Publishes a Method for Prioritizing Post-Quantum Migration",{"type":11,"value":3935,"toc":3959},[3936,3940,3945,3948,3951,3954],[14,3937,3939],{"id":3938},"europol-publishes-a-method-for-prioritizing-post-quantum-migration","Europol publishes a method for prioritizing post-quantum migration",[19,3941,3942],{},[383,3943,3944],{},"21 JANUARY 2026, THE HAGUE",[19,3946,3947],{},"Europol published a method for prioritizing post-quantum migration on 21 January 2026. The method ranks systems by three factors: the shelf life of the data they protect, the system's exposure, and the business impact of a compromise. It then weighs that risk against the time each system needs to migrate.",[19,3949,3950],{},"Weighing risk against migration time is the method's key insight. A system that is both high-risk and slow to migrate must start earliest, because it needs urgency and a long runway at once. Ranking this way stops an organization from leaving its hardest, most important systems until last, when there may be too little time left to finish them.",[19,3952,3953],{},"The method answers a practical problem for security leaders. No organization can migrate every system at once, so the order matters. By giving CISOs and their teams a structured way to rank systems on data shelf life, exposure, business impact and migration time, the method turns an overwhelming estate-wide task into a defensible, sequenced plan.",[19,3955,3956,3958],{},[383,3957,399],{}," Europol's method gives security teams a concrete way to decide what to migrate first, rather than guessing. Its core idea, that high-risk and slow-to-migrate systems must start earliest, is one of the most useful planning rules for a long migration. CISOs can apply the shelf-life, exposure, business-impact and migration-time factors to their own inventory to produce a prioritised, time-aware roadmap.",{"title":8,"searchDepth":84,"depth":84,"links":3960},[3961],{"id":3938,"depth":84,"text":3939},"2026-01-21","Europol published a post-quantum prioritization method in January 2026 ranking systems by shelf life, exposure and business impact against migration time.",[3965,3968,3971],{"q":3966,"a":3967},"What does Europol's prioritization method consider?","The method, published on 21 January 2026, ranks systems by three factors: the shelf life of the data, the system's exposure, and the business impact of a compromise. It then weighs that risk against the time each system needs to migrate, so the most urgent and slowest-to-migrate systems rank highest.",{"q":3969,"a":3970},"Why weigh risk against migration time?","A system that is high-risk and slow to migrate must start earliest, because it needs both urgency and a long runway. Weighing risk against migration time prevents an organization from leaving its hardest, most important systems until last, when there may not be time to finish.",{"q":3972,"a":3973},"Who is the method for?","The method helps CISOs and security teams decide the order of migration across many systems. Since no organization can migrate everything at once, a structured way to rank systems by risk and migration time turns an overwhelming task into a defensible plan.",[3975],"the-hague",[227,100],{},"\u002Fnews\u002Feuropol-post-quantum-prioritization-method",[3980],{"label":3981,"url":3982},"Europol, \"A method for prioritizing post-quantum cryptography migration,\" Jan. 21, 2026.","https:\u002F\u002Fwww.europol.europa.eu\u002F",[3984,3987],{"label":3985,"url":3986},"Europol's Quantum Safe Financial Forum Issues a Post-Quantum Call to Action","\u002Fnews\u002Feuropol-qsff-post-quantum-call-to-action",{"label":818,"url":819},{"title":3933,"description":3963},"Europol Publishes a Post-Quantum Prioritization Method","europol-post-quantum-prioritization-method","news\u002Feuropol-post-quantum-prioritization-method",[132,258,133,2862,664],"Europol published a post-quantum prioritization method in January 2026 that ranks systems by shelf life, exposure and business impact, weighing risk against migration time.","eytRa8jkhoZ3wOL34gtm8nEM4VgjtXDlppup9pAjCY8",{"id":3996,"title":3997,"author":7,"authorTitle":8,"authorUrl":9,"body":3998,"canonical":9,"category":92,"date":4026,"description":4027,"draft":95,"extension":96,"faqs":4028,"findingsSource":9,"geo":4038,"image":417,"industries":4039,"keyFindings":9,"meta":4040,"modified":3846,"navigation":103,"path":4041,"pullquote":9,"recommendations":9,"references":4042,"related":4046,"seo":4049,"seoTitle":4050,"signposts":9,"slug":4051,"stats":9,"stem":4052,"tags":4053,"tldr":4054,"__hash__":4055},"news\u002Fnews\u002Feu-commission-nis2-pqc-proposal.md","European Commission Proposes Writing Post-Quantum Migration Into NIS2",{"type":11,"value":3999,"toc":4023},[4000,4004,4009,4012,4015,4018],[14,4001,4003],{"id":4002},"commission-proposes-writing-post-quantum-migration-into-nis2","Commission proposes writing post-quantum migration into NIS2",[19,4005,4006],{},[383,4007,4008],{},"20 JANUARY 2026, BRUSSELS",[19,4010,4011],{},"The European Commission proposed on 20 January 2026, in COM(2026) 13 final, to write the post-quantum transition into NIS2. The proposal would amend the directive so that the national strategies required under Article 7(2)(k) explicitly cover the move to post-quantum cryptography. It sets a 2030 target for critical systems and 2035 for medium-risk systems, matching the risk-based staging the EU roadmap already uses.",[19,4013,4014],{},"The step matters because of its legal weight. The EU roadmap is soft law that sets direction, while NIS2 is a binding directive. Writing the transition into NIS2 would oblige member states to reflect post-quantum migration in the national strategies the directive already requires, turning the roadmap's milestones into a legal expectation rather than a recommendation.",[19,4016,4017],{},"The proposal remains pending. It must pass the EU legislative process before it binds anyone, and member states would then transpose it into national law. Until that happens, the dates carry the Commission's intent rather than legal force, so organizations should track the proposal's progress rather than treat its deadlines as fixed.",[19,4019,4020,4022],{},[383,4021,399],{}," The proposal signals that the European Union intends to give its post-quantum timeline legal teeth through NIS2 rather than leaving it as guidance. If it passes, critical-system operators across the Union would face a 2030 expectation grounded in a binding directive. Organizations in scope of NIS2 should watch the proposal closely and begin discovery now, since the directive route would narrow their room to delay.",{"title":8,"searchDepth":84,"depth":84,"links":4024},[4025],{"id":4002,"depth":84,"text":4003},"2026-01-20","A January 2026 Commission proposal would write post-quantum migration into NIS2 national strategies, with 2030 for critical and 2035 for medium-risk systems.",[4029,4032,4035],{"q":4030,"a":4031},"What would the NIS2 proposal change?","The proposal, COM(2026) 13 final, would amend NIS2 so that Article 7(2)(k) national strategies explicitly cover the post-quantum transition. It would set a 2030 target for critical systems and 2035 for medium-risk systems. The proposal is pending, not yet law.",{"q":4033,"a":4034},"How does this differ from the EU roadmap?","The roadmap is soft law and sets direction. Writing the transition into NIS2 would make it part of a binding directive, so member states would have to reflect the post-quantum transition in the national strategies NIS2 already requires. It raises the legal weight of the timeline.",{"q":4036,"a":4037},"When would it take effect?","The proposal is pending as of early 2026. It must pass the EU legislative process before it binds member states, and member states would then transpose it into national law. Organizations should track its progress rather than treat the dates as settled.",[416],[419,100],{},"\u002Fnews\u002Feu-commission-nis2-pqc-proposal",[4043],{"label":4044,"url":4045},"European Commission, \"Proposal amending Directive (EU) 2022\u002F2555 (NIS2),\" COM(2026) 13 final, Jan. 20, 2026.","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:52026PC0013",[4047,4048],{"label":3214,"url":3215},{"label":1863,"url":1864},{"title":3997,"description":4027},"EU Proposes Writing PQC Migration Into NIS2","eu-commission-nis2-pqc-proposal","news\u002Feu-commission-nis2-pqc-proposal",[1270,1431,132,1338,439],"A January 2026 Commission proposal would write post-quantum migration into NIS2 national strategies, with critical systems by 2030 and medium-risk systems by 2035.","CFcMnkBNlhbM9cTuvja7yWIKSRJRNEjnrxHGRwiphBs",{"id":4057,"title":4058,"author":7,"authorTitle":8,"authorUrl":9,"body":4059,"canonical":9,"category":92,"date":4090,"description":4091,"draft":95,"extension":96,"faqs":4092,"findingsSource":9,"geo":4099,"image":417,"industries":4100,"keyFindings":9,"meta":4101,"modified":3464,"navigation":103,"path":1332,"pullquote":9,"recommendations":9,"references":4102,"related":4105,"seo":4108,"seoTitle":4109,"signposts":9,"slug":4110,"stats":9,"stem":4111,"tags":4112,"tldr":4113,"__hash__":4114},"news\u002Fnews\u002Fg7-financial-sector-post-quantum-roadmap-2030-2032.md","The G7 Financial-Sector Roadmap Sets a 2030 to 2032 Target for Critical Systems",{"type":11,"value":4060,"toc":4087},[4061,4065,4070,4073,4076,4079,4082],[14,4062,4064],{"id":4063},"g7-financial-sector-roadmap-sets-2030-to-2032-target-for-critical-systems","G7 financial-sector roadmap sets 2030 to 2032 target for critical systems",[19,4066,4067],{},[383,4068,4069],{},"12 JANUARY 2026, WASHINGTON",[19,4071,4072],{},"The G7 Cyber Expert Group published \"Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector\" in January 2026, and the PDF sits on the US Treasury's website. The group says it developed the roadmap to encourage a coordinated approach to migrating the financial sector to quantum-resistant cryptography.",[19,4074,4075],{},"The document sets out six phases or activities: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring. The target for migrating critical systems is 2030 to 2032, with 2035 as the overall date for the sector.",[19,4077,4078],{},"The roadmap says it is not intended to be prescriptive, in the document's words, and lets organizations adapt timelines to risk profile and system complexity. It is therefore voluntary guidance, not a binding rule.",[19,4080,4081],{},"Financial authorities and entities of all sizes, third-party service providers and vendors, infrastructure operators, national cyber agencies and standards bodies are affected. The roadmap promotes risk-based prioritization, interoperability and international collaboration.",[19,4083,4084,4086],{},[383,4085,399],{}," Banks and fintechs now have a shared sector reference for sequencing work and for talking to supervisors, with 2030 to 2032 for critical systems and 2035 for the sector. Although the roadmap is not prescriptive, organizations should expect supervisors and counterparties to use it as a benchmark. Third-party providers should expect their financial clients to ask about their migration plans.",{"title":8,"searchDepth":84,"depth":84,"links":4088},[4089],{"id":4063,"depth":84,"text":4064},"2026-01-12","The G7 Cyber Expert Group's January 2026 roadmap sets 2030 to 2032 for migrating critical financial systems and 2035 for the sector. It is voluntary.",[4093,4096],{"q":4094,"a":4095},"Is the G7 roadmap binding?","No. The roadmap says it is not intended to be prescriptive and lets organizations adapt timelines to risk profile and system complexity. It is voluntary guidance, though supervisors and counterparties may use it as a benchmark.",{"q":4097,"a":4098},"What are the six phases?","Awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring. Third-party providers should expect financial clients to ask about their plans.",[342],[227,100],{},[4103],{"label":4104,"url":641},"U.S. Department of the Treasury (G7 Cyber Expert Group), \"Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector,\" Jan. 2026.",[4106,4107],{"label":659,"url":637},{"label":1174,"url":1157},{"title":4058,"description":4091},"G7 Financial Sector Roadmap Targets 2030 to 2032","g7-financial-sector-post-quantum-roadmap-2030-2032","news\u002Fg7-financial-sector-post-quantum-roadmap-2030-2032",[257,438,2157,258,664],"The G7 Cyber Expert Group's January 2026 roadmap sets 2030 to 2032 for migrating critical financial systems and 2035 for the sector, and it is voluntary.","gd2UQLSnF4fNHsAsNDJNcE22hI35aVB-u9ZQucTTHtk",{"id":4116,"title":2981,"author":7,"authorTitle":8,"authorUrl":9,"body":4117,"canonical":9,"category":92,"date":4145,"description":4146,"draft":95,"extension":96,"faqs":4147,"findingsSource":9,"geo":4157,"image":417,"industries":4159,"keyFindings":9,"meta":4160,"modified":631,"navigation":103,"path":2982,"pullquote":9,"recommendations":9,"references":4161,"related":4165,"seo":4169,"seoTitle":4170,"signposts":9,"slug":4171,"stats":9,"stem":4172,"tags":4173,"tldr":4146,"__hash__":4174},"news\u002Fnews\u002Fcentral-bank-of-jordan-pqc-roadmap-for-banks.md",{"type":11,"value":4118,"toc":4142},[4119,4123,4128,4131,4134,4137],[14,4120,4122],{"id":4121},"central-bank-of-jordan-issues-a-post-quantum-roadmap-for-banks","Central Bank of Jordan issues a post-quantum roadmap for banks",[19,4124,4125],{},[383,4126,4127],{},"4 JANUARY 2026, AMMAN",[19,4129,4130],{},"The Central Bank of Jordan issued a post-quantum roadmap for banks on 4 January 2026. The roadmap covers risk registers, governance, cryptographic inventory, prioritization, pilots and full adoption. It gives banks a complete sequence of steps to follow, though it does not attach a dated target to the work.",[19,4132,4133],{},"The roadmap emphasises method over deadline. It sets out what banks should do and in what order, from establishing governance and inventorying cryptography, through prioritising by risk and running pilots, to full adoption. Leaving the timing open lets banks progress at a realistic pace while still following a defined path.",[19,4135,4136],{},"A stepwise structure carries practical value. It prevents a bank from attempting full migration before it understands its own estate, which is a common way migrations go wrong. By placing governance and inventory first and pilots before full adoption, the roadmap steers banks through the work in an order that reduces the risk of costly missteps.",[19,4138,4139,4141],{},[383,4140,399],{}," The Central Bank of Jordan gives its banks a clear, ordered method for post-quantum migration, even without a deadline attached. The sequence, governance, inventory, prioritization, pilots, adoption, matches the practical reality of how migrations succeed. Jordanian banks can start with governance and inventory now, following the roadmap's order so that each step rests on the one before it.",{"title":8,"searchDepth":84,"depth":84,"links":4143},[4144],{"id":4121,"depth":84,"text":4122},"2026-01-04","The Central Bank of Jordan issued a post-quantum roadmap for banks in January 2026, covering governance, inventory, prioritization and pilots, without a dated target.",[4148,4151,4154],{"q":4149,"a":4150},"What does the Jordan roadmap cover?","The Central Bank of Jordan's roadmap, issued on 4 January 2026, covers risk registers, governance, cryptographic inventory, prioritization, pilots and full adoption. It gives banks a complete sequence of steps, though it does not attach a dated target to them.",{"q":4152,"a":4153},"Does the roadmap set a deadline?","No. The roadmap sets out the steps banks should take without a dated end target. It focuses on the method, from governance and inventory through pilots to full adoption, leaving the timing for banks to work through as they progress.",{"q":4155,"a":4156},"What is the value of a stepwise roadmap?","A stepwise roadmap gives banks a clear order of work: establish governance, inventory cryptography, prioritise by risk, pilot, then adopt fully. That sequence prevents banks from attempting full migration before they understand their estate, which lowers the risk of costly missteps.",[4158],"amman",[227,100],{},[4162],{"label":4163,"url":4164},"Central Bank of Jordan, \"Post-quantum cryptography roadmap for banks,\" Jan. 4, 2026.","https:\u002F\u002Fwww.cbj.gov.jo\u002F",[4166,4167],{"label":1928,"url":1929},{"label":4168,"url":2974},"UAE Launches a National Cryptography Discovery Platform",{"title":2981,"description":4146},"Central Bank of Jordan Issues a PQC Roadmap for Banks","central-bank-of-jordan-pqc-roadmap-for-banks","news\u002Fcentral-bank-of-jordan-pqc-roadmap-for-banks",[257,132,133,368,260],"XlBcwlYeOQobiEZ3lW5pjrBOzk6K5UOdulrWqoT9daE",{"id":4176,"title":4177,"author":7,"authorTitle":8,"authorUrl":9,"body":4178,"canonical":9,"category":92,"date":4206,"description":4207,"draft":95,"extension":96,"faqs":4208,"findingsSource":9,"geo":4218,"image":417,"industries":4220,"keyFindings":9,"meta":4221,"modified":631,"navigation":103,"path":4222,"pullquote":9,"recommendations":9,"references":4223,"related":4227,"seo":4230,"seoTitle":4231,"signposts":9,"slug":4232,"stats":9,"stem":4233,"tags":4234,"tldr":4235,"__hash__":4236},"news\u002Fnews\u002Fafrican-consortium-readiness-paper-regional-alliance.md","African Consortium Issues a Post-Quantum Readiness Paper and Forms a Regional Alliance",{"type":11,"value":4179,"toc":4203},[4180,4184,4189,4192,4195,4198],[14,4181,4183],{"id":4182},"african-consortium-issues-a-post-quantum-readiness-paper-and-forms-an-alliance","African consortium issues a post-quantum readiness paper and forms an alliance",[19,4185,4186],{},[383,4187,4188],{},"1 JANUARY 2026, ABUJA",[19,4190,4191],{},"An African consortium issued a post-quantum readiness white paper in 2026 and helped form a regional alliance, the African Quantum Cybersecurity Society Alliance. The work highlights the scale of mobile money across the continent and points organizations to free migration tools. It frames post-quantum readiness as relevant to Africa's financial inclusion, not only to large institutions.",[19,4193,4194],{},"Mobile money gives the paper its focus. Because so many people across Africa use mobile money, the cryptography protecting it secures a large share of everyday financial activity. The paper highlights that scale to show why migration matters widely, since a weakness in the cryptography behind mobile money would reach far beyond any single bank.",[19,4196,4197],{},"The emphasis on free tools reflects practical constraints. The paper points to CBOMkit, the Open Quantum Safe project and the PQ Code Package, all available at no cost. Free tools lower the barrier to starting migration where budgets for specialised cryptographic software are limited, so organizations can begin discovery and testing without a large upfront spend.",[19,4199,4200,4202],{},[383,4201,399],{}," The African consortium's work adapts post-quantum readiness to the continent's context, stressing mobile money's reach and pointing to free tools that make a start affordable. Forming a regional alliance builds the shared capacity that smaller organizations lack on their own. Organizations across Africa can use the referenced free tools to begin cryptographic discovery now, regardless of budget.",{"title":8,"searchDepth":84,"depth":84,"links":4204},[4205],{"id":4182,"depth":84,"text":4183},"2026-01-01","An African consortium issued a post-quantum readiness white paper and formed a regional alliance in 2026, citing mobile money scale and free migration tools.",[4209,4212,4215],{"q":4210,"a":4211},"What did the African consortium publish?","In 2026, the Africa Quantum Consortium published a post-quantum readiness white paper and helped form the African Quantum Cybersecurity Society Alliance. The work highlights the scale of mobile money on the continent and points to free migration tools organizations can use.",{"q":4213,"a":4214},"Why does mobile money feature in the paper?","Mobile money is widely used across Africa, so the cryptography protecting it secures a large share of everyday financial activity. The paper highlights that scale to show why post-quantum readiness matters for the continent's financial inclusion, not just for large institutions.",{"q":4216,"a":4217},"Which free tools does the paper reference?","The paper points to free tools including CBOMkit, the Open Quantum Safe project, and the PQ Code Package. Free tools lower the cost barrier to starting migration, which matters where budgets for specialised cryptographic software are limited.",[4219],"abuja",[227,100],{},"\u002Fnews\u002Fafrican-consortium-readiness-paper-regional-alliance",[4224],{"label":4225,"url":4226},"Africa Quantum Consortium (AQC) and African Quantum Cybersecurity Society Alliance (AQCSA), \"Post-quantum readiness white paper,\" 2026.","https:\u002F\u002Fafricaquantumconsortium.org\u002F",[4228,4229],{"label":4168,"url":2974},{"label":2981,"url":2982},{"title":4177,"description":4207},"African Consortium Issues PQC Readiness Paper","african-consortium-readiness-paper-regional-alliance","news\u002Fafrican-consortium-readiness-paper-regional-alliance",[368,132,257,133,260],"An African consortium issued a post-quantum readiness white paper and formed a regional alliance in 2026, pointing to mobile money scale and free migration tools.","f-b69Ke07AO2tGoSOsNoXxgWdFoKeWhogTRbTdgDLZI",{"id":4238,"title":4239,"author":7,"authorTitle":8,"authorUrl":9,"body":4240,"canonical":9,"category":220,"date":4268,"description":4269,"draft":95,"extension":96,"faqs":4270,"findingsSource":9,"geo":4280,"image":417,"industries":4281,"keyFindings":9,"meta":4282,"modified":3653,"navigation":103,"path":4283,"pullquote":9,"recommendations":9,"references":4284,"related":4288,"seo":4293,"seoTitle":4294,"signposts":9,"slug":4295,"stats":9,"stem":4296,"tags":4297,"tldr":4298,"__hash__":4299},"news\u002Fnews\u002Fgermany-bsi-expects-crqc-around-2040.md","Germany's BSI Expects a Cryptographically Relevant Quantum Computer Around 2040",{"type":11,"value":4241,"toc":4265},[4242,4246,4251,4254,4257,4260],[14,4243,4245],{"id":4244},"germanys-bsi-expects-a-cryptographically-relevant-quantum-computer-around-2040","Germany's BSI expects a cryptographically relevant quantum computer around 2040",[19,4247,4248],{},[383,4249,4250],{},"1 DECEMBER 2025, BONN",[19,4252,4253],{},"Germany's Federal Office for Information Security, the BSI, estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040. Such a machine could break the public-key cryptography that secures most systems today. The BSI describes a roughly 15-year path and notes it could compress to about 10 years if progress accelerates.",[19,4255,4256],{},"A 2040 estimate does not mean organizations can wait until then. The harvest-now-decrypt-later risk means an adversary can record encrypted data today and decrypt it once the machine exists, so any data that must stay confidential past 2040 is already exposed. The possibility that the timeline compresses to around 2035 narrows that safe window further.",[19,4258,4259],{},"The BSI's central estimate sits later than some peers. The Dutch AIVD, for instance, has said Q-Day could come by 2030. That spread across agencies reflects genuine uncertainty about the pace of quantum hardware, and it is precisely why national guidance tends to stress starting migration now rather than timing it to any single forecast.",[19,4261,4262,4264],{},[383,4263,399],{}," The BSI's 2040 estimate, with a possible compression to 2035 or so, sets a planning horizon for German organizations without licensing delay. Because harvest-now-decrypt-later already threatens long-lived data, the relevant question is how long an organization's data must stay secret, not when a quantum computer arrives. Teams protecting data with a long confidentiality life should treat the estimate as a reason to act now.",{"title":8,"searchDepth":84,"depth":84,"links":4266},[4267],{"id":4244,"depth":84,"text":4245},"2025-12-01","Germany's BSI estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040, a 15-year path that may compress to 10.",[4271,4274,4277],{"q":4272,"a":4273},"When does the BSI expect a CRQC?","In December 2025 the BSI estimated that a cryptographically relevant quantum computer, one able to break current public-key cryptography, could arrive around 2040. It describes a roughly 15-year path that could compress to about 10 years if progress accelerates.",{"q":4275,"a":4276},"Does a 2040 estimate mean organizations can wait?","No. The harvest-now-decrypt-later risk means data recorded today can be decrypted once a CRQC exists, so data that must stay secret past 2040 is already exposed. The estimate is also uncertain and could compress to around 2035, which narrows the safe window further.",{"q":4278,"a":4279},"How does this compare to other estimates?","The BSI's 2040 central estimate is later than some, such as the Dutch AIVD's view that Q-Day could come by 2030. The range across agencies reflects genuine uncertainty, which is why guidance stresses starting migration now rather than timing it to a single forecast.",[3911],[100,228],{},"\u002Fnews\u002Fgermany-bsi-expects-crqc-around-2040",[4285],{"label":4286,"url":4287},"Bundesamt für Sicherheit in der Informationstechnik (BSI), \"Status of quantum computer development,\" Dec. 2025.","https:\u002F\u002Fwww.bsi.bund.de\u002FEN\u002F",[4289,4292],{"label":4290,"url":4291},"Dutch AIVD, CWI and TNO Publish a Post-Quantum Migration Handbook","\u002Fnews\u002Fdutch-aivd-cwi-tno-migration-handbook",{"label":818,"url":819},{"title":4239,"description":4269},"Germany's BSI Expects a CRQC Around 2040","germany-bsi-expects-crqc-around-2040","news\u002Fgermany-bsi-expects-crqc-around-2040",[258,259,368,2862,260],"Germany's BSI estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040, a 15-year path that could compress to about 10 years.","YQUSa93SjNkxI0ELR_Ezio7VoBGSp5bXCACVBF6zAoM",{"id":4301,"title":4302,"author":7,"authorTitle":8,"authorUrl":9,"body":4303,"canonical":9,"category":220,"date":4268,"description":4331,"draft":95,"extension":96,"faqs":4332,"findingsSource":9,"geo":4342,"image":417,"industries":4343,"keyFindings":9,"meta":4344,"modified":740,"navigation":103,"path":4345,"pullquote":9,"recommendations":9,"references":4346,"related":4350,"seo":4355,"seoTitle":4356,"signposts":9,"slug":4357,"stats":9,"stem":4358,"tags":4359,"tldr":4360,"__hash__":4361},"news\u002Fnews\u002Fidb-oas-2025-cybersecurity-report.md","IDB and OAS 2025 Cybersecurity Report Finds Progress and Persistent Gaps",{"type":11,"value":4304,"toc":4328},[4305,4309,4314,4317,4320,4323],[14,4306,4308],{"id":4307},"idb-and-oas-2025-cybersecurity-report-finds-progress-and-persistent-gaps","IDB and OAS 2025 cybersecurity report finds progress and persistent gaps",[19,4310,4311],{},[383,4312,4313],{},"1 DECEMBER 2025, WASHINGTON",[19,4315,4316],{},"The Inter-American Development Bank and the Organization of American States published a cybersecurity report for Latin America and the Caribbean in December 2025. It found that cyber maturity across the region improved, while gaps persisted in software quality, critical infrastructure protection and cyber insurance. The report pairs a picture of progress with a clear list of weaknesses that remain.",[19,4318,4319],{},"Those gaps bear directly on quantum readiness. Critical infrastructure protection and software quality are the same foundations that post-quantum migration depends on, since migration touches the software and systems a region runs. A region that closes these gaps builds the base that quantum readiness needs, so the report's findings describe the groundwork for future quantum work even without naming it.",[19,4321,4322],{},"The joint authorship gives the report regional weight. The IDB and the OAS both operate across the Americas, so their shared assessment helps governments benchmark their cyber maturity against neighbours and see where they stand. A common regional yardstick makes it easier for countries to identify and prioritise the gaps most worth closing.",[19,4324,4325,4327],{},[383,4326,399],{}," The IDB and OAS report shows Latin American and Caribbean cyber maturity rising while flagging gaps in software quality, infrastructure protection and insurance. Those gaps matter for quantum readiness because migration rests on the same foundations. Governments in the region can use the report to target the weaknesses that would most hinder a future post-quantum transition, strengthening the base before the specialised work begins.",{"title":8,"searchDepth":84,"depth":84,"links":4329},[4330],{"id":4307,"depth":84,"text":4308},"A December 2025 IDB and OAS report found Latin American and Caribbean cyber maturity improving but flagged gaps in software quality and infrastructure protection.",[4333,4336,4339],{"q":4334,"a":4335},"What did the IDB and OAS 2025 report find?","The December 2025 report found that cyber maturity across Latin America and the Caribbean improved, while gaps persisted in software quality, critical infrastructure protection and cyber insurance. It gives a regional picture of progress alongside the weaknesses still to address.",{"q":4337,"a":4338},"How do these gaps relate to quantum readiness?","Weaknesses in critical infrastructure protection and software quality are the same foundations that post-quantum migration depends on. A region that strengthens these areas builds the base needed for quantum readiness, so the gaps the report flags also shape future quantum preparation.",{"q":4340,"a":4341},"Who produced the report?","The Inter-American Development Bank and the Organization of American States produced it jointly. Both work across the Americas, so their shared assessment carries regional weight and helps governments benchmark their cyber maturity against neighbours.",[342],[419,100],{},"\u002Fnews\u002Fidb-oas-2025-cybersecurity-report",[4347],{"label":4348,"url":4349},"Inter-American Development Bank and Organization of American States, \"Cybersecurity report for Latin America and the Caribbean 2025,\" Dec. 2025.","https:\u002F\u002Fwww.iadb.org\u002F",[4351,4354],{"label":4352,"url":4353},"Caribbean Updates Its Cybersecurity Action Plan With an Incident Response Pillar","\u002Fnews\u002Fcaribbean-updated-cybersecurity-action-plan",{"label":1931,"url":1932},{"title":4302,"description":4331},"IDB and OAS 2025 Cybersecurity Report Finds Gaps","idb-oas-2025-cybersecurity-report","news\u002Fidb-oas-2025-cybersecurity-report",[546,368,1078,258,439],"A December 2025 IDB and OAS report found Latin American and Caribbean cyber maturity improving but flagged gaps in software quality, critical infrastructure protection and cyber insurance.","gewnAD9Chxc7cHMJGDyE_qyeVhZOXvXvWtxkDPRN3yw",{"id":4363,"title":2056,"author":7,"authorTitle":8,"authorUrl":9,"body":4364,"canonical":9,"category":220,"date":4268,"description":4392,"draft":95,"extension":96,"faqs":4393,"findingsSource":9,"geo":4403,"image":417,"industries":4404,"keyFindings":9,"meta":4405,"modified":3464,"navigation":103,"path":2057,"pullquote":9,"recommendations":9,"references":4406,"related":4410,"seo":4415,"seoTitle":4416,"signposts":9,"slug":4417,"stats":9,"stem":4418,"tags":4419,"tldr":4420,"__hash__":4421},"news\u002Fnews\u002Fproject-leap-tests-pq-signatures-payments.md",{"type":11,"value":4365,"toc":4389},[4366,4370,4375,4378,4381,4384],[14,4367,4369],{"id":4368},"project-leap-tests-post-quantum-signatures-in-live-payment-systems","Project Leap tests post-quantum signatures in live payment systems",[19,4371,4372],{},[383,4373,4374],{},"1 DECEMBER 2025, BASEL",[19,4376,4377],{},"Project Leap completed its second phase in December 2025, testing post-quantum signatures in live payment systems. The BIS Innovation Hub ran the work with the Banque de France, the Bundesbank, Banca d'Italia, Nexi-Colt and Swift. By involving real institutions and real infrastructure, the project moved post-quantum cryptography out of the laboratory and into practical payment settings.",[19,4379,4380],{},"The headline finding is encouraging but qualified. Post-quantum signatures work in live payment systems, but they add processing time compared with current cryptography. That result points to a real-world cost, which helps institutions plan for the performance impact of migration rather than discover it late in their own rollouts.",[19,4382,4383],{},"Testing in live systems is what gives the finding its value. Laboratory tests cannot fully reveal how new cryptography behaves under real payment loads and integrations, so running the signatures through actual systems with real institutions surfaces practical issues like processing time. Those are exactly the issues institutions need to understand before committing to a full migration.",[19,4385,4386,4388],{},[383,4387,399],{}," Project Leap gives the financial sector hard evidence that post-quantum signatures function in live payment systems, along with a clear caveat about added processing time. That combination lets institutions plan realistically, budgeting for performance effects instead of assuming a seamless swap. The involvement of major central banks and Swift signals that the sector is actively testing migration, not just discussing it.",{"title":8,"searchDepth":84,"depth":84,"links":4390},[4391],{"id":4368,"depth":84,"text":4369},"Project Leap completed its second phase in December 2025, testing post-quantum signatures in live payment systems; they work but add processing time.",[4394,4397,4400],{"q":4395,"a":4396},"What did Project Leap test?","Project Leap tested post-quantum signatures in live payment systems. Its second phase, completed in December 2025, involved the BIS Innovation Hub with the Banque de France, Bundesbank, Banca d'Italia, Nexi-Colt and Swift, demonstrating post-quantum cryptography in real payment infrastructure.",{"q":4398,"a":4399},"What did phase 2 find?","The test showed that post-quantum signatures work in live payment systems but add processing time compared with current cryptography. That finding is useful because it points to a real-world cost, helping institutions plan for the performance impact of migration.",{"q":4401,"a":4402},"Why test in live payment systems?","Laboratory tests cannot fully reveal how new cryptography behaves under real payment loads and integrations. Testing in live systems, with real institutions, surfaces practical issues like processing time that institutions must account for before committing to a full migration.",[1152],[227,228],{},[4407],{"label":4408,"url":4409},"BIS Innovation Hub, \"Project Leap: quantum-proofing the financial system, phase 2,\" Dec. 2025.","https:\u002F\u002Fwww.bis.org\u002Fabout\u002Fbisih\u002Ftopics\u002Fcyber_security\u002Fleap.htm",[4411,4414],{"label":4412,"url":4413},"BIS Papers No. 158 Urges Banks to Start Post-Quantum Work Now","\u002Fnews\u002Fbis-papers-158-start-post-quantum-now",{"label":1331,"url":1332},{"title":2056,"description":4392},"Project Leap Tests PQ Signatures in Live Payments","project-leap-tests-pq-signatures-payments","news\u002Fproject-leap-tests-pq-signatures-payments",[257,438,368,2862,260],"Project Leap completed its second phase in December 2025, testing post-quantum signatures in live payment systems and finding they work but add processing time.","yEPQ8QaZloo25HnNBEyDrrqteadg3jQOT03Ifj6mXl4",{"id":4423,"title":4424,"author":7,"authorTitle":8,"authorUrl":9,"body":4425,"canonical":9,"category":92,"date":4268,"description":4453,"draft":95,"extension":96,"faqs":4454,"findingsSource":9,"geo":4464,"image":417,"industries":4466,"keyFindings":9,"meta":4467,"modified":3653,"navigation":103,"path":4468,"pullquote":9,"recommendations":9,"references":4469,"related":4473,"seo":4476,"seoTitle":4477,"signposts":9,"slug":4478,"stats":9,"stem":4479,"tags":4480,"tldr":4481,"__hash__":4482},"news\u002Fnews\u002Fsaudi-ncs-pqc-update-pending.md","Saudi National Cryptographic Standards Do Not Yet Accept Post-Quantum Algorithms",{"type":11,"value":4426,"toc":4450},[4427,4431,4436,4439,4442,4445],[14,4428,4430],{"id":4429},"saudi-national-cryptographic-standards-do-not-yet-accept-post-quantum-algorithms","Saudi national cryptographic standards do not yet accept post-quantum algorithms",[19,4432,4433],{},[383,4434,4435],{},"1 DECEMBER 2025, RIYADH",[19,4437,4438],{},"Saudi Arabia's National Cryptographic Standards, in the NCS-1:2020 version, do not yet accept post-quantum algorithms. An updated version, NCS-2:2025, went to consultation in December 2025, but it had not reached final status as of early 2026. Until the authority finalises the update, the accepted set of algorithms under Saudi standards stays the same.",[19,4440,4441],{},"The pending status matters for organizations that follow the standards. While NCS-2:2025 remains in consultation, the 2020 standards stay in effect, so an organization cannot yet rely on Saudi standards to sanction post-quantum algorithms. Tracking the update tells an organization when that will change and which algorithms the final version will accept.",[19,4443,4444],{},"The situation does not force organizations to wait on everything, though. Cryptographic discovery and migration planning are independent of which specific algorithms a final standard accepts. An organization can map where it uses cryptography and plan its transition now, so that it can adopt post-quantum algorithms promptly once the updated standard permits them.",[19,4446,4447,4449],{},[383,4448,399],{}," Saudi Arabia's standards sit at a transition point: the current standards do not yet accept post-quantum algorithms, but an update is working through consultation. Organizations following the standards should watch NCS-2:2025 closely to know when the accepted set changes. In the meantime, they can do the discovery and planning that any migration needs, so they are positioned to move as soon as the final standard opens the door to post-quantum cryptography.",{"title":8,"searchDepth":84,"depth":84,"links":4451},[4452],{"id":4429,"depth":84,"text":4430},"Saudi Arabia's National Cryptographic Standards do not yet accept post-quantum algorithms; an update consulted in December 2025 was not yet final.",[4455,4458,4461],{"q":4456,"a":4457},"Do Saudi standards accept post-quantum algorithms?","Not yet. The National Cryptographic Standards NCS-1:2020 do not accept post-quantum algorithms. An updated version, NCS-2:2025, went to consultation in December 2025 but was not final as of early 2026, so the accepted set had not yet changed.",{"q":4459,"a":4460},"What is the status of the NCS-2:2025 update?","NCS-2:2025 was out for consultation in December 2025 and had not been finalised. Until it is final, the 2020 standards remain in effect, so organizations following Saudi standards should track the update to know when post-quantum algorithms become accepted.",{"q":4462,"a":4463},"What should Saudi organizations do while the update is pending?","Organizations can begin cryptographic discovery and planning now, since those steps are independent of which algorithms the final standard accepts. That way they are ready to adopt post-quantum algorithms as soon as the updated standard permits them.",[4465],"riyadh",[419,228],{},"\u002Fnews\u002Fsaudi-ncs-pqc-update-pending",[4470],{"label":4471,"url":4472},"National Cybersecurity Authority, Kingdom of Saudi Arabia, \"National Cryptographic Standards NCS-1:2020 and NCS-2:2025 (consultation),\" 2020 and Dec. 2025.","https:\u002F\u002Fnca.gov.sa\u002Fen",[4474,4475],{"label":4168,"url":2974},{"label":2673,"url":2674},{"title":4424,"description":4453},"Saudi NCS Does Not Yet Accept PQ Algorithms","saudi-ncs-pqc-update-pending","news\u002Fsaudi-ncs-pqc-update-pending",[438,134,368,132,439],"Saudi Arabia's National Cryptographic Standards do not yet accept post-quantum algorithms, and an update consulted in December 2025 was not final as of early 2026.","0i9WTpFcq9tXtH72ZSAeNI2uxOEnVx_gVbAn6JCs2p4",{"id":4484,"title":4485,"author":7,"authorTitle":8,"authorUrl":9,"body":4486,"canonical":9,"category":92,"date":4514,"description":4515,"draft":95,"extension":96,"faqs":4516,"findingsSource":9,"geo":4526,"image":417,"industries":4528,"keyFindings":9,"meta":4529,"modified":3653,"navigation":103,"path":4530,"pullquote":9,"recommendations":9,"references":4531,"related":4535,"seo":4542,"seoTitle":4543,"signposts":9,"slug":4544,"stats":9,"stem":4545,"tags":4546,"tldr":4547,"__hash__":4548},"news\u002Fnews\u002Fjapan-sets-2035-government-pqc-target.md","Japan Sets a 2035 Government Post-Quantum Target, With a Roadmap in FY2026",{"type":11,"value":4487,"toc":4511},[4488,4492,4497,4500,4503,4506],[14,4489,4491],{"id":4490},"japan-sets-a-2035-government-post-quantum-target","Japan sets a 2035 government post-quantum target",[19,4493,4494],{},[383,4495,4496],{},"20 NOVEMBER 2025, TOKYO",[19,4498,4499],{},"Japan set a government post-quantum target of 2035, in principle, on 20 November 2025. The target gives the country's government a horizon for transitioning to post-quantum cryptography, and Japan plans to publish a detailed roadmap in FY2026 that fills in the steps behind it.",[19,4501,4502],{},"The phrase \"in principle\" signals a target rather than a hard legal deadline. It commits the government to a 2035 horizon while leaving the FY2026 roadmap to define how the transition happens. Organizations should read it as firm direction, since a stated government target shapes procurement and planning even before the detailed document arrives.",[19,4504,4505],{},"The sequencing, a target now and a roadmap later, is common in national post-quantum programs. It lets a government fix the destination while taking time to work out the route. For Japanese agencies and their suppliers, the 2035 target already sets the planning horizon, and the FY2026 roadmap will add the concrete timelines and responsibilities.",[19,4507,4508,4510],{},[383,4509,399],{}," Japan has joined the group of jurisdictions using a 2035 horizon for government post-quantum migration, giving its agencies and vendors a clear planning target. The FY2026 roadmap will turn that target into actionable steps. Suppliers to the Japanese government can begin cryptographic discovery now, confident that the direction is set and that more detailed requirements are on the way.",{"title":8,"searchDepth":84,"depth":84,"links":4512},[4513],{"id":4490,"depth":84,"text":4491},"2025-11-20","Japan set a government post-quantum target of 2035 in principle in November 2025, with a detailed migration roadmap to follow in FY2026.",[4517,4520,4523],{"q":4518,"a":4519},"What is Japan's post-quantum target?","Japan set a target of 2035, in principle, for its government to transition to post-quantum cryptography. The announcement came on 20 November 2025 and sets the horizon, with a detailed roadmap to follow in FY2026 that fills in the steps.",{"q":4521,"a":4522},"What does 'in principle' mean here?","The phrase signals a target rather than a hard legal deadline. It commits the government to a 2035 horizon while leaving room for the FY2026 roadmap to define how the transition happens and to adjust details, so organizations should treat it as firm direction.",{"q":4524,"a":4525},"When will the detailed roadmap appear?","Japan plans to publish the detailed roadmap in FY2026. That document is expected to translate the 2035 target into concrete steps, timelines and responsibilities, so agencies and their suppliers will have more specific guidance to plan against once it is released.",[4527],"tokyo",[419,100],{},"\u002Fnews\u002Fjapan-sets-2035-government-pqc-target",[4532],{"label":4533,"url":4534},"Government of Japan, Cabinet cybersecurity authorities, \"Post-quantum cryptography government transition target,\" Nov. 20, 2025.","https:\u002F\u002Fwww.nisc.go.jp\u002Feng\u002F",[4536,4539],{"label":4537,"url":4538},"Japan's CRYPTREC Adds Post-Quantum Algorithms to Its Approved Ciphers List","\u002Fnews\u002Fjapan-cryptrec-adds-pqc-ciphers-list",{"label":4540,"url":4541},"Japan FSA Study Group Urges Banks to Start Post-Quantum Work Now","\u002Fnews\u002Fjapan-fsa-study-group-urges-banks-start-now",{"title":4485,"description":4515},"Japan Sets a 2035 Government Post-Quantum Target","japan-sets-2035-government-pqc-target","news\u002Fjapan-sets-2035-government-pqc-target",[132,2157,368,439,438],"Japan set a government post-quantum target of 2035 in principle in November 2025, and will publish a detailed migration roadmap in FY2026.","fVmJE8g69cb--Sq72_qTLrPxFF25nE51_31AnruCZbI",{"id":4550,"title":4352,"author":7,"authorTitle":8,"authorUrl":9,"body":4551,"canonical":9,"category":92,"date":4579,"description":4580,"draft":95,"extension":96,"faqs":4581,"findingsSource":9,"geo":4591,"image":417,"industries":4593,"keyFindings":9,"meta":4594,"modified":1156,"navigation":103,"path":4353,"pullquote":9,"recommendations":9,"references":4595,"related":4599,"seo":4604,"seoTitle":4605,"signposts":9,"slug":4606,"stats":9,"stem":4607,"tags":4608,"tldr":4609,"__hash__":4610},"news\u002Fnews\u002Fcaribbean-updated-cybersecurity-action-plan.md",{"type":11,"value":4552,"toc":4576},[4553,4557,4562,4565,4568,4571],[14,4554,4556],{"id":4555},"caribbean-updates-its-cybersecurity-action-plan-with-an-incident-response-pillar","Caribbean updates its cybersecurity action plan with an incident response pillar",[19,4558,4559],{},[383,4560,4561],{},"31 OCTOBER 2025, PORT OF SPAIN",[19,4563,4564],{},"CARICOM and its implementing agency IMPACS updated the Caribbean cybersecurity action plan on 31 October 2025, adding an incident response pillar. The addition strengthens the region's ability to respond to cyber incidents, extending the plan from prevention toward handling events when they occur. It reflects a maturing regional approach to cyber resilience.",[19,4566,4567],{},"The plan addresses cyber resilience broadly rather than quantum specifically. Even so, a stronger regional foundation matters for quantum readiness, because the capacity to inventory systems, respond to incidents and coordinate across states is the same capacity that quantum migration will draw on. The plan builds general strength that supports specific future challenges, quantum among them.",[19,4569,4570],{},"Working regionally is the plan's defining feature. CARICOM represents the Caribbean Community, and acting together lets smaller states pool capacity and coordinate their efforts. That approach matters where individual countries may lack the resources to tackle cyber resilience alone, so a regional plan multiplies what each member can achieve on its own.",[19,4572,4573,4575],{},[383,4574,399],{}," The updated Caribbean action plan strengthens regional cyber resilience with an incident response pillar, building the collective capacity smaller states need. It does not address quantum directly, but the foundation it lays supports future quantum work. Member states can treat the stronger regional footing as a base on which to add quantum-specific preparation as the threat and international expectations develop.",{"title":8,"searchDepth":84,"depth":84,"links":4577},[4578],{"id":4555,"depth":84,"text":4556},"2025-10-31","CARICOM and IMPACS updated the Caribbean cybersecurity action plan in October 2025, adding an incident response pillar to strengthen regional resilience.",[4582,4585,4588],{"q":4583,"a":4584},"What changed in the Caribbean action plan?","On 31 October 2025, CARICOM and IMPACS updated the regional cybersecurity action plan to add an incident response pillar. The addition strengthens the region's ability to respond to cyber incidents as part of a broader resilience effort.",{"q":4586,"a":4587},"How does this relate to quantum readiness?","The plan addresses cyber resilience broadly rather than quantum specifically. A stronger regional cyber foundation, including incident response, supports the capacity that member states will need as quantum risk grows, even though the plan does not name quantum.",{"q":4589,"a":4590},"Who is behind the action plan?","CARICOM, the Caribbean Community, and its implementing agency IMPACS lead the plan. Working regionally lets smaller states pool capacity and coordinate, which matters where individual countries may lack the resources to tackle cyber resilience alone.",[4592],"port-of-spain",[419,100],{},[4596],{"label":4597,"url":4598},"CARICOM and CARICOM IMPACS, \"Updated Caribbean Cybersecurity Action Plan,\" Oct. 31, 2025.","https:\u002F\u002Fcaricom.org\u002F",[4600,4603],{"label":4601,"url":4602},"EU-Backed Caribbean Cyber Training Centre LAC4 Serves 27 Countries","\u002Fnews\u002Feu-backed-caribbean-cyber-training-centre-lac4",{"label":2162,"url":2207},{"title":4352,"description":4580},"Caribbean Updates Its Cybersecurity Action Plan","caribbean-updated-cybersecurity-action-plan","news\u002Fcaribbean-updated-cybersecurity-action-plan",[546,368,1078,258,439],"CARICOM and IMPACS updated the Caribbean cybersecurity action plan in October 2025, adding an incident response pillar to strengthen regional cyber resilience.","azny1eAKowpfzXbZWymK6frRKgZbg0Zhx19NPq-G_Jw",{"id":4612,"title":4613,"author":7,"authorTitle":8,"authorUrl":9,"body":4614,"canonical":9,"category":92,"date":4642,"description":4643,"draft":95,"extension":96,"faqs":4644,"findingsSource":9,"geo":4654,"image":417,"industries":4655,"keyFindings":9,"meta":4656,"modified":3653,"navigation":103,"path":4657,"pullquote":9,"recommendations":9,"references":4658,"related":4662,"seo":4667,"seoTitle":4668,"signposts":9,"slug":4669,"stats":9,"stem":4670,"tags":4671,"tldr":4672,"__hash__":4673},"news\u002Fnews\u002Fpki-consortium-five-level-pqc-maturity-model.md","PKI Consortium Drafts a Five-Level Post-Quantum Maturity Model",{"type":11,"value":4615,"toc":4639},[4616,4620,4625,4628,4631,4634],[14,4617,4619],{"id":4618},"pki-consortium-drafts-a-five-level-post-quantum-maturity-model","PKI Consortium drafts a five-level post-quantum maturity model",[19,4621,4622],{},[383,4623,4624],{},"27 OCTOBER 2025, GLOBAL",[19,4626,4627],{},"The PKI Consortium published a draft post-quantum maturity model on 27 October 2025, defining five levels: Initial, Foundational, Advanced, Managed and Optimized. The levels describe increasing post-quantum maturity, so an organization or vendor can place itself on the scale and see what the next level requires. The model gives a structured way to answer how ready an organization is.",[19,4629,4630],{},"The model is voluntary, and vendors self-grade against it. That makes it a self-assessment tool rather than a certification scheme. Its value lies in honest internal benchmarking, so an organization gets the most from it by grading itself candidly rather than optimistically, since no independent party verifies the result.",[19,4632,4633],{},"A maturity model earns its keep by turning a vague question into a measurable one. Instead of asking whether an organization is ready, which invites a yes-or-no answer that hides nuance, the five levels let an organization track progress over time and identify the specific steps that move it from one level to the next. That structure makes a long effort feel navigable.",[19,4635,4636,4638],{},[383,4637,399],{}," The PKI Consortium's draft model gives organizations a shared vocabulary for post-quantum maturity, from Initial to Optimized, which helps them benchmark and plan. Because it is voluntary and self-graded, its usefulness depends on honest assessment. Organizations can use it to locate where they stand today and to set a clear target level, turning a broad goal into a sequence of concrete improvements.",{"title":8,"searchDepth":84,"depth":84,"links":4640},[4641],{"id":4618,"depth":84,"text":4619},"2025-10-27","The PKI Consortium published a draft five-level post-quantum maturity model in October 2025, letting vendors self-grade from Initial to Optimized voluntarily.",[4645,4648,4651],{"q":4646,"a":4647},"What are the five levels of the maturity model?","The draft model, published on 27 October 2025, defines five levels: Initial, Foundational, Advanced, Managed and Optimized. The levels describe increasing post-quantum maturity, so an organization or vendor can place itself on the scale and see what the next level requires.",{"q":4649,"a":4650},"Who grades against the model?","The model is voluntary, and vendors self-grade. That makes it a self-assessment tool rather than a certification scheme, useful for honest internal benchmarking but reliant on the vendor's own judgment rather than independent verification.",{"q":4652,"a":4653},"What is the value of a maturity model?","A maturity model turns a vague question, how ready are we, into a structured scale with defined levels. That lets organizations track progress over time, compare themselves against the levels, and identify the specific steps needed to advance toward higher maturity.",[225],[228,100],{},"\u002Fnews\u002Fpki-consortium-five-level-pqc-maturity-model",[4659],{"label":4660,"url":4661},"PKI Consortium, \"Post-Quantum Cryptography Maturity Model (draft),\" Oct. 27, 2025.","https:\u002F\u002Fpkic.org\u002F",[4663,4664],{"label":3933,"url":3978},{"label":4665,"url":4666},"NIST Issues Crypto Agility Guidance in CSWP 39","\u002Fnews\u002Fnist-cswp-39-crypto-agility-guidance",{"title":4613,"description":4643},"PKI Consortium Drafts a Five-Level PQC Maturity Model","pki-consortium-five-level-pqc-maturity-model","news\u002Fpki-consortium-five-level-pqc-maturity-model",[368,132,549,2862,260],"The PKI Consortium published a draft five-level post-quantum maturity model in October 2025, letting vendors self-grade from Initial to Optimized on a voluntary basis.","fahQC-Pxr21ouuvV-ZjgKiad454YnR9MOmXP2h09mKQ",{"id":4675,"title":4676,"author":7,"authorTitle":8,"authorUrl":9,"body":4677,"canonical":9,"category":220,"date":4742,"description":4743,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":4744,"image":9,"industries":4745,"keyFindings":9,"meta":4747,"modified":4748,"navigation":103,"path":4749,"pullquote":9,"recommendations":9,"references":4750,"related":4760,"seo":4763,"seoTitle":4764,"signposts":9,"slug":4765,"stats":9,"stem":4766,"tags":4767,"tldr":4768,"__hash__":4769},"news\u002Fnews\u002Femergency-services-public-safety-radio-post-quantum.md","Public Safety Networks Harden Radios and 911 While Post-Quantum Plans Lag",{"type":11,"value":4678,"toc":4734},[4679,4681,4684,4688,4697,4701,4710,4714,4722,4726,4729,4731],[14,4680,17],{"id":16},[19,4682,4683],{},"Emergency-services communications have hardened their encryption against the quantum threat, but mostly through stronger symmetric keys rather than a NIST-style post-quantum migration, and the 911 side has barely begun. The current reporting is thin: it covers radio-encryption hardening and a US 911 overview in which quantum is a minor topic. The honest summary is that public-safety networks are aware of the threat and have taken some steps, while a structured move to post-quantum algorithms for dispatch and emergency communications is not yet visible.",[14,4685,4687],{"id":4686},"radio-standards-already-shifted","Radio standards already shifted",[19,4689,4690,4691,4693,4694,4696],{},"Public-safety radio standards reflect quantum concerns, though through symmetric-key hardening. An October 2024 ETSI presentation by the chair of its TETRA committee names quantum computing as a looming threat that drove stronger cryptography ",[23,4692,25],{},". The 2019 standard update moved encryption keys from 80 to 192 bits and authentication keys from 128 to 256 bits, aiming for 25 more years of security, and four ETSI specifications released in July 2024 publicly document TETRA's encryption and authentication algorithms ",[23,4695,25],{},". Larger symmetric keys resist quantum search attacks, which is a different problem from the public-key migration that post-quantum standards address.",[14,4698,4700],{"id":4699},"radio-security-keeps-moving","Radio security keeps moving",[19,4702,4703,4704,4706,4707,4709],{},"RF Globalnet's July 2025 roundup notes that NIST finalized FIPS 203, 204 and 205 in August 2024, and reports that researchers broke the NATO HALFLOOP-24 link-protection cipher using about two hours of captured traffic ",[23,4705,29],{},". It adds that NIST chose HQC as a backup algorithm in March 2025, and that Connecticut mandated P25 Link Layer Authentication on its statewide radio network ",[23,4708,29],{},". The article covers first-responder post-quantum work only in passing, so it signals direction more than a sector plan.",[14,4711,4713],{"id":4712},"the-911-gap","The 911 gap",[19,4715,4716,4717,4719,4720,171],{},"The 911 side shows the gap most clearly. Domestic Preparedness reported in October 2025 that ransomware attacks on public-safety answering points doubled in 2024, that legacy 911 relies on decades-old copper infrastructure, and that quantum processors will eventually make current encryption decryptable ",[23,4718,63],{},". It urges agencies to prepare equipment and algorithms now, on a five to ten year horizon, but quantum occupies only a small part of that article ",[23,4721,63],{},[14,4723,4725],{"id":4724},"what-this-means-for-public-safety-agencies","What this means for public-safety agencies",[19,4727,4728],{},"The near-term exposure is more operational than cryptographic, but the long-lived infrastructure argues for starting the inventory now. Agencies should map where public-key cryptography protects dispatch, records and interagency links, treat the symmetric-key radio hardening as a separate track already underway, and plan post-quantum migration into the long modernization cycles that Next Generation 911 already requires.",[14,4730,79],{"id":78},[19,4732,4733],{},"ArcQubit treats discovery as the practical first step where sector guidance is thin. QuCode maps where vulnerable public-key cryptography sits across emergency-communications and records systems, and QuTrust holds the migration plan so the work fits the long modernization timelines these agencies already run.",{"title":8,"searchDepth":84,"depth":84,"links":4735},[4736,4737,4738,4739,4740,4741],{"id":16,"depth":84,"text":17},{"id":4686,"depth":84,"text":4687},{"id":4699,"depth":84,"text":4700},{"id":4712,"depth":84,"text":4713},{"id":4724,"depth":84,"text":4725},{"id":78,"depth":84,"text":79},"2025-10-22","Public-safety radio standards hardened symmetric encryption against quantum, but post-quantum migration for emergency comms and legacy 911 barely registers so far.",[736],[100,4746],"Emergency Services",{},"2026-09-07","\u002Fnews\u002Femergency-services-public-safety-radio-post-quantum",[4751,4754,4757],{"label":4752,"url":4753},"B. Murgatroyd, \"Security Conference 2024: TETRA - Securing the Future,\" ETSI Security Conference, Oct. 17, 2024.","https:\u002F\u002Fdocbox.etsi.org\u002FWorkshop\u002F2024\u002F10_SECURITYCONFERENCE\u002F17OCTOBER\u002FD42_MURGATROYD_TCCE.pdf",{"label":4755,"url":4756},"J. Oncea, \"From Half-Loop to HQC: The Year Radio Encryption Broke and Rebuilt Itself,\" RF Globalnet, Jul. 21, 2025.","https:\u002F\u002Fwww.rfglobalnet.com\u002Fdoc\u002Ffrom-half-loop-to-hqc-the-year-radio-encryption-broke-and-rebuilt-itself-0001",{"label":4758,"url":4759},"C. Gifford, \"Next Generation 911 in Public Safety Infrastructure Cybersecurity,\" Domestic Preparedness, Oct. 22, 2025.","https:\u002F\u002Fdomesticpreparedness.com\u002Farticles\u002Fnext-generation-911-in-public-safety-infrastructure-cybersecurity\u002F",[4761,4762],{"label":444,"url":525},{"label":249,"url":250},{"title":4676,"description":4743},"Public Safety Networks Lag on Quantum","emergency-services-public-safety-radio-post-quantum","news\u002Femergency-services-public-safety-radio-post-quantum",[546,547,368,438,439],"Public-safety radio standards already strengthened symmetric encryption against the quantum threat, but a NIST-style post-quantum migration for emergency communications and legacy 911 infrastructure barely registers in current reporting.","AKclVH3brQ3NdOK9lF1Y2giwaeDhjaqQmR_t38Sohjg",{"id":4771,"title":4772,"author":7,"authorTitle":8,"authorUrl":9,"body":4773,"canonical":9,"category":220,"date":4837,"description":4838,"draft":95,"extension":96,"faqs":9,"findingsSource":9,"geo":4839,"image":9,"industries":4840,"keyFindings":9,"meta":4841,"modified":4842,"navigation":103,"path":4843,"pullquote":9,"recommendations":9,"references":4844,"related":4855,"seo":4858,"seoTitle":4859,"signposts":9,"slug":4860,"stats":9,"stem":4861,"tags":4862,"tldr":4863,"__hash__":4864},"news\u002Fnews\u002Fhealthcare-medical-devices-long-lived-records-pqc.md","Medical Device Makers and Health Systems Weigh Post-Quantum Plans for Decades-Long Records",{"type":11,"value":4774,"toc":4829},[4775,4777,4780,4784,4796,4800,4809,4813,4819,4821,4824,4826],[14,4776,17],{"id":16},[19,4778,4779],{},"Medical device makers and health systems face a migration shaped by two facts: regulators are setting 2030 and 2035 milestones, and patient records need decades of protection. That combination makes harvest-now-decrypt-later an active concern, not a future one. The current reporting leans on vendor-authored pieces and a preprint, so the claims below should be read as viewpoints and estimates rather than settled fact, but the direction is consistent with the government timelines that anchor it.",[14,4781,4783],{"id":4782},"devices-and-deadlines","Devices and deadlines",[19,4785,4786,4787,4789,4790,4792,4793,4795],{},"Two Medcrypt authors wrote in October 2025 that medical device encryption could be broken within a few years to a decade and that regulators are setting deadlines ",[23,4788,25],{},". They say NIST will deprecate RSA and ECC by 2030 and phase out legacy algorithms by 2035, that the EU expects high-risk systems to reach post-quantum cryptography by the end of 2030 and medium and low risk by 2035, and that the FDA's June 2025 guidance asks for current NIST-recommended cryptography without naming a post-quantum approach ",[23,4791,25],{},". They advise crypto agility and a cryptography bill of materials ",[23,4794,25],{},". Medcrypt sells device cybersecurity, so these are vendor claims.",[14,4797,4799],{"id":4798},"the-uk-clock-applied-to-health","The UK clock applied to health",[19,4801,4802,4803,4805,4806,4808],{},"In the United Kingdom, the National Cyber Security Centre set three milestones in March 2025: complete discovery of cryptography-dependent systems by 2028, finish high-priority migration by 2031, and complete full migration by 2035 ",[23,4804,29],{},". A July 2025 post from an IT services vendor applies that clock to the NHS, treating harvest-now-decrypt-later as an active threat to stolen patient data, noting that patient records need decades of protection, and naming legacy trust middleware as the main readiness obstacle ",[23,4807,63],{},". That post is vendor marketing, so weigh its framing accordingly, but the NCSC dates behind it are primary.",[14,4810,4812],{"id":4811},"device-constraints","Device constraints",[19,4814,4815,4816,4818],{},"A December 2024 arXiv preprint on healthcare IoT says pacemakers and glucose monitors run on roughly 32 to 64 KB of RAM and 16 to 32 MHz processors, which complicates post-quantum algorithms, and it discusses interception and device-manipulation risks alongside harvest-now exposure of patient data ",[23,4817,67],{},". As read, the preprint is not peer reviewed, so its specifics are claims rather than confirmed findings, though the constraint it describes is real and widely acknowledged.",[14,4820,319],{"id":318},[19,4822,4823],{},"Retention is the planning fact. A record created today may need to stay confidential for a lifetime, which is exactly what makes harvest-now exposure present rather than future. Health systems and device makers should inventory where vulnerable cryptography protects long-lived records and devices, prioritize by sensitivity and retention, and build crypto agility and a cryptography bill of materials into device design and procurement.",[14,4825,79],{"id":78},[19,4827,4828],{},"ArcQubit treats the cryptographic inventory as the first deliverable. QuCode discovers where vulnerable cryptography sits across records, devices and cloud platforms, and QuTrust holds the migration plan so a health system can show a current, defensible posture as FDA, NCSC and EU timelines bite.",{"title":8,"searchDepth":84,"depth":84,"links":4830},[4831,4832,4833,4834,4835,4836],{"id":16,"depth":84,"text":17},{"id":4782,"depth":84,"text":4783},{"id":4798,"depth":84,"text":4799},{"id":4811,"depth":84,"text":4812},{"id":318,"depth":84,"text":319},{"id":78,"depth":84,"text":79},"2025-10-01","Vendors and regulators point to 2030 and 2035 milestones for healthcare cryptography. Patient records need decades of protection, so harvest-now risk is active today.",[736],[100,344],{},"2026-09-12","\u002Fnews\u002Fhealthcare-medical-devices-long-lived-records-pqc",[4845,4848,4849,4852],{"label":4846,"url":4847},"N. Schwartz and A. Wirth, \"Medical device manufacturers need to act now on post-quantum cryptography,\" Medical Design and Outsourcing, Oct. 1, 2025.","https:\u002F\u002Fwww.medicaldesignandoutsourcing.com\u002Fmedical-device-encryption-post-quantum-cryptography\u002F",{"label":3565,"url":3566},{"label":4850,"url":4851},"E. Davidson, \"Quantum computing and healthcare cybersecurity: why NHS leaders must act now,\" Celerity UK, Jul. 23, 2025.","https:\u002F\u002Fwww.celerity-uk.com\u002Fresources\u002Fquantum-computing-and-healthcare-cybersecurity-why-nhs-leaders-must-act-now",{"label":4853,"url":4854},"A. Alif, K. F. Hasan, J. Laeuchli, and M. J. M. Chowdhury, \"Quantum threat in healthcare IoT: challenges and mitigation strategies,\" arXiv:2412.05904, Dec. 2024.","https:\u002F\u002Farxiv.org\u002Fpdf\u002F2412.05904",[4856,4857],{"label":265,"url":346},{"label":246,"url":247},{"title":4772,"description":4838},"Health Systems Weigh Post-Quantum Plans","healthcare-medical-devices-long-lived-records-pqc","news\u002Fhealthcare-medical-devices-long-lived-records-pqc",[367,259,1809,549,368],"Vendors and regulators are converging on 2030 and 2035 milestones for healthcare cryptography, and because patient records need decades of protection, harvest-now-decrypt-later is an active concern even though much of the current reporting is vendor-authored.","nTffFgiCZRHSoXa8Z1PyG934Qx9xkURGZmY3PlFAcPY",{"id":4866,"title":4867,"author":7,"authorTitle":8,"authorUrl":9,"body":4868,"canonical":9,"category":92,"date":4837,"description":4896,"draft":95,"extension":96,"faqs":4897,"findingsSource":9,"geo":4907,"image":417,"industries":4909,"keyFindings":9,"meta":4910,"modified":1156,"navigation":103,"path":4911,"pullquote":9,"recommendations":9,"references":4912,"related":4916,"seo":4923,"seoTitle":4924,"signposts":9,"slug":4925,"stats":9,"stem":4926,"tags":4927,"tldr":4928,"__hash__":4929},"news\u002Fnews\u002Fuk-ncsc-pilots-vetted-consultancies.md","UK NCSC Pilots Vetted Consultancies for Post-Quantum Migration",{"type":11,"value":4869,"toc":4893},[4870,4874,4879,4882,4885,4888],[14,4871,4873],{"id":4872},"uk-ncsc-pilots-vetted-consultancies-for-post-quantum-migration","UK NCSC pilots vetted consultancies for post-quantum migration",[19,4875,4876],{},[383,4877,4878],{},"1 OCTOBER 2025, LONDON",[19,4880,4881],{},"The UK's National Cyber Security Centre launched an Assured Cyber Security Consultancy pilot focused on post-quantum cryptography on 1 October 2025. The pilot vets consultancies so that organizations can hire advisers the NCSC has assessed for post-quantum migration work. It runs through 31 March 2027.",[19,4883,4884],{},"The pilot answers a practical problem. Post-quantum migration demands specialist skills that many organizations do not hold in-house, and a new field attracts advisers whose expertise is hard to judge. By assessing consultancies, the NCSC gives organizations a credible way to find external help and lowers the risk of hiring advisers who overstate what they can do.",[19,4886,4887],{},"As a pilot, the scheme tests the approach before any decision to make it permanent. The structure of assured post-quantum consultancy support may change based on what the trial shows between its launch and the March 2027 end date. Organizations using it should treat it as an evolving service rather than a settled one.",[19,4889,4890,4892],{},[383,4891,399],{}," The pilot acknowledges that the skills needed for post-quantum migration are scarce, and it builds a trusted route to external expertise. For organizations that cannot staff the work internally, a vetted list reduces the guesswork in choosing advisers. The pilot also signals that the NCSC expects organizations to be actively migrating during its 2025 to 2027 window, in line with its 2028 discovery deadline.",{"title":8,"searchDepth":84,"depth":84,"links":4894},[4895],{"id":4872,"depth":84,"text":4873},"The UK NCSC launched an Assured Cyber Security Consultancy pilot for post-quantum migration on 1 October 2025, running through 31 March 2027.",[4898,4901,4904],{"q":4899,"a":4900},"What is the NCSC consultancy pilot?","The NCSC launched an Assured Cyber Security Consultancy pilot focused on post-quantum cryptography on 1 October 2025. It vets consultancies so organizations can hire advisers the NCSC has assessed for PQC migration work. The pilot runs through 31 March 2027.",{"q":4902,"a":4903},"Why vet consultancies for PQC?","Post-quantum migration demands scarce specialist skills, and many organizations lack them in-house. Vetting consultancies gives organizations a way to find credible external help, lowering the risk of hiring advisers who overstate their expertise in a new and complex field.",{"q":4905,"a":4906},"How long does the pilot run?","The pilot runs from 1 October 2025 through 31 March 2027. As a pilot, it tests the approach before any decision to make it permanent, so the structure of assured PQC consultancy support may evolve based on what the trial period shows.",[4908],"london",[100,419],{},"\u002Fnews\u002Fuk-ncsc-pilots-vetted-consultancies",[4913],{"label":4914,"url":4915},"National Cyber Security Centre (NCSC), \"Assured Cyber Security Consultancy: Post-Quantum Cryptography pilot,\" Oct. 1, 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsection\u002Fproducts-services\u002Fncsc-certification",[4917,4920],{"label":4918,"url":4919},"UK NCSC Sets 2028, 2031 and 2035 Post-Quantum Migration Deadlines","\u002Fnews\u002Fuk-ncsc-2028-2031-2035-deadlines",{"label":4921,"url":4922},"UK CMORG Issues Voluntary Post-Quantum Guidance for Finance","\u002Fnews\u002Fuk-cmorg-voluntary-pqc-guidance",{"title":4867,"description":4896},"UK NCSC Pilots Vetted PQC Consultancies","uk-ncsc-pilots-vetted-consultancies","news\u002Fuk-ncsc-pilots-vetted-consultancies",[1809,132,368,133,260],"The UK NCSC launched an Assured Cyber Security Consultancy pilot for post-quantum migration on 1 October 2025, running through March 2027.","4C79HMjPinuNv7VyQR9id09VVPMnLOi_UuyLNK1nVUE",{"id":4931,"title":4932,"author":7,"authorTitle":8,"authorUrl":9,"body":4933,"canonical":9,"category":92,"date":4961,"description":4962,"draft":95,"extension":96,"faqs":4963,"findingsSource":9,"geo":4973,"image":417,"industries":4975,"keyFindings":9,"meta":4976,"modified":733,"navigation":103,"path":1932,"pullquote":9,"recommendations":9,"references":4977,"related":4981,"seo":4984,"seoTitle":4985,"signposts":9,"slug":4986,"stats":9,"stem":4987,"tags":4988,"tldr":4989,"__hash__":4990},"news\u002Fnews\u002Fcolombia-supervisor-flags-quantum-risk.md","Colombia's Financial Supervisor Flags Quantum Among Emerging Risks",{"type":11,"value":4934,"toc":4958},[4935,4939,4944,4947,4950,4953],[14,4936,4938],{"id":4937},"colombias-financial-supervisor-flags-quantum-among-emerging-risks","Colombia's financial supervisor flags quantum among emerging risks",[19,4940,4941],{},[383,4942,4943],{},"30 SEPTEMBER 2025, BOGOTA",[19,4945,4946],{},"Colombia's financial supervisor flagged quantum among emerging risks on 30 September 2025, against a backdrop of rising cyberattacks. It identified quantum as a risk to watch rather than imposing a specific requirement on financial firms. The move puts quantum on the sector's radar through supervisory attention rather than a mandate.",[19,4948,4949],{},"The context of rising attacks sharpens the message. The supervisor cited a large volume of cyberattacks, reported as 27 billion between January and July 2025, an increase of about 69 percent. That surge frames quantum as one emerging threat among many pressing on an already stressed cyber environment, which helps explain why the supervisor named it now.",[19,4951,4952],{},"Flagging a risk is a signal, not an obligation. By listing quantum among emerging risks, the supervisor raises awareness and indicates it is paying attention, without yet setting requirements. Firms should read the flag as an early indicator that quantum sits within the supervisor's view, which in regulatory practice often precedes firmer expectations.",[19,4954,4955,4957],{},[383,4956,399],{}," Colombia's supervisor has named quantum as an emerging risk amid a sharp rise in cyberattacks, signalling attention without a mandate. For Colombian financial firms, the flag is an early warning that quantum is on the supervisor's agenda. Firms can respond by building awareness and starting foundational work like cryptographic inventory, so they are positioned if the supervisor moves from flagging the risk to acting on it.",{"title":8,"searchDepth":84,"depth":84,"links":4959},[4960],{"id":4937,"depth":84,"text":4938},"2025-09-30","Colombia's financial supervisor flagged quantum among emerging risks in September 2025 amid rising cyberattacks, without imposing a requirement.",[4964,4967,4970],{"q":4965,"a":4966},"What did Colombia's supervisor say about quantum?","On 30 September 2025, Colombia's financial supervisor flagged quantum among emerging risks, set against a sharp rise in cyberattacks. It identified quantum as a risk to watch rather than imposing a specific requirement on financial firms at this stage.",{"q":4968,"a":4969},"What was the context of rising attacks?","The supervisor cited a large volume of cyberattacks, reported as 27 billion between January and July 2025, up about 69 percent. That surge frames quantum as one emerging threat among many pressing on an already stressed cyber environment.",{"q":4971,"a":4972},"Does the flag create an obligation?","No. Flagging quantum among emerging risks raises awareness and signals supervisory attention, but it imposes no requirement. Firms should read it as an early indicator that the supervisor is watching quantum, which may lead to expectations later.",[4974],"bogota",[227,100],{},[4978],{"label":4979,"url":4980},"Superintendencia Financiera de Colombia, \"Emerging risks in the financial sector,\" Sep. 30, 2025.","https:\u002F\u002Fwww.superfinanciera.gov.co\u002F",[4982,4983],{"label":3740,"url":3785},{"label":1331,"url":1332},{"title":4932,"description":4962},"Colombia's Supervisor Flags Quantum Among Risks","colombia-supervisor-flags-quantum-risk","news\u002Fcolombia-supervisor-flags-quantum-risk",[257,258,368,1078,260],"Colombia's financial supervisor flagged quantum among emerging risks in September 2025, amid a sharp rise in cyberattacks, without yet imposing a requirement.","r5feY9nmZjsk6Odb3HMR5aQx-keeg0UmYj8uMvE-j4o",{"id":4992,"title":4993,"author":7,"authorTitle":8,"authorUrl":9,"body":4994,"canonical":9,"category":220,"date":5022,"description":5023,"draft":95,"extension":96,"faqs":5024,"findingsSource":9,"geo":5034,"image":417,"industries":5035,"keyFindings":9,"meta":5036,"modified":4748,"navigation":103,"path":1587,"pullquote":9,"recommendations":9,"references":5037,"related":5041,"seo":5044,"seoTitle":5045,"signposts":9,"slug":5046,"stats":9,"stem":5047,"tags":5048,"tldr":5049,"__hash__":5050},"news\u002Fnews\u002Fsingapore-mas-qkd-sandbox-report.md","Singapore MAS QKD Sandbox Report Favours Post-Quantum Cryptography as the Foundation",{"type":11,"value":4995,"toc":5019},[4996,5000,5005,5008,5011,5014],[14,4997,4999],{"id":4998},"singapore-mas-qkd-sandbox-report-favours-post-quantum-cryptography","Singapore MAS QKD sandbox report favours post-quantum cryptography",[19,5001,5002],{},[383,5003,5004],{},"29 SEPTEMBER 2025, SINGAPORE",[19,5006,5007],{},"The Monetary Authority of Singapore published a quantum key distribution sandbox report on 29 September 2025. The report positions post-quantum cryptography as the foundation for financial security and treats quantum key distribution, or QKD, as suited to niche point-to-point links. In short, it favours software-based post-quantum cryptography for broad use over hardware-based QKD.",[19,5009,5010],{},"The distinction between the two technologies drives the conclusion. Post-quantum cryptography uses new mathematical algorithms that run on existing systems, while QKD uses the physics of quantum mechanics to exchange keys and needs specialised hardware and dedicated links. One scales across standard networks; the other does not.",[19,5012,5013],{},"That is why the report treats post-quantum cryptography as the general solution. PQC works across standard networks and systems without QKD's specialised hardware and point-to-point constraints, so it fits the broad needs of a financial sector. QKD's limits confine it to specific high-value links, which makes it complementary rather than foundational in the MAS view.",[19,5015,5016,5018],{},[383,5017,399],{}," The MAS report gives financial firms a clear steer: build on post-quantum cryptography and treat QKD as a niche tool for specific links. That guidance helps firms avoid over-investing in QKD hardware for problems that software-based PQC solves more flexibly. For a leading financial hub to state the preference plainly gives firms confidence to focus their migration effort on post-quantum algorithms.",{"title":8,"searchDepth":84,"depth":84,"links":5020},[5021],{"id":4998,"depth":84,"text":4999},"2025-09-29","A September 2025 MAS sandbox report favours post-quantum cryptography as the foundation, with quantum key distribution suited to niche point-to-point links.",[5025,5028,5031],{"q":5026,"a":5027},"What did the MAS QKD sandbox report conclude?","The 29 September 2025 report positions post-quantum cryptography as the foundation for financial security and treats quantum key distribution, or QKD, as suited to niche point-to-point links. It favours software-based PQC for broad use over hardware-based QKD.",{"q":5029,"a":5030},"What is the difference between PQC and QKD?","Post-quantum cryptography uses new mathematical algorithms that run on existing systems. Quantum key distribution uses the physics of quantum mechanics to exchange keys and needs specialised hardware and dedicated links. The report sees PQC as the general solution and QKD as niche.",{"q":5032,"a":5033},"Why does MAS favour PQC as the foundation?","PQC works across standard networks and systems without the specialised hardware and point-to-point links QKD requires, so it scales to a financial sector's broad needs. QKD's constraints limit it to specific high-value links, which is why the report treats it as complementary, not foundational.",[1153],[227,228],{},[5038],{"label":5039,"url":5040},"Monetary Authority of Singapore, \"Quantum key distribution sandbox report,\" Sep. 29, 2025.","https:\u002F\u002Fwww.mas.gov.sg\u002F",[5042,5043],{"label":1583,"url":1584},{"label":2673,"url":2674},{"title":4993,"description":5023},"Singapore MAS QKD Sandbox Report Favours PQC","singapore-mas-qkd-sandbox-report","news\u002Fsingapore-mas-qkd-sandbox-report",[257,438,368,2862,260],"A September 2025 MAS sandbox report positions post-quantum cryptography as the foundation for financial security and quantum key distribution as suited to niche point-to-point links.","EwDOCq9N455rBFCnZjwOm4x8hlPk1FmXzoMuT6bWk1w",{"id":5052,"title":5053,"author":7,"authorTitle":8,"authorUrl":9,"body":5054,"canonical":9,"category":92,"date":5082,"description":5083,"draft":95,"extension":96,"faqs":5084,"findingsSource":9,"geo":5094,"image":417,"industries":5095,"keyFindings":9,"meta":5096,"modified":733,"navigation":103,"path":2281,"pullquote":9,"recommendations":9,"references":5097,"related":5101,"seo":5107,"seoTitle":5108,"signposts":9,"slug":5109,"stats":9,"stem":5110,"tags":5111,"tldr":5112,"__hash__":5113},"news\u002Fnews\u002Faustralia-asd-latice-planning-guidance.md","Australia's ASD Sets End-2026, End-2028 and End-2030 Post-Quantum Planning Milestones",{"type":11,"value":5055,"toc":5079},[5056,5060,5065,5068,5071,5074],[14,5057,5059],{"id":5058},"australias-asd-sets-end-2026-end-2028-and-end-2030-planning-milestones","Australia's ASD sets end-2026, end-2028 and end-2030 planning milestones",[19,5061,5062],{},[383,5063,5064],{},"22 SEPTEMBER 2025, CANBERRA",[19,5066,5067],{},"The Australian Signals Directorate published post-quantum planning guidance on 22 September 2025. It sets three milestones: a migration plan by the end of 2026, commencement of migration by the end of 2028, and completion by the end of 2030. The staged schedule gives Australian organizations a clear sequence to follow rather than a single distant deadline.",[19,5069,5070],{},"The guidance uses a framework the ASD calls LATICE to structure the work. The framework organizes the steps so that planning leads to commencement, which leads to completion, in a coherent method. That structure helps organizations avoid treating migration as ad hoc effort and instead work through defined stages.",[19,5072,5073],{},"The dates complement the ISM control for government cryptography. ISM-1917 requires new government cryptography to support post-quantum algorithms by 2030, and the ASD planning guidance supplies the staged path to reach that horizon. Pairing the control with the schedule tells agencies both what to adopt and when to adopt it, which reduces the chance of a last-minute rush.",[19,5075,5076,5078],{},[383,5077,399],{}," The ASD guidance converts Australia's 2030 horizon into a dated, staged plan, with the end-2026 planning milestone as the first checkpoint. Because migration depends on first understanding the estate, that 2026 date is the one that most affects whether the later milestones are achievable. Organizations that build their plan now have the full window to commence and complete migration on schedule.",{"title":8,"searchDepth":84,"depth":84,"links":5080},[5081],{"id":5058,"depth":84,"text":5059},"2025-09-22","Australia's ASD planning guidance sets a plan by end-2026, commencement by end-2028 and completion by end-2030, under its LATICE framework.",[5085,5088,5091],{"q":5086,"a":5087},"What are the ASD planning milestones?","The ASD guidance of 22 September 2025 sets a migration plan by the end of 2026, commencement of migration by the end of 2028, and completion by the end of 2030. The dates give Australian organizations a staged schedule to work against.",{"q":5089,"a":5090},"What is the LATICE framework?","LATICE is the framework the ASD uses to structure its post-quantum planning guidance. It organizes the steps organizations should take so that planning, commencement and completion follow a coherent method rather than ad hoc effort.",{"q":5092,"a":5093},"How do these dates relate to ISM-1917?","ISM-1917 requires new government cryptography to support post-quantum algorithms by 2030, and the ASD planning guidance gives the staged path to meet that horizon. Together they pair a control with a schedule, so agencies know both what to adopt and when.",[1506],[419,100],{},[5098],{"label":5099,"url":5100},"Australian Signals Directorate, \"Planning for post-quantum cryptography (LATICE framework),\" Sep. 22, 2025.","https:\u002F\u002Fwww.cyber.gov.au\u002F",[5102,5105],{"label":5103,"url":5104},"Australia's ISM-1917 Requires New Government Cryptography to Support PQC by 2030","\u002Fnews\u002Faustralia-ism-1917-gov-crypto-pqc-by-2030",{"label":5106,"url":2273},"Australia's APRA Signals Tougher Quantum Supervision for Finance",{"title":5053,"description":5083},"Australia's ASD Sets 2026, 2028, 2030 PQC Milestones","australia-asd-latice-planning-guidance","news\u002Faustralia-asd-latice-planning-guidance",[132,1338,133,368,439],"Australia's ASD published planning guidance in September 2025 setting a plan by end-2026, commencement by end-2028 and completion by end-2030, under its LATICE framework.","3nZ60deZ-sGqbWsUNpV9orsz_kQS8OgpM6v53wGXVq4",{"id":5115,"title":2854,"author":7,"authorTitle":8,"authorUrl":9,"body":5116,"canonical":9,"category":92,"date":5144,"description":5145,"draft":95,"extension":96,"faqs":5146,"findingsSource":9,"geo":5156,"image":417,"industries":5158,"keyFindings":9,"meta":5159,"modified":1156,"navigation":103,"path":2855,"pullquote":9,"recommendations":9,"references":5160,"related":5164,"seo":5169,"seoTitle":5170,"signposts":9,"slug":5171,"stats":9,"stem":5172,"tags":5173,"tldr":5174,"__hash__":5175},"news\u002Fnews\u002Fnist-sp-800-227-kem-guidance.md",{"type":11,"value":5117,"toc":5141},[5118,5122,5127,5130,5133,5136],[14,5119,5121],{"id":5120},"nist-issues-final-guidance-on-key-establishment-mechanisms-in-sp-800-227","NIST issues final guidance on key establishment mechanisms in SP 800-227",[19,5123,5124],{},[383,5125,5126],{},"18 SEPTEMBER 2025, GAITHERSBURG",[19,5128,5129],{},"NIST finalized Special Publication 800-227 on 18 September 2025, giving practitioners implementation guidance for key establishment mechanisms. These mechanisms let two parties agree on a shared secret, and they sit at the core of secure communication. The guidance supports FIPS 203, the ML-KEM standard NIST published in 2024, and anticipates the future HQC standard that NIST selected as a backup.",[19,5131,5132],{},"The publication complements the algorithm standards rather than repeating them. FIPS 203 defines ML-KEM as an algorithm, while SP 800-227 tells engineers how to use key establishment mechanisms correctly in practice. The two documents work together: one specifies the mathematics, the other guides the implementation so teams avoid mistakes that could weaken an otherwise sound algorithm.",[19,5134,5135],{},"By covering both FIPS 203 today and HQC in the future, SP 800-227 points implementers toward crypto agility. A team that follows the guidance can build systems that support more than one key establishment mechanism, which matters because NIST chose HQC specifically to diversify away from a single mathematical family. Supporting both reduces the risk if one family later proves weaker than expected.",[19,5137,5138,5140],{},[383,5139,399],{}," SP 800-227 closes a gap between a standardized algorithm and a correct implementation. Engineers building post-quantum key establishment now have NIST guidance on how to do it, and the guidance already looks ahead to HQC. Teams that read it alongside FIPS 203 can implement key establishment correctly the first time and keep room for a second algorithm.",{"title":8,"searchDepth":84,"depth":84,"links":5142},[5143],{"id":5120,"depth":84,"text":5121},"2025-09-18","NIST finalized SP 800-227 in September 2025, giving practitioners implementation guidance for key establishment mechanisms, supporting FIPS 203 and future HQC.",[5147,5150,5153],{"q":5148,"a":5149},"What does SP 800-227 cover?","SP 800-227 gives practitioners implementation guidance for key establishment mechanisms, the schemes that let two parties agree on a shared secret. It supports FIPS 203, the ML-KEM standard, and anticipates the future HQC standard NIST selected as a backup.",{"q":5151,"a":5152},"How does it relate to FIPS 203?","FIPS 203 standardizes ML-KEM as an algorithm. SP 800-227 is implementation guidance that tells practitioners how to use key establishment mechanisms correctly, so the two documents work together rather than overlap. One defines the algorithm, the other guides its use.",{"q":5154,"a":5155},"Who should read it?","Engineers and architects implementing post-quantum key establishment should read SP 800-227. It helps teams apply FIPS 203 correctly and prepare for HQC, reducing the chance of implementation mistakes that weaken an otherwise sound algorithm.",[5157],"gaithersburg",[100,228],{},[5161],{"label":5162,"url":5163},"National Institute of Standards and Technology, \"Recommendations for Key-Encapsulation Mechanisms,\" NIST Special Publication 800-227, Sep. 18, 2025.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F227\u002Ffinal",[5165,5166],{"label":2673,"url":2674},{"label":5167,"url":5168},"NIST Picks HQC as a Backup Key Establishment Mechanism","\u002Fnews\u002Fnist-selects-hqc-backup-post-quantum-encryption",{"title":2854,"description":5145},"NIST Final Guidance on KEMs (SP 800-227)","nist-sp-800-227-kem-guidance","news\u002Fnist-sp-800-227-kem-guidance",[438,549,368,132,260],"NIST finalized SP 800-227 in September 2025, giving practitioners implementation guidance for key establishment mechanisms that supports FIPS 203 and future HQC.","3xIsQo6gHukQn86lyfdpIFTKw_i50rZXoBEZXMEs2kQ",{"id":5177,"title":5178,"author":7,"authorTitle":8,"authorUrl":9,"body":5179,"canonical":9,"category":92,"date":5207,"description":5208,"draft":95,"extension":96,"faqs":5209,"findingsSource":9,"geo":5219,"image":417,"industries":5220,"keyFindings":9,"meta":5221,"modified":733,"navigation":103,"path":5222,"pullquote":9,"recommendations":9,"references":5223,"related":5227,"seo":5230,"seoTitle":5231,"signposts":9,"slug":5232,"stats":9,"stem":5233,"tags":5234,"tldr":5235,"__hash__":5236},"news\u002Fnews\u002Fbrazil-drops-blockchain-from-drex-pilot.md","Brazil Drops Blockchain From Its Drex Pilot, Restart Slips to 2027",{"type":11,"value":5180,"toc":5204},[5181,5185,5190,5193,5196,5199],[14,5182,5184],{"id":5183},"brazil-drops-blockchain-from-its-drex-pilot","Brazil drops blockchain from its Drex pilot",[19,5186,5187],{},[383,5188,5189],{},"13 AUGUST 2025, BRASILIA",[19,5191,5192],{},"Brazil dropped blockchain from its Drex pilot on 13 August 2025. Drex is Brazil's central bank digital currency project, and the change means no public CBDC platform is expected before 2027. Private tokenization is filling the gap in the meantime. The pilot carries no post-quantum requirement at this stage.",[19,5194,5195],{},"The absence of a post-quantum requirement is notable but not unusual for an early-stage project. A central bank digital currency would depend heavily on cryptography, so quantum risk is relevant to how Brazil eventually designs Drex. For now, though, the country has not attached a post-quantum requirement to the project, leaving that question for a later design phase.",[19,5197,5198],{},"Dropping blockchain amounts to a significant design change. The project needs time to regroup around a different technical approach, which is why the restart slips to 2027. With no public platform expected before then and private tokenization covering the interim, Brazil has effectively reset the timeline for its central bank digital currency work.",[19,5200,5201,5203],{},[383,5202,399],{}," Brazil's Drex reset shows a central bank digital currency project still settling its basic design, with no post-quantum requirement yet attached. For a system that will rely on cryptography, the eventual design choices will matter for quantum resilience. Organizations watching Drex should note that quantum requirements could appear as the design firms up toward the 2027 restart, even though none exists today.",{"title":8,"searchDepth":84,"depth":84,"links":5205},[5206],{"id":5183,"depth":84,"text":5184},"2025-08-13","Brazil dropped blockchain from its Drex pilot in August 2025, with no public CBDC platform before 2027 and no post-quantum requirement yet.",[5210,5213,5216],{"q":5211,"a":5212},"What changed in Brazil's Drex pilot?","On 13 August 2025, Brazil dropped blockchain from its Drex pilot, its central bank digital currency project. No public CBDC platform is expected before 2027, and private tokenization is filling the gap in the meantime. The pilot carries no post-quantum requirement yet.",{"q":5214,"a":5215},"Does the Drex pilot address quantum risk?","Not yet. The current pilot includes no post-quantum requirement. As a central bank digital currency would depend heavily on cryptography, quantum risk is relevant to its design, but Brazil has not attached a post-quantum requirement to Drex at this stage.",{"q":5217,"a":5218},"Why does the restart slip to 2027?","Dropping blockchain is a significant design change, so the project needs time to regroup around a different approach. With no public platform before 2027 and private tokenization filling the gap, Brazil has effectively reset the timeline for its CBDC work.",[3782],[227,100],{},"\u002Fnews\u002Fbrazil-drops-blockchain-from-drex-pilot",[5224],{"label":5225,"url":5226},"Banco Central do Brasil, \"Update on the Drex pilot,\" Aug. 13, 2025.","https:\u002F\u002Fwww.bcb.gov.br\u002Fen",[5228,5229],{"label":3740,"url":3785},{"label":2217,"url":2218},{"title":5178,"description":5208},"Brazil Drops Blockchain From Its Drex Pilot","brazil-drops-blockchain-from-drex-pilot","news\u002Fbrazil-drops-blockchain-from-drex-pilot",[256,257,258,1078,260],"Brazil dropped blockchain from its Drex pilot in August 2025, with no public central bank digital currency platform expected before 2027 and no post-quantum requirement yet.","Aur9Wrt_BcLdJNLQ2piIT3u0Q2pRB0cUAo5V5d3nTkU",{"id":5238,"title":1651,"author":7,"authorTitle":8,"authorUrl":9,"body":5239,"canonical":9,"category":92,"date":5267,"description":5268,"draft":95,"extension":96,"faqs":5269,"findingsSource":9,"geo":5279,"image":417,"industries":5280,"keyFindings":9,"meta":5281,"modified":793,"navigation":103,"path":1652,"pullquote":9,"recommendations":9,"references":5282,"related":5286,"seo":5290,"seoTitle":5291,"signposts":9,"slug":5292,"stats":9,"stem":5293,"tags":5294,"tldr":5295,"__hash__":5296},"news\u002Fnews\u002Findia-meity-cert-in-quantum-readiness-white-paper.md",{"type":11,"value":5240,"toc":5264},[5241,5245,5250,5253,5256,5259],[14,5242,5244],{"id":5243},"indias-meity-and-cert-in-publish-a-quantum-readiness-white-paper","India's MeitY and CERT-In publish a quantum readiness white paper",[19,5246,5247],{},[383,5248,5249],{},"11 JULY 2025, NEW DELHI",[19,5251,5252],{},"India's Ministry of Electronics and Information Technology, MeitY, and the national cyber agency CERT-In published a quantum readiness white paper on 11 July 2025. The paper offers guidance on preparing for post-quantum cryptography, helping Indian organizations understand the threat and the steps to prepare. It sets no deadline, so it informs rather than compels.",[19,5254,5255],{},"The white paper's role is to build awareness and point to practical steps. It covers the kinds of foundational work, such as cryptographic inventory and crypto agility, that any migration depends on. By issuing guidance before any dated mandate, MeitY and CERT-In gave organizations time to understand the problem before firmer obligations arrived.",[19,5257,5258],{},"Those obligations followed. The February 2026 task force report set dated critical-infrastructure deadlines, so the white paper and the task force together show India moving from awareness-building guidance toward concrete timelines. Organizations that engaged with the white paper early were better placed when the deadlines appeared.",[19,5260,5261,5263],{},[383,5262,399],{}," The MeitY and CERT-In white paper marks India's first broad step on post-quantum readiness: guidance to build awareness and point organizations toward foundational work. It carries no deadline, but it preceded the task force deadlines that did. Indian organizations can use the paper to understand the steps and start their inventory now, ahead of the dated critical-infrastructure targets that followed it.",{"title":8,"searchDepth":84,"depth":84,"links":5265},[5266],{"id":5243,"depth":84,"text":5244},"2025-07-11","India's MeitY and CERT-In published a quantum readiness white paper in July 2025, offering post-quantum guidance without setting a deadline.",[5270,5273,5276],{"q":5271,"a":5272},"What does the MeitY and CERT-In white paper provide?","Published on 11 July 2025, the white paper offers guidance on preparing for post-quantum cryptography. It helps Indian organizations understand the quantum threat and the steps to prepare, but it sets no deadline, so it informs rather than compels action.",{"q":5274,"a":5275},"Does the white paper set a deadline?","No. The white paper is guidance without a deadline. It builds awareness and points to practical steps such as inventory and crypto agility, leaving dated obligations to later instruments like the 2026 task force report that set critical-infrastructure targets.",{"q":5277,"a":5278},"How does it relate to India's task force deadlines?","The white paper came first, in July 2025, building awareness and guidance. The February 2026 task force report then set dated critical-infrastructure deadlines. Together they show India moving from guidance toward concrete timelines over time.",[3650],[419,100],{},[5283],{"label":5284,"url":5285},"Ministry of Electronics and Information Technology (MeitY) and CERT-In, \"Quantum readiness white paper,\" Jul. 11, 2025.","https:\u002F\u002Fwww.cert-in.org.in\u002F",[5287,5289],{"label":5288,"url":3723},"India Task Force Sets a 2029 Deadline for Critical Infrastructure Migration",{"label":815,"url":816},{"title":1651,"description":5268},"India MeitY and CERT-In Issue PQC Readiness Paper","india-meity-cert-in-quantum-readiness-white-paper","news\u002Findia-meity-cert-in-quantum-readiness-white-paper",[368,132,133,549,439],"India's MeitY and CERT-In published a quantum readiness white paper in July 2025, offering guidance on preparing for post-quantum cryptography without setting a deadline.","I8OMkYE6MfSVdeOLhLo7OX8xZBe1n_12D4OYsmsOrI4",{"id":5298,"title":4412,"author":7,"authorTitle":8,"authorUrl":9,"body":5299,"canonical":9,"category":220,"date":5327,"description":5328,"draft":95,"extension":96,"faqs":5329,"findingsSource":9,"geo":5339,"image":417,"industries":5340,"keyFindings":9,"meta":5341,"modified":890,"navigation":103,"path":4413,"pullquote":9,"recommendations":9,"references":5342,"related":5346,"seo":5349,"seoTitle":5350,"signposts":9,"slug":5351,"stats":9,"stem":5352,"tags":5353,"tldr":5354,"__hash__":5355},"news\u002Fnews\u002Fbis-papers-158-start-post-quantum-now.md",{"type":11,"value":5300,"toc":5324},[5301,5305,5310,5313,5316,5319],[14,5302,5304],{"id":5303},"bis-papers-no-158-urges-banks-to-start-post-quantum-work-now","BIS Papers No. 158 urges banks to start post-quantum work now",[19,5306,5307],{},[383,5308,5309],{},"7 JULY 2025, BASEL",[19,5311,5312],{},"The Bank for International Settlements published BIS Papers No. 158 on 7 July 2025, urging banks to start post-quantum work now. The paper names cryptographic inventory as the foundation and recommends crypto agility, defense in depth, hybrid schemes and a phased approach. It gives banks a clear, practical set of priorities rather than an abstract warning.",[19,5314,5315],{},"Inventory leads the list for a reason. A bank cannot migrate or protect cryptography it has not located, so mapping where and how cryptography is used underpins every later step. The paper places it first because prioritisation, crypto agility and phased migration all depend on having that picture of the estate.",[19,5317,5318],{},"The source gives the message weight. The Bank for International Settlements serves central banks and shapes thinking across the global financial system, so a BIS paper urging banks to start now resonates internationally. It reinforces similar calls from national supervisors and central banks, adding a global voice to a consistent message.",[19,5320,5321,5323],{},[383,5322,399],{}," BIS Papers No. 158 adds the authority of the central banks' bank to a now-familiar message: start post-quantum work now, beginning with inventory. Its recommended priorities, agility, defense in depth, hybrids and phasing, match the broad consensus. Banks can treat the paper as confirmation that the time to act is current, and start by inventorying their cryptography as it advises.",{"title":8,"searchDepth":84,"depth":84,"links":5325},[5326],{"id":5303,"depth":84,"text":5304},"2025-07-07","BIS Papers No. 158 urges banks to start post-quantum work now, with inventory as the foundation plus crypto agility, defense in depth and hybrid schemes.",[5330,5333,5336],{"q":5331,"a":5332},"What does BIS Papers No. 158 recommend?","Published on 7 July 2025, the paper urges banks to start post-quantum work now. It names inventory as the foundation and recommends crypto agility, defense in depth, hybrid schemes and a phased approach, giving banks a clear set of practical priorities.",{"q":5334,"a":5335},"Why is inventory the foundation?","A bank cannot migrate or protect cryptography it has not located, so an inventory of where and how cryptography is used underpins every later step. The paper puts it first because prioritisation, agility and phased migration all depend on knowing the starting point.",{"q":5337,"a":5338},"What authority does the BIS carry here?","The Bank for International Settlements serves central banks and shapes thinking across the global financial system. A BIS paper urging banks to start now carries weight internationally, reinforcing similar messages from national supervisors and central banks.",[1152],[227,100],{},[5343],{"label":5344,"url":5345},"Bank for International Settlements, \"Project Leap and the quantum threat to finance,\" BIS Papers No. 158, Jul. 7, 2025.","https:\u002F\u002Fwww.bis.org\u002Fpubl\u002Fbppdf\u002Fbispap158.htm",[5347,5348],{"label":2056,"url":2057},{"label":1331,"url":1332},{"title":4412,"description":5328},"BIS Papers No. 158 Urges Banks to Start PQC Now","bis-papers-158-start-post-quantum-now","news\u002Fbis-papers-158-start-post-quantum-now",[257,133,549,368,260],"BIS Papers No. 158, published in July 2025, urges banks to start post-quantum work now, with inventory as the foundation and crypto agility, defense in depth and hybrid schemes.","FBvqa5DsOpJ1yrpRwJJBWVti4WoYsAJLKCDJMk-SNxg",{"id":5357,"title":5358,"author":7,"authorTitle":8,"authorUrl":9,"body":5359,"canonical":9,"category":92,"date":5387,"description":5388,"draft":95,"extension":96,"faqs":5389,"findingsSource":9,"geo":5399,"image":417,"industries":5400,"keyFindings":9,"meta":5401,"modified":1509,"navigation":103,"path":5402,"pullquote":9,"recommendations":9,"references":5403,"related":5406,"seo":5409,"seoTitle":5410,"signposts":9,"slug":5411,"stats":9,"stem":5412,"tags":5413,"tldr":5414,"__hash__":5415},"news\u002Fnews\u002F21-european-agencies-renew-joint-pqc-statement.md","Twenty-One European Agencies Renew Their Joint Post-Quantum Statement",{"type":11,"value":5360,"toc":5384},[5361,5365,5370,5373,5376,5379],[14,5362,5364],{"id":5363},"twenty-one-european-agencies-renew-their-joint-post-quantum-statement","Twenty-one European agencies renew their joint post-quantum statement",[19,5366,5367],{},[383,5368,5369],{},"1 JULY 2025, BRUSSELS",[19,5371,5372],{},"Twenty-one European agencies, including Norway, renewed a joint post-quantum statement on 1 July 2025. The statement urges organizations to treat post-quantum planning as core risk management rather than a specialist side issue. It builds on a 2024 statement signed by eighteen agencies, so the renewal widens the group of signatories by three.",[19,5374,5375],{},"The content carries forward a consistent message. The agencies urge organizations to adopt hybrid schemes and to protect sensitive data against store-now-decrypt-later attacks by the end of 2030. Framing migration as risk management rather than a technical project pushes it onto the agenda of boards and risk committees, not just cryptographers.",[19,5377,5378],{},"The growth from eighteen to twenty-one signatories matters as a signal. A broader coalition of national agencies agreeing on the same message strengthens the European consensus and makes it harder for an organization to treat post-quantum readiness as an open question. The addition of Norway extends that consensus beyond the European Union itself.",[19,5380,5381,5383],{},[383,5382,399],{}," The renewed statement shows European cybersecurity agencies converging on a single message: start now, use hybrids, and protect long-lived sensitive data against store-now-decrypt-later by the end of 2030. The widening group of signatories gives that message more weight. Organizations across Europe can read it as a clear expectation to fold post-quantum planning into their standard risk management without waiting for binding rules.",{"title":8,"searchDepth":84,"depth":84,"links":5385},[5386],{"id":5363,"depth":84,"text":5364},"2025-07-01","Twenty-one European agencies, including Norway, renewed a joint post-quantum statement in July 2025 urging organizations to treat planning as core risk management.",[5390,5393,5396],{"q":5391,"a":5392},"What is the joint statement?","On 1 July 2025, twenty-one European agencies, including Norway, renewed a joint statement urging organizations to treat post-quantum planning as core risk management. It builds on a 2024 statement by eighteen agencies, widening the group of signatories.",{"q":5394,"a":5395},"What does it ask organizations to do?","The statement urges organizations to adopt hybrid schemes and to protect sensitive data against store-now-decrypt-later attacks by the end of 2030. It frames post-quantum planning as part of standard risk management rather than a specialist concern.",{"q":5397,"a":5398},"How does it differ from the 2024 version?","The 2024 statement had eighteen agencies; the 2025 renewal has twenty-one, including Norway. The growth in signatories signals broadening European consensus, with the core message, start now and treat migration as risk management, carried forward.",[416],[419,100],{},"\u002Fnews\u002F21-european-agencies-renew-joint-pqc-statement",[5404],{"label":5405,"url":4287},"European national cybersecurity agencies, \"Joint statement on post-quantum cryptography migration,\" Jul. 1, 2025.",[5407,5408],{"label":3214,"url":3215},{"label":4290,"url":4291},{"title":5358,"description":5388},"21 European Agencies Renew Joint PQC Statement","21-european-agencies-renew-joint-pqc-statement","news\u002F21-european-agencies-renew-joint-pqc-statement",[1431,368,132,259,439],"Twenty-one European agencies, including Norway, renewed a joint statement in July 2025 urging organizations to treat post-quantum planning as core risk management.","YFAlMQFxWxumCMd0l7XKdKQF0VHadIUzEn1YL8xB0_0",{"id":5417,"title":5418,"author":7,"authorTitle":8,"authorUrl":9,"body":5419,"canonical":9,"category":92,"date":5447,"description":5448,"draft":95,"extension":96,"faqs":5449,"findingsSource":9,"geo":5459,"image":417,"industries":5461,"keyFindings":9,"meta":5462,"modified":793,"navigation":103,"path":5463,"pullquote":9,"recommendations":9,"references":5464,"related":5468,"seo":5473,"seoTitle":5474,"signposts":9,"slug":5475,"stats":9,"stem":5476,"tags":5477,"tldr":5478,"__hash__":5479},"news\u002Fnews\u002Fcanada-federal-migration-roadmap-itsm-40-001.md","Canada's Federal Migration Roadmap Sets 2031 and 2035 Post-Quantum Deadlines",{"type":11,"value":5420,"toc":5444},[5421,5425,5430,5433,5436,5439],[14,5422,5424],{"id":5423},"canadas-federal-migration-roadmap-sets-2031-and-2035-deadlines","Canada's federal migration roadmap sets 2031 and 2035 deadlines",[19,5426,5427],{},[383,5428,5429],{},"23 JUNE 2025, OTTAWA",[19,5431,5432],{},"Canada's federal migration roadmap, ITSM.40.001, was issued on 23 June 2025. It calls for migration plans in April 2026, high-priority systems migrated by the end of 2031, and the remaining systems by the end of 2035. The staged dates give federal organizations a clear schedule, moving from planning to priority systems to full completion.",[19,5434,5435],{},"The roadmap gained force through a Treasury Board policy instrument. The SPIN, issued on 9 October 2025, turns the guidance into a requirement, and contracts signed after 1 April 2026 carry post-quantum clauses. That procurement lever means the roadmap reaches suppliers, not just internal federal systems, extending its effect across the government's supply chain.",[19,5437,5438],{},"The April 2026 contract date is the one suppliers should mark. From that point, new agreements with the Canadian government carry post-quantum clauses, so vendors must be ready to meet them. Pairing internal deadlines with procurement clauses mirrors the approach other governments have taken, where contract terms turn a roadmap into an obligation that vendors cannot ignore.",[19,5440,5441,5443],{},[383,5442,399],{}," Canada has backed its 2031 and 2035 federal deadlines with a Treasury Board instrument and post-quantum contract clauses from April 2026, so the roadmap carries real force. Federal organizations have a staged schedule, and their suppliers face post-quantum terms in new contracts. Vendors to the Canadian government should prepare now, since the contract clauses begin applying in April 2026.",{"title":8,"searchDepth":84,"depth":84,"links":5445},[5446],{"id":5423,"depth":84,"text":5424},"2025-06-23","Canada's federal roadmap sets high-priority systems by end-2031 and the rest by end-2035, with post-quantum clauses in contracts signed after April 2026.",[5450,5453,5456],{"q":5451,"a":5452},"What deadlines does Canada's federal roadmap set?","The roadmap, ITSM.40.001 of 23 June 2025, calls for migration plans in April 2026, high-priority systems migrated by the end of 2031, and the rest by the end of 2035. The staged dates give federal organizations a defined schedule to work against.",{"q":5454,"a":5455},"How does Canada give the roadmap force?","A Treasury Board policy instrument, the SPIN issued on 9 October 2025, gives the roadmap force. Contracts signed after 1 April 2026 carry post-quantum clauses, so the requirement reaches suppliers through procurement, not just internal federal systems.",{"q":5457,"a":5458},"When do post-quantum contract clauses apply?","Contracts signed after 1 April 2026 carry post-quantum clauses. That timing means suppliers to the Canadian government should expect post-quantum requirements in new agreements from that date, flowing the roadmap's expectations into the supply chain.",[5460],"ottawa",[419,100],{},"\u002Fnews\u002Fcanada-federal-migration-roadmap-itsm-40-001",[5465],{"label":5466,"url":5467},"Canadian Centre for Cyber Security, \"Guidance on becoming cryptographically agile (ITSM.40.001),\" Jun. 23, 2025; Treasury Board SPIN, Oct. 9, 2025.","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen",[5469,5472],{"label":5470,"url":5471},"Canadian CFDIR Issues Voluntary Post-Quantum Guidance for the Financial Sector","\u002Fnews\u002Fcanada-cfdir-voluntary-pqc-guidance",{"label":432,"url":124},{"title":5418,"description":5448},"Canada's Federal PQC Roadmap Sets 2031 and 2035 Dates","canada-federal-migration-roadmap-itsm-40-001","news\u002Fcanada-federal-migration-roadmap-itsm-40-001",[132,134,2157,759,439],"Canada's federal migration roadmap sets high-priority systems by end-2031 and the rest by end-2035, with post-quantum clauses in contracts signed after April 2026.","x5UmrH4j1nLz3Dvnuke-D21YTo0P5NoMVVo8fw6yBU4",{"id":5481,"title":5482,"author":7,"authorTitle":8,"authorUrl":9,"body":5483,"canonical":9,"category":92,"date":5511,"description":5512,"draft":95,"extension":96,"faqs":5513,"findingsSource":9,"geo":5523,"image":417,"industries":5524,"keyFindings":9,"meta":5525,"modified":4748,"navigation":103,"path":3215,"pullquote":9,"recommendations":9,"references":5526,"related":5529,"seo":5533,"seoTitle":5534,"signposts":9,"slug":5535,"stats":9,"stem":5536,"tags":5537,"tldr":5538,"__hash__":5539},"news\u002Fnews\u002Feu-roadmap-2026-2030-2035-milestones.md","EU Post-Quantum Roadmap Sets 2026, 2030 and 2035 Migration Milestones",{"type":11,"value":5484,"toc":5508},[5485,5489,5494,5497,5500,5503],[14,5486,5488],{"id":5487},"eu-roadmap-sets-2026-2030-and-2035-migration-milestones","EU roadmap sets 2026, 2030 and 2035 migration milestones",[19,5490,5491],{},[383,5492,5493],{},"11 JUNE 2025, BRUSSELS",[19,5495,5496],{},"The European Union's post-quantum roadmap, published on 11 June 2025, sets three dated milestones. Member states should start national strategies by the end of 2026, migrate high-risk use cases by the end of 2030, and migrate medium-risk use cases by the end of 2035. Germany, France and the Netherlands co-chaired the work under the NIS Cooperation Group, so the roadmap reflects a coordinated European position.",[19,5498,5499],{},"Staging the work by risk lets member states tackle the most exposed systems first. High-risk use cases, where a breach would cause the greatest harm or where data must stay confidential for many years, carry the earlier 2030 date. Medium-risk systems follow by 2035, matching the horizon several other jurisdictions use.",[19,5501,5502],{},"The roadmap also references the Cyber Resilience Act's December 2027 upgradability date for vendors. That date requires products to support security updates, which matters for post-quantum migration because a system that cannot be updated cannot receive new algorithms. The roadmap therefore ties the migration timeline to the ability to deliver the new cryptography through updates.",[19,5504,5505,5507],{},[383,5506,399],{}," The roadmap converts the Commission's earlier soft-law recommendation into dated milestones that member states can plan against. The 2026, 2030 and 2035 sequence gives organizations in Europe a clear risk-based schedule, and the link to the Cyber Resilience Act's 2027 upgradability date reminds vendors that updatable products are a precondition for migration. Starting discovery now leaves room to meet the 2030 high-risk target.",{"title":8,"searchDepth":84,"depth":84,"links":5509},[5510],{"id":5487,"depth":84,"text":5488},"2025-06-11","The EU post-quantum roadmap sets national strategies by end-2026, high-risk migration by end-2030 and medium-risk systems by end-2035, co-chaired by DE, FR and NL.",[5514,5517,5520],{"q":5515,"a":5516},"What are the EU roadmap's milestones?","The roadmap asks member states to start national strategies by the end of 2026, migrate high-risk use cases by the end of 2030, and migrate medium-risk use cases by the end of 2035. The dates stage the work by risk rather than requiring everything at once.",{"q":5518,"a":5519},"Who produced the roadmap?","Germany, France and the Netherlands co-chaired the work under the NIS Cooperation Group. The roadmap was published on 11 June 2025 and reflects a coordinated European position rather than a single member state's plan.",{"q":5521,"a":5522},"How does the Cyber Resilience Act fit in?","The roadmap references the Cyber Resilience Act's December 2027 upgradability date for vendors, which requires products to support security updates. That date matters for post-quantum migration because systems that cannot be updated cannot receive new algorithms.",[416],[419,100],{},[5527],{"label":5528,"url":1797},"NIS Cooperation Group, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" European Commission, Jun. 11, 2025.",[5530,5531],{"label":3217,"url":3218},{"label":5532,"url":4041},"Commission Proposes Writing Post-Quantum Migration Into NIS2",{"title":5482,"description":5512},"EU Roadmap Sets 2026, 2030 and 2035 PQC Milestones","eu-roadmap-2026-2030-2035-milestones","news\u002Feu-roadmap-2026-2030-2035-milestones",[1431,132,1338,2157,439],"The EU post-quantum roadmap, published in June 2025, sets national strategies by end-2026, high-risk migration by end-2030 and medium-risk systems by end-2035.","mS2WJqE9o-XC2ojCI4AyeaV4IwwfMhGmRSF9qkl4vjY",{"id":5541,"title":2918,"author":7,"authorTitle":8,"authorUrl":9,"body":5542,"canonical":9,"category":92,"date":5570,"description":5571,"draft":95,"extension":96,"faqs":5572,"findingsSource":9,"geo":5582,"image":417,"industries":5583,"keyFindings":9,"meta":5584,"modified":1156,"navigation":103,"path":2919,"pullquote":9,"recommendations":9,"references":5585,"related":5589,"seo":5592,"seoTitle":5593,"signposts":9,"slug":5594,"stats":9,"stem":5595,"tags":5596,"tldr":5571,"__hash__":5597},"news\u002Fnews\u002Fbank-of-japan-joins-g7-central-bank-quantum-group.md",{"type":11,"value":5543,"toc":5567},[5544,5548,5553,5556,5559,5562],[14,5545,5547],{"id":5546},"bank-of-japan-joins-the-g7-central-bank-quantum-working-group","Bank of Japan joins the G7 central bank quantum working group",[19,5549,5550],{},[383,5551,5552],{},"1 JUNE 2025, TOKYO",[19,5554,5555],{},"The Bank of Japan joined the G7 central bank quantum working group in June 2025. The group brings together G7 central banks to examine what quantum computing means for central banking and financial stability. It went on to produce a reference report during 11 to 13 May 2026.",[19,5557,5558],{},"Central banks have good reason to study the question together. They oversee critical financial infrastructure and payment systems that depend on cryptography, so a cryptographically relevant quantum computer would threaten systems at the core of the financial system. Working as a group lets them coordinate on the risks and align their supervisory and operational responses rather than diverging.",[19,5560,5561],{},"The May 2026 reference report informs the participants' thinking rather than imposing requirements on commercial banks. As a central bank working-group document, its influence runs through how the member central banks shape their own supervision and operations. Commercial banks feel its effect indirectly, through the expectations their central banks set.",[19,5563,5564,5566],{},[383,5565,399],{}," The Bank of Japan's participation shows central banks treating quantum risk as a shared financial-stability concern, not just an institution-level IT issue. Coordination among G7 central banks increases the chance of consistent expectations across major markets. Commercial banks should expect the thinking in forums like this to flow into the supervisory expectations they eventually face, so early preparation remains prudent.",{"title":8,"searchDepth":84,"depth":84,"links":5568},[5569],{"id":5546,"depth":84,"text":5547},"2025-06-01","The Bank of Japan joined the G7 central bank quantum working group in June 2025, and the group produced a reference report in May 2026.",[5573,5576,5579],{"q":5574,"a":5575},"What is the G7 central bank quantum working group?","It is a working group of G7 central banks examining the implications of quantum computing for central banking and financial stability. The Bank of Japan joined in June 2025, and the group produced a reference report during 11 to 13 May 2026.",{"q":5577,"a":5578},"Why do central banks study quantum computing?","Central banks oversee critical financial infrastructure and payment systems that rely on cryptography. Studying quantum computing together helps them coordinate on the risks a cryptographically relevant quantum computer would pose and align their supervisory and operational responses.",{"q":5580,"a":5581},"What did the reference report cover?","The group produced a reference report dated 11 to 13 May 2026. As a reference document from a central bank working group, it informs the participants' thinking on quantum risk rather than imposing requirements on commercial banks directly.",[4527],[227,100],{},[5586],{"label":5587,"url":5588},"Bank of Japan, \"Participation in the G7 central bank quantum working group,\" Jun. 2025; reference report May 11-13, 2026.","https:\u002F\u002Fwww.boj.or.jp\u002Fen\u002F",[5590,5591],{"label":1331,"url":1332},{"label":4540,"url":4541},{"title":2918,"description":5571},"Bank of Japan Joins G7 Central Bank Quantum Group","bank-of-japan-joins-g7-central-bank-quantum-group","news\u002Fbank-of-japan-joins-g7-central-bank-quantum-group",[257,368,2862,258,260],"S0fVbhvngeEIWxBgxJ94Gr3FAXal1QP6wxKY67crqzo",{"id":5599,"title":5600,"author":7,"authorTitle":8,"authorUrl":9,"body":5601,"canonical":9,"category":92,"date":5629,"description":5630,"draft":95,"extension":96,"faqs":5631,"findingsSource":9,"geo":5641,"image":417,"industries":5642,"keyFindings":9,"meta":5643,"modified":890,"navigation":103,"path":5644,"pullquote":9,"recommendations":9,"references":5645,"related":5649,"seo":5652,"seoTitle":5653,"signposts":9,"slug":5654,"stats":9,"stem":5655,"tags":5656,"tldr":5657,"__hash__":5658},"news\u002Fnews\u002Feu-certification-group-eccg-adds-pqc.md","EU Certification Group ECCG Adds Post-Quantum Cryptography, With a v3 Draft in Review",{"type":11,"value":5602,"toc":5626},[5603,5607,5612,5615,5618,5621],[14,5604,5606],{"id":5605},"eu-certification-group-eccg-adds-post-quantum-cryptography","EU certification group ECCG adds post-quantum cryptography",[19,5608,5609],{},[383,5610,5611],{},"6 MAY 2025, BRUSSELS",[19,5613,5614],{},"The European Cybersecurity Certification Group, ECCG, is adding post-quantum cryptography to its Agreed Cryptographic Mechanisms. It published version 2.0 on 6 May 2025 and put a version 3 draft out for public review ending in July 2026. The work extends the mechanisms that products may use to achieve certification in the European Union toward post-quantum options.",[19,5616,5617],{},"Certification is the lever here. The scheme defines which cryptographic mechanisms a product may use to earn certification, so adding post-quantum options lets vendors certify quantum-resistant products. Without approved mechanisms, a vendor cannot certify a post-quantum product, which would hold back trusted procurement across the single market.",[19,5619,5620],{},"The version 3 draft stayed in public review through the end of July 2026, and the final text follows once the ECCG addresses the comments. Vendors should track the ECCG process to learn which post-quantum mechanisms the scheme will approve, because that list determines what they can build into certified products. The timing links product certification to the European Union's broader migration milestones.",[19,5622,5623,5625],{},[383,5624,399],{}," The ECCG's work turns post-quantum cryptography into something vendors can certify, which is a quiet but necessary step for the European market. Approved mechanisms let certified products carry quantum-resistant cryptography, aligning procurement with the European Union's migration goals. Vendors planning certified products should follow the version 3 review so their roadmaps match the mechanisms the scheme will approve.",{"title":8,"searchDepth":84,"depth":84,"links":5627},[5628],{"id":5605,"depth":84,"text":5606},"2025-05-06","The EU certification group ECCG is adding post-quantum cryptography to its scheme; version 2.0 published in May 2025, with a version 3 draft in public review.",[5632,5635,5638],{"q":5633,"a":5634},"What is the ECCG doing on post-quantum?","The European Cybersecurity Certification Group is adding post-quantum cryptography to its Agreed Cryptographic Mechanisms. Version 2.0 was published on 6 May 2025, and a version 3 draft went to public review ending in July 2026, extending the approved mechanisms toward post-quantum options.",{"q":5636,"a":5637},"Why does certification matter for PQC?","Certification schemes define which cryptographic mechanisms products may use to be certified in the European Union. Adding post-quantum options lets vendors certify quantum-resistant products, which is a precondition for those products to be trusted and procured across the single market.",{"q":5639,"a":5640},"When will version 3 be final?","The version 3 draft was in public review through the end of July 2026. The final text follows the review once comments are addressed, so vendors should track the ECCG process to know which post-quantum mechanisms will be approved for certified products.",[416],[419,228],{},"\u002Fnews\u002Feu-certification-group-eccg-adds-pqc",[5646],{"label":5647,"url":5648},"European Cybersecurity Certification Group (ECCG), \"Agreed Cryptographic Mechanisms (ACM), version 2.0,\" May 6, 2025.","https:\u002F\u002Fcertification.enisa.europa.eu\u002F",[5650,5651],{"label":3214,"url":3215},{"label":3161,"url":3207},{"title":5600,"description":5630},"EU Certification Group ECCG Adds PQC to Scheme","eu-certification-group-eccg-adds-pqc","news\u002Feu-certification-group-eccg-adds-pqc",[1431,438,134,368,439],"The EU certification group ECCG is adding post-quantum cryptography to its scheme, with version 2.0 published in May 2025 and a version 3 draft in public review.","elE5nTysMljpJihFyVMrrT5hQsBN6G5xH_kXBM9WMM8",{"id":5660,"title":5661,"author":7,"authorTitle":8,"authorUrl":9,"body":5662,"canonical":9,"category":92,"date":5690,"description":5691,"draft":95,"extension":96,"faqs":5692,"findingsSource":9,"geo":5702,"image":417,"industries":5703,"keyFindings":9,"meta":5704,"modified":1509,"navigation":103,"path":4922,"pullquote":9,"recommendations":9,"references":5705,"related":5709,"seo":5714,"seoTitle":5715,"signposts":9,"slug":5716,"stats":9,"stem":5717,"tags":5718,"tldr":5719,"__hash__":5720},"news\u002Fnews\u002Fuk-cmorg-voluntary-pqc-guidance.md","UK CMORG Issues Voluntary Post-Quantum Guidance for Financial Institutions",{"type":11,"value":5663,"toc":5687},[5664,5668,5673,5676,5679,5682],[14,5665,5667],{"id":5666},"uk-cmorg-issues-voluntary-post-quantum-guidance-for-financial-institutions","UK CMORG issues voluntary post-quantum guidance for financial institutions",[19,5669,5670],{},[383,5671,5672],{},"8 APRIL 2025, LONDON",[19,5674,5675],{},"The Cross Market Operational Resilience Group, CMORG, published voluntary post-quantum guidance for UK financial institutions on 8 April 2025. The guidance sets strategic direction for the sector and aligns with the NCSC and NIST, giving firms a finance-specific view that stays consistent with national and international standards.",[19,5677,5678],{},"The guidance is voluntary. It offers UK financial institutions a shared strategic direction rather than imposing requirements, so firms can use it to coordinate their approach without a regulatory obligation attached to this document. That makes it a reference point the sector can rally around while firmer rules develop elsewhere.",[19,5680,5681],{},"Alignment with the NCSC and NIST is the guidance's key feature. A firm that follows CMORG moves in step with UK national guidance and the international algorithm standards, which avoids steering the sector toward choices that later clash with those authorities. For a sector where firms interconnect heavily, that consistency reduces the risk of fragmented, incompatible migrations.",[19,5683,5684,5686],{},[383,5685,399],{}," CMORG gives UK financial institutions a coordinated, finance-specific starting point that does not conflict with the NCSC or NIST. Because it is voluntary, its value depends on firms adopting it, but its alignment with the recognised authorities makes it a low-risk reference for building a migration strategy. Firms can use it to shape plans now, ahead of any firmer supervisory expectations.",{"title":8,"searchDepth":84,"depth":84,"links":5688},[5689],{"id":5666,"depth":84,"text":5667},"2025-04-08","UK CMORG published voluntary post-quantum guidance for financial institutions in April 2025, aligned with NCSC and NIST, setting strategic direction.",[5693,5696,5699],{"q":5694,"a":5695},"What is CMORG's guidance?","The Cross Market Operational Resilience Group published voluntary post-quantum guidance for UK financial institutions on 8 April 2025. It sets strategic direction for the sector and aligns with NCSC and NIST, so firms get a finance-specific view that is consistent with national and international standards.",{"q":5697,"a":5698},"Is the CMORG guidance mandatory?","No. The guidance is voluntary. It gives UK financial institutions a shared strategic direction rather than imposing requirements, so firms can adopt it to coordinate their approach without a regulatory obligation attached to this particular document.",{"q":5700,"a":5701},"How does it relate to NCSC and NIST?","CMORG aligns its guidance with NCSC and NIST, so a firm that follows it moves in step with UK national guidance and the international algorithm standards. That alignment avoids sending the sector in a direction that later conflicts with those authorities.",[4908],[227,100],{},[5706],{"label":5707,"url":5708},"Cross Market Operational Resilience Group (CMORG), \"Post-Quantum Cryptography guidance for the UK financial sector,\" Apr. 8, 2025.","https:\u002F\u002Fwww.ukfinance.org.uk\u002F",[5710,5711],{"label":4918,"url":4919},{"label":5712,"url":5713},"WEF and UK FCA White Paper on Quantum Security for Finance","\u002Fnews\u002Fwef-uk-fca-quantum-security-finance-white-paper",{"title":5661,"description":5691},"UK CMORG Issues Voluntary PQC Guidance for Finance","uk-cmorg-voluntary-pqc-guidance","news\u002Fuk-cmorg-voluntary-pqc-guidance",[257,1809,368,132,260],"UK CMORG published voluntary post-quantum guidance for financial institutions in April 2025, setting strategic direction that aligns with NCSC and NIST.","4lxBPFv5RaIqiFxNn5fcvmFW7ZTexuVEdqcyuQQ0uG0",{"id":5722,"title":4537,"author":7,"authorTitle":8,"authorUrl":9,"body":5723,"canonical":9,"category":92,"date":5751,"description":5752,"draft":95,"extension":96,"faqs":5753,"findingsSource":9,"geo":5763,"image":417,"industries":5764,"keyFindings":9,"meta":5765,"modified":890,"navigation":103,"path":4538,"pullquote":9,"recommendations":9,"references":5766,"related":5770,"seo":5773,"seoTitle":5774,"signposts":9,"slug":5775,"stats":9,"stem":5776,"tags":5777,"tldr":5778,"__hash__":5779},"news\u002Fnews\u002Fjapan-cryptrec-adds-pqc-ciphers-list.md",{"type":11,"value":5724,"toc":5748},[5725,5729,5734,5737,5740,5743],[14,5726,5728],{"id":5727},"japans-cryptrec-adds-post-quantum-algorithms-to-its-ciphers-list","Japan's CRYPTREC adds post-quantum algorithms to its ciphers list",[19,5730,5731],{},[383,5732,5733],{},"2 APRIL 2025, TOKYO",[19,5735,5736],{},"Japan's cryptography evaluation body, CRYPTREC, issued a post-quantum guideline on 2 April 2025 and revised its Ciphers List on 30 March 2026 to include an ML-KEM table. It is evaluating the signature schemes ML-DSA and SLH-DSA during 2026. Japan is therefore adding post-quantum algorithms to its approved list in stages rather than all at once.",[19,5738,5739],{},"The Ciphers List carries weight in Japan. It catalogues the cryptographic algorithms recommended for government use, and industry references it widely. Adding ML-KEM, and later the signature schemes, tells Japanese organizations which post-quantum algorithms they can adopt with official backing, which removes a layer of uncertainty from their choices.",[19,5741,5742],{},"The staging, key establishment first and signatures to follow, mirrors how several other authorities have introduced post-quantum algorithms. Key establishment addresses the more urgent harvest-now-decrypt-later risk, so prioritising ML-KEM makes sense. The 2026 evaluations of ML-DSA and SLH-DSA will complete the picture for signatures once CRYPTREC finishes its assessment.",[19,5744,5745,5747],{},[383,5746,399],{}," CRYPTREC's updates give Japanese organizations an officially backed answer to which post-quantum algorithms to use, starting with ML-KEM. Because industry follows the Ciphers List, the additions ripple beyond government into the wider market. Teams can adopt the listed algorithms now for key establishment and watch the 2026 signature evaluations to complete their post-quantum toolkit.",{"title":8,"searchDepth":84,"depth":84,"links":5749},[5750],{"id":5727,"depth":84,"text":5728},"2025-04-02","Japan's CRYPTREC added post-quantum algorithms to its Ciphers List, revised March 2026 with an ML-KEM table, and is evaluating ML-DSA and SLH-DSA in 2026.",[5754,5757,5760],{"q":5755,"a":5756},"What did CRYPTREC do?","CRYPTREC issued a post-quantum guideline on 2 April 2025 and revised its Ciphers List on 30 March 2026 to include an ML-KEM table. It is evaluating ML-DSA and SLH-DSA during 2026, so Japan's approved-cipher list is adding post-quantum algorithms in stages.",{"q":5758,"a":5759},"What is the CRYPTREC Ciphers List?","The Ciphers List is Japan's catalogue of cryptographic algorithms recommended for government and widely referenced by industry. Adding ML-KEM, and later the signature schemes, tells Japanese organizations which post-quantum algorithms they can adopt with official backing.",{"q":5761,"a":5762},"When will the signature schemes be added?","CRYPTREC is evaluating ML-DSA and SLH-DSA, the post-quantum signature standards, during 2026. The staged approach, key establishment first and signatures to follow, mirrors how several other authorities have rolled post-quantum algorithms into their recommendations.",[4527],[419,228],{},[5767],{"label":5768,"url":5769},"CRYPTREC, \"Guideline on post-quantum cryptography and revised Ciphers List,\" Apr. 2, 2025; list revised Mar. 30, 2026.","https:\u002F\u002Fwww.cryptrec.go.jp\u002Fen\u002F",[5771,5772],{"label":4543,"url":4530},{"label":2673,"url":2674},{"title":4537,"description":5752},"Japan's CRYPTREC Adds PQC to Its Ciphers List","japan-cryptrec-adds-pqc-ciphers-list","news\u002Fjapan-cryptrec-adds-pqc-ciphers-list",[438,368,549,132,439],"Japan's CRYPTREC issued post-quantum guidance in April 2025 and revised its Ciphers List in March 2026 with an ML-KEM table, with ML-DSA and SLH-DSA evaluations in 2026.","E4T48GtckIJsaUQIGHzxLGIPtrnamSIebvxC6AEgKqc",{"id":5781,"title":5782,"author":7,"authorTitle":8,"authorUrl":9,"body":5783,"canonical":9,"category":92,"date":5811,"description":5812,"draft":95,"extension":96,"faqs":5813,"findingsSource":9,"geo":5823,"image":417,"industries":5825,"keyFindings":9,"meta":5826,"modified":890,"navigation":103,"path":2215,"pullquote":9,"recommendations":9,"references":5827,"related":5831,"seo":5834,"seoTitle":5835,"signposts":9,"slug":5836,"stats":9,"stem":5837,"tags":5838,"tldr":5839,"__hash__":5840},"news\u002Fnews\u002Fcayman-moves-vasps-to-licensing.md","Cayman Moves Virtual Asset Service Providers From Registration to Licensing",{"type":11,"value":5784,"toc":5808},[5785,5789,5794,5797,5800,5803],[14,5786,5788],{"id":5787},"cayman-moves-virtual-asset-service-providers-from-registration-to-licensing","Cayman moves virtual asset service providers from registration to licensing",[19,5790,5791],{},[383,5792,5793],{},"1 APRIL 2025, GEORGE TOWN",[19,5795,5796],{},"The Cayman Islands moved virtual asset service providers from a registration regime to a licensing regime from 1 April 2025. Licensing sets a higher bar than registration, and it requires firms to have cybersecurity plans as a condition of operating. The change raises what the regulator expects of virtual asset businesses before they can do business.",[19,5798,5799],{},"The difference between the two regimes is substantive. Registration records that a firm exists, while licensing requires the firm to meet conditions before it operates. By requiring cybersecurity plans for a licence, the Cayman Islands Monetary Authority assesses a firm's security posture up front, rather than simply noting the firm's presence in a register.",[19,5801,5802],{},"Cybersecurity plans are where quantum risk can enter. Virtual asset services depend on cryptography, so a required security plan is a natural place to address cryptographic and quantum concerns. As quantum developments make current algorithms a growing risk, licensees can expect their plans to account for the threat to the cryptography their services rely on.",[19,5804,5805,5807],{},[383,5806,399],{}," Cayman's shift to licensing raises the regulatory bar for virtual asset service providers and makes cybersecurity plans a condition of operating. Because those plans must address the cryptography that underpins virtual asset services, they give quantum risk a place in the licensing process. Firms seeking or holding a Cayman licence can treat quantum readiness as part of the security posture their licence requires.",{"title":8,"searchDepth":84,"depth":84,"links":5809},[5810],{"id":5787,"depth":84,"text":5788},"2025-04-01","The Cayman Islands moved virtual asset service providers from registration to licensing from April 2025, requiring cybersecurity plans for a licence.",[5814,5817,5820],{"q":5815,"a":5816},"What changed for Cayman VASPs in 2025?","From 1 April 2025, the Cayman Islands moved virtual asset service providers from a registration regime to a licensing regime. Licensing is a higher bar than registration, and it requires firms to have cybersecurity plans as a condition of operating.",{"q":5818,"a":5819},"Why does licensing matter more than registration?","Registration records that a firm exists, while licensing requires the firm to meet conditions before it can operate. Requiring cybersecurity plans for a licence means the regulator assesses a firm's security posture up front rather than simply noting its presence.",{"q":5821,"a":5822},"How does this relate to quantum risk?","Virtual asset services depend on cryptography, so a required cybersecurity plan is a natural place to address cryptographic and quantum risk. As quantum concerns grow, licensees can expect their security plans to account for the threat to the cryptography they rely on.",[5824],"george-town",[227,100],{},[5828],{"label":5829,"url":5830},"Cayman Islands Monetary Authority, \"Virtual Asset Service Providers licensing regime,\" effective Apr. 1, 2025.","https:\u002F\u002Fwww.cima.ky\u002F",[5832,5833],{"label":2162,"url":2207},{"label":2217,"url":2218},{"title":5782,"description":5812},"Cayman Moves Virtual Asset Providers to Licensing","cayman-moves-vasps-to-licensing","news\u002Fcayman-moves-vasps-to-licensing",[256,257,134,368,260],"The Cayman Islands moved virtual asset service providers from registration to licensing from April 2025, requiring cybersecurity plans as a condition of a licence.","Qwfgr9tFCHSgTtkAfi8G2Rrd2-kYiwP4wpGGmyhLVMU",{"id":5842,"title":4918,"author":7,"authorTitle":8,"authorUrl":9,"body":5843,"canonical":9,"category":92,"date":5871,"description":5872,"draft":95,"extension":96,"faqs":5873,"findingsSource":9,"geo":5883,"image":417,"industries":5884,"keyFindings":9,"meta":5885,"modified":793,"navigation":103,"path":4919,"pullquote":9,"recommendations":9,"references":5886,"related":5889,"seo":5894,"seoTitle":5895,"signposts":9,"slug":5896,"stats":9,"stem":5897,"tags":5898,"tldr":5872,"__hash__":5899},"news\u002Fnews\u002Fuk-ncsc-2028-2031-2035-deadlines.md",{"type":11,"value":5844,"toc":5868},[5845,5849,5854,5857,5860,5863],[14,5846,5848],{"id":5847},"uk-ncsc-sets-2028-2031-and-2035-migration-deadlines","UK NCSC sets 2028, 2031 and 2035 migration deadlines",[19,5850,5851],{},[383,5852,5853],{},"20 MARCH 2025, LONDON",[19,5855,5856],{},"The UK's National Cyber Security Centre set three post-quantum deadlines on 20 March 2025. Organizations should complete discovery and planning by 2028, begin early migration by 2031, and finish migration by 2035. The staged sequence tells organizations to understand their estate first, migrate the priority systems next, and complete the work within a decade.",[19,5858,5859],{},"Putting discovery first reflects how the NCSC sees the problem. An organization cannot migrate cryptography it has not located, so the 2028 milestone focuses on finding where cryptography is used and building a plan. The heavier migration work in 2031 and 2035 then rests on that picture rather than starting blind.",[19,5861,5862],{},"The NCSC issues guidance rather than binding regulation, so the timeline sets a strong national expectation rather than a universal legal mandate. Regulated sectors may face firmer requirements derived from it, and organizations across the United Kingdom can treat the dates as a planning baseline that aligns with the 2035 horizon used in several other jurisdictions.",[19,5864,5865,5867],{},[383,5866,399],{}," The NCSC timeline gives UK organizations a clear, staged schedule anchored on a 2028 discovery milestone. Because migration depends on knowing where cryptography lives, the 2028 date is the one that most affects whether the later deadlines are achievable. Organizations that start discovery now have the time to plan an orderly migration; those that wait compress all three stages into a shorter window.",{"title":8,"searchDepth":84,"depth":84,"links":5869},[5870],{"id":5847,"depth":84,"text":5848},"2025-03-20","The UK NCSC set three post-quantum deadlines in March 2025: discovery and planning by 2028, early migration by 2031 and complete migration by 2035.",[5874,5877,5880],{"q":5875,"a":5876},"What are the NCSC's three deadlines?","The NCSC set discovery and planning by 2028, early migration by 2031, and complete migration by 2035. The staged dates give organizations a defined sequence: understand your estate first, migrate the priority systems next, and finish within a decade.",{"q":5878,"a":5879},"Are the NCSC deadlines mandatory?","The NCSC issues guidance rather than binding regulation, so the timeline sets a strong national expectation rather than a legal mandate for every organization. Regulated sectors may face firmer requirements derived from it, so organizations should treat the dates as a planning baseline.",{"q":5881,"a":5882},"What should organizations do by 2028?","By 2028 the NCSC expects organizations to complete discovery and build a migration plan. That means finding where cryptography is used across the estate and deciding the order and method of migration, so the heavier work in 2031 and 2035 rests on a clear picture.",[4908],[100,419],{},[5887],{"label":5888,"url":1794},"National Cyber Security Centre (NCSC), \"Timelines for migration to post-quantum cryptography,\" Mar. 20, 2025.",[5890,5893],{"label":5891,"url":5892},"UK NCSC Endorses ML-KEM-768 and ML-DSA-65, Hybrid as Interim Only","\u002Fnews\u002Fuk-ncsc-endorses-ml-kem-768-ml-dsa-65",{"label":432,"url":124},{"title":4918,"description":5872},"UK NCSC Sets 2028, 2031 and 2035 PQC Deadlines","uk-ncsc-2028-2031-2035-deadlines","news\u002Fuk-ncsc-2028-2031-2035-deadlines",[1809,132,2157,133,260],"luIpLwzMbz5V_n9P-tWvIHpcay-F9pDn1grohtj_mBs",{"id":5901,"title":5902,"author":7,"authorTitle":8,"authorUrl":9,"body":5903,"canonical":9,"category":92,"date":5934,"description":5935,"draft":95,"extension":96,"faqs":5936,"findingsSource":9,"geo":5943,"image":417,"industries":5944,"keyFindings":9,"meta":5945,"modified":5946,"navigation":103,"path":5168,"pullquote":9,"recommendations":9,"references":5947,"related":5954,"seo":5960,"seoTitle":5961,"signposts":9,"slug":5962,"stats":9,"stem":5963,"tags":5964,"tldr":5965,"__hash__":5966},"news\u002Fnews\u002Fnist-selects-hqc-backup-post-quantum-encryption.md","NIST Picks HQC as a Backup Post-Quantum Encryption Algorithm",{"type":11,"value":5904,"toc":5931},[5905,5909,5914,5917,5920,5923,5926],[14,5906,5908],{"id":5907},"nist-picks-hqc-as-a-backup-post-quantum-encryption-algorithm","NIST picks HQC as a backup post-quantum encryption algorithm",[19,5910,5911],{},[383,5912,5913],{},"11 MARCH 2025, GAITHERSBURG",[19,5915,5916],{},"NIST announced that it had selected HQC (Hamming Quasi-Cyclic) as a fifth post-quantum algorithm and a backup for general encryption. HQC is a code-based key-encapsulation mechanism, meaning a method for two parties to agree a shared secret key, built on error-correcting codes. ML-KEM (FIPS 203), the main standard, rests on structured lattices instead. NIST's release says reviewers found HQC computationally heavier than ML-KEM but secure and clean in operation.",[19,5918,5919],{},"The reason for the choice is diversification. Dustin Moody, who heads NIST's post-quantum project, said NIST wants a backup standard based on a different mathematical approach than ML-KEM. If someone found a weakness in lattice constructions, organizations would then have an approved alternative with a different security basis.",[19,5921,5922],{},"NIST set out a timeline. It expected to publish a draft standard in about a year, follow that with a 90-day public comment period, and finalize the standard in 2027. NIST also told organizations not to wait: Moody said they should keep migrating to the standards finalized in 2024. HQC is not meant to replace ML-KEM as the recommended general choice.",[19,5924,5925],{},"The choice reaches vendors of key-establishment products, hardware security module makers, protocol designers and standards bodies that plan for algorithm-agility, along with federal agencies that will eventually run HQC alongside ML-KEM. As of 2 October 2026, NIST's standardization page records the 11 March 2025 HQC selection and refers readers to NIST IR 8545 for status. It does not mention a draft standard, a FIPS 207 designation or publication dates.",[19,5927,5928,5930],{},[383,5929,399],{}," Executives should not pause ML-KEM migration to wait for HQC, because NIST said so directly. The backup matters for planning: organizations should expect products to need the ability to swap key-establishment algorithms (crypto agility) without rebuilding systems. Procurement teams should expect HQC to appear in vendor roadmaps once a standard is final, which NIST targets for 2027.",{"title":8,"searchDepth":84,"depth":84,"links":5932},[5933],{"id":5907,"depth":84,"text":5908},"2025-03-11","NIST chose HQC as a fifth post-quantum algorithm and backup to ML-KEM, targeting a final standard in 2027. Organizations should keep migrating to ML-KEM.",[5937,5940],{"q":5938,"a":5939},"Should organizations wait for HQC before migrating?","No. NIST's Dustin Moody said organizations should keep migrating to the standards finalized in 2024. HQC is a backup and is not meant to replace ML-KEM as the recommended general choice.",{"q":5941,"a":5942},"What does HQC mean for procurement and architecture?","Teams should expect products to need crypto agility, the ability to swap key-establishment algorithms without rebuilding systems. HQC may appear in vendor roadmaps once NIST finalizes a standard, which it targets for 2027.",[5157],[100,419],{},"2026-08-27",[5948,5951],{"label":5949,"url":5950},"National Institute of Standards and Technology, \"NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption,\" NIST, Mar. 11, 2025.","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2025\u002F03\u002Fnist-selects-hqc-fifth-algorithm-post-quantum-encryption",{"label":5952,"url":5953},"National Institute of Standards and Technology, \"Post-Quantum Cryptography Standardization,\" NIST CSRC, accessed Oct. 2, 2026.","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fpost-quantum-cryptography\u002Fpost-quantum-cryptography-standardization",[5955,5957],{"label":5956,"url":2674},"NIST Approves Its First Three Post-Quantum Encryption Standards",{"label":5958,"url":5959},"Crypto Agility: What It Is and How to Build It","\u002Fblog\u002Fcrypto-agility",{"title":5902,"description":5935},"NIST Selects HQC as Backup Post-Quantum Encryption","nist-selects-hqc-backup-post-quantum-encryption","news\u002Fnist-selects-hqc-backup-post-quantum-encryption",[438,549,132,260],"NIST chose HQC as a fifth post-quantum algorithm and backup to ML-KEM, targeting a final standard in 2027, but organizations should keep migrating to ML-KEM now.","D7QZHxz_MRSrUbQzad6O9hvuQr5bUZe5TkXT1esbsGw",{"id":5968,"title":5969,"author":7,"authorTitle":8,"authorUrl":9,"body":5970,"canonical":9,"category":92,"date":6001,"description":6002,"draft":95,"extension":96,"faqs":6003,"findingsSource":9,"geo":6010,"image":417,"industries":6011,"keyFindings":9,"meta":6012,"modified":5946,"navigation":103,"path":4666,"pullquote":9,"recommendations":9,"references":6013,"related":6020,"seo":6025,"seoTitle":6026,"signposts":9,"slug":6027,"stats":9,"stem":6028,"tags":6029,"tldr":6030,"__hash__":6031},"news\u002Fnews\u002Fnist-cswp-39-crypto-agility-guidance.md","NIST Publishes Its Updated Guidance on Crypto Agility",{"type":11,"value":5971,"toc":5998},[5972,5976,5981,5984,5987,5990,5993],[14,5973,5975],{"id":5974},"nist-publishes-its-updated-guidance-on-crypto-agility","NIST publishes its updated guidance on crypto agility",[19,5977,5978],{},[383,5979,5980],{},"4 MARCH 2025, GAITHERSBURG",[19,5982,5983],{},"NIST Cybersecurity White Paper 39, \"Considerations for Achieving Cryptographic Agility: Strategies and Practices,\" examines how organizations can replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware and infrastructure while keeping systems running. Practitioners call this ability to swap algorithms crypto agility. NIST released the initial public draft on 4 March 2025, with updates on 5 March, and took comments through 30 April 2025. NIST also said it planned a virtual workshop to help stakeholders develop sector-specific crypto agility strategies. A second public draft followed on 17 July 2025.",[19,5985,5986],{},"NIST published a final version on 19 December 2025. NIST's record for the update, CSWP 39upd1, gives its date as 29 June 2026 and says it supersedes the 19 December 2025 final. The upd1 record is therefore the current publication, not the December final or the second public draft. It lists nine contributors from NIST, Vigil Security, Strativia and Trusted Cyber Annex, including Elaine Barker, Lily Chen, David Cooper and Dustin Moody, and covers cryptographic agility, algorithms, APIs, risk management and transition strategies.",[19,5988,5989],{},"The paper responds to the need to migrate algorithms because of quantum computing and other emerging threats, and it surveys trade-offs, challenges and operational mechanisms. It also fed the maturity-model thinking that practitioners use to assess crypto agility.",[19,5991,5992],{},"The paper speaks to security architects, product teams and standards bodies planning for algorithm change, and to federal agencies facing the 2026 migration deadlines.",[19,5994,5995,5997],{},[383,5996,399],{}," Crypto agility determines how costly the next algorithm change will be, so this paper is a practical reference for architecture and procurement decisions. Executives should expect auditors and boards to ask whether critical systems can change algorithms without replacement. The guidance is a NIST white paper, not a mandate.",{"title":8,"searchDepth":84,"depth":84,"links":5999},[6000],{"id":5974,"depth":84,"text":5975},"2025-03-04","NIST's CSWP 39 explains how to replace cryptographic algorithms without disrupting systems. The 29 June 2026 update supersedes the December 2025 final.",[6004,6007],{"q":6005,"a":6006},"Is the crypto agility paper a mandate?","No. It is a NIST white paper, not a mandate. It surveys trade-offs, challenges and operational mechanisms and serves as a practical reference for architecture and procurement decisions.",{"q":6008,"a":6009},"Which version of CSWP 39 should teams use?","Use CSWP 39upd1, dated 29 June 2026. NIST's record says it supersedes the 19 December 2025 final, so neither that final nor the second public draft is the current publication.",[5157],[100,419],{},[6014,6017],{"label":6015,"url":6016},"National Institute of Standards and Technology, \"Considerations for Achieving Crypto Agility: NIST Releases CSWP 39 for Public Comment,\" NIST CSRC, Mar. 4, 2025.","https:\u002F\u002Fcsrc.nist.gov\u002Fnews\u002F2025\u002Fnist-releases-cswp-39-for-public-comment",{"label":6018,"url":6019},"National Institute of Standards and Technology, \"CSWP 39upd1, Considerations for Achieving Crypto Agility: Strategies and Practices,\" NIST CSRC, Jun. 29, 2026.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fcswp\u002F39\u002Fupd1\u002Fconsiderations-for-achieving-crypto-agility\u002Ffinal",[6021,6022],{"label":5958,"url":5959},{"label":6023,"url":6024},"Crypto Agility Infrastructure Isn't Optional Anymore","\u002Fblog\u002Fcrypto-agility-infrastructure-isnt-optional-anymore",{"title":5969,"description":6002},"NIST CSWP 39 Crypto Agility Guidance Updated 2026","nist-cswp-39-crypto-agility-guidance","news\u002Fnist-cswp-39-crypto-agility-guidance",[549,438,132,134],"NIST's CSWP 39 explains how to replace cryptographic algorithms without disrupting systems, and the 29 June 2026 update supersedes the December 2025 final.","hRabtM4zXsVXTG9CI3wQxXvPUa76jEcmtF4l6P4vfAc",{"id":6033,"title":3985,"author":7,"authorTitle":8,"authorUrl":9,"body":6034,"canonical":9,"category":92,"date":6062,"description":6063,"draft":95,"extension":96,"faqs":6064,"findingsSource":9,"geo":6074,"image":417,"industries":6075,"keyFindings":9,"meta":6076,"modified":6077,"navigation":103,"path":3986,"pullquote":9,"recommendations":9,"references":6078,"related":6081,"seo":6084,"seoTitle":6085,"signposts":9,"slug":6086,"stats":9,"stem":6087,"tags":6088,"tldr":6089,"__hash__":6090},"news\u002Fnews\u002Feuropol-qsff-post-quantum-call-to-action.md",{"type":11,"value":6035,"toc":6059},[6036,6040,6045,6048,6051,6054],[14,6037,6039],{"id":6038},"europols-quantum-safe-financial-forum-issues-a-call-to-action","Europol's Quantum Safe Financial Forum issues a call to action",[19,6041,6042],{},[383,6043,6044],{},"7 FEBRUARY 2025, THE HAGUE",[19,6046,6047],{},"Europol's Quantum Safe Financial Forum issued a call to action for the financial sector on 7 February 2025. The forum argues that existing EU rules, such as DORA and GDPR, already suffice to require action, and it urges firms to adopt hybrid schemes, build cryptographic inventories and invest in crypto agility.",[19,6049,6050],{},"The claim that existing rules suffice carries a clear message. DORA and GDPR already require firms to protect data and manage technology risk, which the forum reads as covering the quantum threat. That framing tells firms they need not wait for a new quantum-specific regulation to justify acting, since the legal obligation to protect data already exists.",[19,6052,6053],{},"The practical steps mirror the broad consensus. The forum urges hybrid schemes during the transition, cryptographic inventories to find where cryptography is used, and crypto agility so systems can swap algorithms later. Framing these familiar steps for the financial sector gives firms a sector-specific prompt grounded in rules they already follow.",[19,6055,6056,6058],{},[383,6057,399],{}," The QSFF call removes a common excuse for delay by arguing that existing EU rules already require firms to address quantum risk. Its practical recommendations, hybrids, inventory and crypto agility, match what other authorities advise. Financial firms in Europe can treat the call as confirmation that DORA and GDPR give them both the reason and the basis to start their post-quantum work now.",{"title":8,"searchDepth":84,"depth":84,"links":6060},[6061],{"id":6038,"depth":84,"text":6039},"2025-02-07","Europol's Quantum Safe Financial Forum issued a February 2025 call to action, saying existing EU rules suffice and urging hybrids, inventories and crypto agility.",[6065,6068,6071],{"q":6066,"a":6067},"What is the Europol QSFF call to action?","On 7 February 2025, Europol's Quantum Safe Financial Forum issued a call to action for the financial sector. It argues that existing EU rules such as DORA and GDPR suffice, and urges firms to adopt hybrid schemes, build cryptographic inventories and invest in crypto agility.",{"q":6069,"a":6070},"Why say existing rules suffice?","The forum's view is that rules like DORA and GDPR already require firms to protect data and manage technology risk, which covers quantum. That framing tells firms they need not wait for a new quantum-specific regulation to justify acting, because the obligation already exists.",{"q":6072,"a":6073},"What practical steps does it urge?","It urges hybrid schemes during the transition, cryptographic inventories to find where cryptography is used, and crypto agility so systems can swap algorithms. These are the same foundational steps other authorities recommend, framed here for the financial sector.",[3975],[227,100],{},"2026-08-31",[6079],{"label":6080,"url":3982},"Europol, \"Quantum Safe Financial Forum: a call to action,\" Feb. 7, 2025.",[6082,6083],{"label":1863,"url":1864},{"label":3989,"url":3978},{"title":3985,"description":6063},"Europol QSFF Issues a Post-Quantum Call to Action","europol-qsff-post-quantum-call-to-action","news\u002Feuropol-qsff-post-quantum-call-to-action",[257,549,133,368,260],"Europol's Quantum Safe Financial Forum issued a call to action in February 2025, saying existing EU rules suffice and urging hybrid schemes, inventories and crypto agility.","bse85xuPN0JvOOzwf1WnzefqRgo4eX9x0gl3PlalUTY",{"id":6092,"title":6093,"author":7,"authorTitle":8,"authorUrl":9,"body":6094,"canonical":9,"category":92,"date":6122,"description":6123,"draft":95,"extension":96,"faqs":6124,"findingsSource":9,"geo":6134,"image":417,"industries":6136,"keyFindings":9,"meta":6137,"modified":5946,"navigation":103,"path":6138,"pullquote":9,"recommendations":9,"references":6139,"related":6143,"seo":6146,"seoTitle":6147,"signposts":9,"slug":6148,"stats":9,"stem":6149,"tags":6150,"tldr":6123,"__hash__":6151},"news\u002Fnews\u002Fchina-opens-call-for-next-gen-algorithms-ngcc.md","China Opens a Call for Its Own Next-Generation Cryptographic Algorithms",{"type":11,"value":6095,"toc":6119},[6096,6100,6105,6108,6111,6114],[14,6097,6099],{"id":6098},"china-opens-a-call-for-its-own-next-generation-cryptographic-algorithms","China opens a call for its own next-generation cryptographic algorithms",[19,6101,6102],{},[383,6103,6104],{},"5 FEBRUARY 2025, BEIJING",[19,6106,6107],{},"China opened a call for next-generation commercial cryptographic algorithms, known as NGCC, on 5 February 2025. The call solicits new algorithm proposals and sets a deadline of 30 June 2026 for public-key submissions. Through it, China is developing its own next-generation cryptography rather than relying solely on standards set abroad.",[19,6109,6110],{},"The process resembles the NIST competition in structure, soliciting and then evaluating algorithm proposals, but it is a national Chinese effort aimed at Chinese commercial use. Nations increasingly run their own evaluations so they can control the cryptography their critical systems depend on, and the NGCC call fits that pattern.",[19,6112,6113],{},"The move reflects a broader push for cryptographic sovereignty. By running a national call, China gains algorithms it controls and evaluates, which parallels steps by other countries, such as South Korea's selection of home-grown post-quantum algorithms. The trend points to a future with multiple national cryptographic ecosystems alongside the international standards.",[19,6115,6116,6118],{},[383,6117,399],{}," China's NGCC call signals that major powers intend to develop and control their own post-quantum cryptography, adding to a world of multiple national algorithm sets. For organizations that operate across borders, that fragmentation raises the value of crypto agility: systems able to support different algorithm families can meet varied national requirements. The 30 June 2026 proposal deadline marks the next milestone to watch.",{"title":8,"searchDepth":84,"depth":84,"links":6120},[6121],{"id":6098,"depth":84,"text":6099},"2025-02-05","China opened a call for next-generation commercial cryptographic algorithms in February 2025, with a 30 June 2026 deadline for public-key proposals.",[6125,6128,6131],{"q":6126,"a":6127},"What is China's NGCC call?","China opened a call for next-generation commercial cryptographic algorithms, known as NGCC, on 5 February 2025. The call solicits new algorithm proposals, with a deadline of 30 June 2026 for public-key submissions, as China develops its own next-generation cryptography.",{"q":6129,"a":6130},"Is this China's version of the NIST process?","It resembles the NIST competition in structure, soliciting and evaluating algorithm proposals, but it is a national Chinese process producing algorithms for Chinese commercial use. Nations increasingly run their own evaluations to control the cryptography their systems depend on.",{"q":6132,"a":6133},"Why does China run its own call?","Running a national call supports cryptographic sovereignty, giving China algorithms it controls and evaluates rather than relying on standards set elsewhere. It mirrors moves by other nations, such as South Korea, to develop home-grown post-quantum cryptography.",[6135],"beijing",[419,228],{},"\u002Fnews\u002Fchina-opens-call-for-next-gen-algorithms-ngcc",[6140],{"label":6141,"url":6142},"Office of the State Commercial Cryptography Administration, \"Call for next-generation commercial cryptographic algorithms (NGCC),\" Feb. 5, 2025.","https:\u002F\u002Fwww.oscca.gov.cn\u002F",[6144,6145],{"label":3147,"url":3148},{"label":2673,"url":2674},{"title":6093,"description":6123},"China Opens a Call for Next-Gen Algorithms (NGCC)","china-opens-call-for-next-gen-algorithms-ngcc","news\u002Fchina-opens-call-for-next-gen-algorithms-ngcc",[438,368,2862,258,439],"xvT46NVNZmjbIYwAs-_hMB8oSS00FxP0D5zuRuw5TS0",{"id":6153,"title":6154,"author":7,"authorTitle":8,"authorUrl":9,"body":6155,"canonical":9,"category":92,"date":6183,"description":6184,"draft":95,"extension":96,"faqs":6185,"findingsSource":9,"geo":6195,"image":417,"industries":6197,"keyFindings":9,"meta":6198,"modified":6077,"navigation":103,"path":6199,"pullquote":9,"recommendations":9,"references":6200,"related":6204,"seo":6207,"seoTitle":6208,"signposts":9,"slug":6209,"stats":9,"stem":6210,"tags":6211,"tldr":6212,"__hash__":6213},"news\u002Fnews\u002Fczech-nukib-algorithm-baseline.md","Czech NUKIB Sets a Post-Quantum Algorithm Baseline Without Deadlines",{"type":11,"value":6156,"toc":6180},[6157,6161,6166,6169,6172,6175],[14,6158,6160],{"id":6159},"czech-nukib-sets-a-post-quantum-algorithm-baseline","Czech NUKIB sets a post-quantum algorithm baseline",[19,6162,6163],{},[383,6164,6165],{},"1 FEBRUARY 2025, BRNO",[19,6167,6168],{},"The Czech National Cyber and Information Security Agency, NUKIB, set a post-quantum algorithm baseline in version 4.0 of its minimum requirements, dated 1 February 2025. The baseline names ML-KEM-1024 for key establishment, ML-DSA-87 and SLH-DSA for signatures, and endorses hybrid schemes. It points Czech organizations to the strongest parameter sets of the NIST standards.",[19,6170,6171],{},"The baseline answers what to adopt rather than when. It sets no migration deadline, so organizations get a clear technical target while the timing stays open. That approach suits an agency that wants to steer algorithm choices early without committing the country to a dated migration schedule it may later need to revise.",[19,6173,6174],{},"Choosing ML-KEM-1024 and ML-DSA-87 signals a conservative stance. These are the highest-security parameter sets of their standards, so selecting them favours a larger security margin over performance. That trade-off fits government systems, which often must protect data for long periods and can accept the extra cost of the strongest options.",[19,6176,6177,6179],{},[383,6178,399],{}," NUKIB gives Czech organizations a precise algorithm target without a deadline, which clarifies the technical destination while leaving the schedule flexible. The choice of the strongest parameter sets tells organizations the agency prioritises a wide security margin. Teams can specify these algorithms in new systems now, aligning with both NUKIB and the broader European direction toward the NIST standards and hybrids.",{"title":8,"searchDepth":84,"depth":84,"links":6181},[6182],{"id":6159,"depth":84,"text":6160},"2025-02-01","The Czech NUKIB set a post-quantum algorithm baseline in February 2025, naming ML-KEM-1024, ML-DSA-87, SLH-DSA and hybrids, without setting deadlines.",[6186,6189,6192],{"q":6187,"a":6188},"Which algorithms does NUKIB name?","In version 4.0 of its baseline, dated 1 February 2025, NUKIB names ML-KEM-1024 for key establishment, ML-DSA-87 and SLH-DSA for signatures, and endorses hybrid schemes. It points to the strongest parameter sets of the NIST standards.",{"q":6190,"a":6191},"Does NUKIB set a migration deadline?","No. The baseline sets which algorithms to use without attaching deadlines for migration. It answers the question of what to adopt rather than when, so Czech organizations get a clear technical target even as the timing is left open.",{"q":6193,"a":6194},"Why choose the strongest parameter sets?","ML-KEM-1024 and ML-DSA-87 are the highest-security parameter sets of their standards. Choosing them reflects a conservative stance that favours a larger security margin, which suits government systems that must protect data for long periods.",[6196],"brno",[419,100],{},"\u002Fnews\u002Fczech-nukib-algorithm-baseline",[6201],{"label":6202,"url":6203},"National Cyber and Information Security Agency (NUKIB), \"Minimum requirements for cryptographic algorithms,\" version 4.0, Feb. 1, 2025.","https:\u002F\u002Fnukib.gov.cz\u002Fen\u002F",[6205,6206],{"label":3921,"url":3922},{"label":2673,"url":2674},{"title":6154,"description":6184},"Czech NUKIB Sets a Post-Quantum Algorithm Baseline","czech-nukib-algorithm-baseline","news\u002Fczech-nukib-algorithm-baseline",[438,549,368,1431,439],"The Czech cybersecurity agency NUKIB set a post-quantum algorithm baseline in February 2025, naming ML-KEM-1024, ML-DSA-87, SLH-DSA and hybrid schemes, with no deadlines.","esbeIsoINWdymk7jhfE9IU8r31XTrl0j6jisseDcMgg",{"id":6215,"title":6216,"author":7,"authorTitle":8,"authorUrl":9,"body":6217,"canonical":9,"category":92,"date":6245,"description":6246,"draft":95,"extension":96,"faqs":6247,"findingsSource":9,"geo":6257,"image":417,"industries":6258,"keyFindings":9,"meta":6259,"modified":1249,"navigation":103,"path":1864,"pullquote":9,"recommendations":9,"references":6260,"related":6264,"seo":6269,"seoTitle":6270,"signposts":9,"slug":6271,"stats":9,"stem":6272,"tags":6273,"tldr":6274,"__hash__":6275},"news\u002Fnews\u002Feu-dora-financial-ict-risk-quantum.md","EU DORA Governs Financial Firms' Technology Risk and Pulls Cryptography Into Scope",{"type":11,"value":6218,"toc":6242},[6219,6223,6228,6231,6234,6237],[14,6220,6222],{"id":6221},"eu-dora-governs-financial-firms-technology-risk","EU DORA governs financial firms' technology risk",[19,6224,6225],{},[383,6226,6227],{},"17 JANUARY 2025, BRUSSELS",[19,6229,6230],{},"The EU Digital Operational Resilience Act, known as DORA, entered into force on 16 January 2023 and has applied to financial firms since 17 January 2025. It builds on four pillars, one of which is ICT risk management. DORA sets no post-quantum deadline of its own, so it does not name a date by which firms must adopt quantum-resistant cryptography.",[19,6232,6233],{},"Cryptography still enters the regulation. Article 9 and the delegated technical standards that sit beneath DORA cover encryption and key management, and a recital references quantum. That structure lets supervisors treat cryptographic resilience as part of a firm's ICT risk management, using DORA as the legal anchor rather than pointing to a standalone quantum rule.",[19,6235,6236],{},"Because DORA frames the obligation through risk management rather than a fixed deadline, firms carry the responsibility to assess their own cryptographic exposure and act on it. A supervisor can ask a firm how it manages the risk that today's cryptography becomes vulnerable, and expect a credible answer grounded in the technical standards.",[19,6238,6239,6241],{},[383,6240,399],{}," DORA gives European supervisors a standing legal hook for cryptographic resilience without waiting for a dedicated quantum regulation. Financial firms that treat post-quantum readiness as part of their ICT risk management, with an inventory and a migration plan, are better placed to answer supervisory questions. The absence of a hard deadline is not an absence of expectation.",{"title":8,"searchDepth":84,"depth":84,"links":6243},[6244],{"id":6221,"depth":84,"text":6222},"2025-01-17","The EU Digital Operational Resilience Act applies to financial firms since January 2025; cryptography enters via Article 9 and delegated technical standards.",[6248,6251,6254],{"q":6249,"a":6250},"Does DORA set a post-quantum deadline?","No. DORA sets no post-quantum deadline of its own. Cryptography enters its scope through Article 9 and the delegated technical standards, and a recital references quantum, so supervisors use DORA as the legal anchor for cryptographic expectations rather than a dated mandate.",{"q":6252,"a":6253},"When did DORA start to apply?","DORA entered into force on 16 January 2023 and has applied to financial firms since 17 January 2025. Its four pillars include ICT risk management, which is where cryptographic requirements sit for in-scope firms across the European Union.",{"q":6255,"a":6256},"Who does DORA cover?","DORA covers a broad range of financial entities in the European Union, from banks and insurers to investment firms and certain ICT providers that serve them. The regulation makes technology risk, including cryptography, a supervised matter for those entities.",[416],[227,100],{},[6261],{"label":6262,"url":6263},"European Union, \"Regulation (EU) 2022\u002F2554 on digital operational resilience for the financial sector (DORA),\" Official Journal of the European Union, Dec. 27, 2022.","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj",[6265,6268],{"label":6266,"url":6267},"EU Technical Standard 2024\u002F1774 Requires Crypto Updates as Attacks Advance","\u002Fnews\u002Feu-technical-standard-2024-1774-crypto-updates",{"label":1331,"url":1332},{"title":6216,"description":6246},"EU DORA Governs Financial Firms' Tech Risk","eu-dora-financial-ict-risk-quantum","news\u002Feu-dora-financial-ict-risk-quantum",[663,257,134,549,260],"The EU Digital Operational Resilience Act has applied to financial firms since January 2025, and cryptography enters its scope through Article 9 and delegated technical standards.","70Pmord3zNJdkX_4OIUsHci0mxDWF-HAb8WGJDU3Byg",{"id":6277,"title":3147,"author":7,"authorTitle":8,"authorUrl":9,"body":6278,"canonical":9,"category":92,"date":6306,"description":6307,"draft":95,"extension":96,"faqs":6308,"findingsSource":9,"geo":6318,"image":417,"industries":6319,"keyFindings":9,"meta":6320,"modified":890,"navigation":103,"path":3148,"pullquote":9,"recommendations":9,"references":6321,"related":6325,"seo":6328,"seoTitle":6329,"signposts":9,"slug":6330,"stats":9,"stem":6331,"tags":6332,"tldr":6333,"__hash__":6334},"news\u002Fnews\u002Fsouth-korea-picks-four-home-grown-pqc-algorithms.md",{"type":11,"value":6279,"toc":6303},[6280,6284,6289,6292,6295,6298],[14,6281,6283],{"id":6282},"south-korea-picks-four-home-grown-post-quantum-algorithms","South Korea picks four home-grown post-quantum algorithms",[19,6285,6286],{},[383,6287,6288],{},"16 JANUARY 2025, SEOUL",[19,6290,6291],{},"South Korea selected four home-grown post-quantum algorithms on 16 January 2025. AIMer and HAETAE cover digital signatures, while NTRU+ and SMAUG-T cover key establishment and public-key encryption. The choices give the country its own post-quantum options to sit alongside the international standards.",[19,6293,6294],{},"Developing national algorithms serves a strategic goal. It supports technological self-reliance and gives South Korea cryptography it controls and understands in depth, rather than depending entirely on schemes designed elsewhere. The move also diversifies the global pool of post-quantum designs, which reduces the risk that the world over-relies on any single scheme or mathematical family.",[19,6296,6297],{},"The selection gives South Korea national options rather than necessarily replacing the NIST standards. Korean organizations that operate internationally will often still need the NIST algorithms for interoperability with partners abroad. That reality keeps crypto agility valuable: systems that support more than one algorithm can satisfy both national preferences and international interoperability.",[19,6299,6300,6302],{},[383,6301,399],{}," South Korea's choice of four home-grown algorithms signals a strategic investment in cryptographic self-reliance and adds to global diversity in post-quantum designs. For Korean organizations, the practical takeaway is to build systems flexible enough to run both national and international algorithms. That flexibility lets them align with domestic policy while keeping the interoperability their global operations require.",{"title":8,"searchDepth":84,"depth":84,"links":6304},[6305],{"id":6282,"depth":84,"text":6283},"2025-01-16","South Korea selected four home-grown post-quantum algorithms in January 2025: AIMer and HAETAE for signatures, NTRU+ and SMAUG-T for key establishment.",[6309,6312,6315],{"q":6310,"a":6311},"Which algorithms did South Korea pick?","On 16 January 2025, South Korea selected four home-grown algorithms: AIMer and HAETAE for digital signatures, and NTRU+ and SMAUG-T for key establishment and public-key encryption. The choices give the country its own post-quantum options alongside the international standards.",{"q":6313,"a":6314},"Why develop home-grown algorithms?","Developing national algorithms supports technological self-reliance and gives a country cryptography it controls and understands deeply. It also diversifies the global pool of post-quantum schemes, which reduces the risk of over-reliance on any single design or mathematical family.",{"q":6316,"a":6317},"Do these replace the NIST standards in Korea?","The selection gives South Korea national options rather than necessarily replacing the NIST standards. Organizations operating internationally will often still need the NIST algorithms for interoperability, so crypto agility that supports more than one scheme remains valuable.",[3137],[419,228],{},[6322],{"label":6323,"url":6324},"Korea Internet & Security Agency (KISA), \"Selection of national post-quantum cryptographic algorithms,\" Jan. 16, 2025.","https:\u002F\u002Fwww.kisa.or.kr\u002FEN",[6326,6327],{"label":3150,"url":3151},{"label":3095,"url":3140},{"title":3147,"description":6307},"South Korea Picks Four Home-Grown PQC Algorithms","south-korea-picks-four-home-grown-pqc-algorithms","news\u002Fsouth-korea-picks-four-home-grown-pqc-algorithms",[438,368,549,2862,439],"South Korea selected four home-grown post-quantum algorithms in January 2025: AIMer and HAETAE for signatures, and NTRU+ and SMAUG-T for key establishment.","ZBjY7LDoWk7h4LJ16V3YQACXqPnKR25YhP9CMkxNz0Q",{"id":6336,"title":6337,"author":7,"authorTitle":8,"authorUrl":9,"body":6338,"canonical":9,"category":92,"date":6366,"description":6367,"draft":95,"extension":96,"faqs":6368,"findingsSource":9,"geo":6378,"image":417,"industries":6380,"keyFindings":9,"meta":6381,"modified":6382,"navigation":103,"path":1929,"pullquote":9,"recommendations":9,"references":6383,"related":6387,"seo":6392,"seoTitle":6393,"signposts":9,"slug":6394,"stats":9,"stem":6395,"tags":6396,"tldr":6397,"__hash__":6398},"news\u002Fnews\u002Fbank-of-israel-orders-quantum-preparedness-plans.md","Bank of Israel Orders Banks to Submit Quantum Preparedness Plans Within One Year",{"type":11,"value":6339,"toc":6363},[6340,6344,6349,6352,6355,6358],[14,6341,6343],{"id":6342},"bank-of-israel-orders-banks-to-submit-quantum-preparedness-plans","Bank of Israel orders banks to submit quantum preparedness plans",[19,6345,6346],{},[383,6347,6348],{},"7 JANUARY 2025, TEL AVIV",[19,6350,6351],{},"The Bank of Israel's Banking Supervision Department ordered banks to submit quantum preparedness plans within one year, in Letter 202501 dated 7 January 2025. That timing made initial plans due by 7 January 2026. The letter ties to Directive 364 and places the harvest-now-decrypt-later threat at the centre of its reasoning.",[19,6353,6354],{},"Harvest-now-decrypt-later drives the urgency. An adversary can record encrypted data today and decrypt it once a quantum computer can break the encryption, so a bank's long-lived sensitive data is already exposed even before such a computer exists. By centring that threat, the letter frames preparedness as a present obligation rather than a future one.",[19,6356,6357],{},"The legal basis comes from Directive 364. Issued in November 2024, the directive consolidates earlier directives and provides the supervisory foundation on which the Bank of Israel builds the quantum requirement. The directive does not mention quantum itself, so the letter supplies the quantum-specific expectation while the directive supplies the authority behind it.",[19,6359,6360,6362],{},[383,6361,399],{}," The Bank of Israel moved early and concretely, ordering banks to produce quantum preparedness plans on a one-year clock rather than issuing open-ended guidance. Its focus on harvest-now-decrypt-later tells banks the risk to long-lived data is current. Banks subject to the letter needed a credible plan by January 2026, and the inventory and prioritisation behind such a plan remain the practical starting point.",{"title":8,"searchDepth":84,"depth":84,"links":6364},[6365],{"id":6342,"depth":84,"text":6343},"2025-01-07","The Bank of Israel ordered banks in January 2025 to submit quantum preparedness plans within one year, centring the harvest-now-decrypt-later threat.",[6369,6372,6375],{"q":6370,"a":6371},"What did the Bank of Israel order?","In Letter 202501, dated 7 January 2025, the Bank of Israel ordered banks to submit quantum preparedness plans within one year, so initial plans were due by 7 January 2026. The letter ties to Directive 364 and centres the harvest-now-decrypt-later threat.",{"q":6373,"a":6374},"What is harvest-now-decrypt-later?","Harvest-now-decrypt-later is the threat where an adversary records encrypted data today and decrypts it once a quantum computer can break the encryption. For banks, it means long-lived sensitive data is already at risk, which is why the letter treats preparedness as urgent.",{"q":6376,"a":6377},"What is Directive 364's role?","Directive 364 is the legal hook for the quantum letter. Issued in November 2024, it consolidates earlier directives and, while it does not mention quantum itself, it provides the supervisory basis on which the Bank of Israel builds the quantum preparedness requirement.",[6379],"tel-aviv",[227,100],{},"2026-08-25",[6384],{"label":6385,"url":6386},"Bank of Israel, Banking Supervision Department, \"Quantum preparedness,\" Letter 202501, Jan. 7, 2025.","https:\u002F\u002Fwww.boi.org.il\u002Fen\u002F",[6388,6391],{"label":6389,"url":6390},"Israel's Directive 364 Underpins the Bank of Israel Quantum Letter","\u002Fnews\u002Fisrael-directive-364-underpins-quantum-letter",{"label":1711,"url":1712},{"title":6337,"description":6367},"Bank of Israel Orders Quantum Preparedness Plans","bank-of-israel-orders-quantum-preparedness-plans","news\u002Fbank-of-israel-orders-quantum-preparedness-plans",[257,259,368,134,260],"The Bank of Israel ordered banks in January 2025 to submit quantum preparedness plans within one year, with the harvest-now-decrypt-later threat at the centre.","XrWjocNvvLCJCbnIKNqN8wt_BTx56SNfS3e-8Wi7YRY",{"id":6400,"title":6401,"author":7,"authorTitle":8,"authorUrl":9,"body":6402,"canonical":9,"category":92,"date":6430,"description":6431,"draft":95,"extension":96,"faqs":6432,"findingsSource":9,"geo":6442,"image":417,"industries":6443,"keyFindings":9,"meta":6444,"modified":6445,"navigation":103,"path":6446,"pullquote":9,"recommendations":9,"references":6447,"related":6451,"seo":6454,"seoTitle":6455,"signposts":9,"slug":6456,"stats":9,"stem":6457,"tags":6458,"tldr":6459,"__hash__":6460},"news\u002Fnews\u002Ffs-isac-common-end-date-call.md","FS-ISAC Calls for a Common Post-Quantum Migration End Date for Finance",{"type":11,"value":6403,"toc":6427},[6404,6408,6413,6416,6419,6422],[14,6405,6407],{"id":6406},"fs-isac-calls-for-a-common-post-quantum-migration-end-date-for-finance","FS-ISAC calls for a common post-quantum migration end date for finance",[19,6409,6410],{},[383,6411,6412],{},"1 JANUARY 2025, WASHINGTON",[19,6414,6415],{},"FS-ISAC, the financial sector's information-sharing body, has called for the industry to adopt a common end date for post-quantum migration. The proposal asks interconnected financial firms to aim for a shared deadline, so the sector moves together rather than at widely different paces. It reframes migration as a collective problem for the industry, not just a task for each firm.",[19,6417,6418],{},"The logic rests on how finance connects. Financial firms interconnect heavily, so the security of a transaction can depend on both parties involved. If firms migrate on very different timelines, the laggards weaken the system that the leaders have secured. A common end date coordinates the sector so that protection advances across firms together rather than unevenly.",[19,6420,6421],{},"The call is a coordinating proposal, not a rule. As an industry body, FS-ISAC cannot mandate a deadline, so its influence depends on firms and regulators embracing the shared-timeline idea. Some supervisors echo the thinking in their own guidance, which gives the proposal reach beyond FS-ISAC's membership even without binding force.",[19,6423,6424,6426],{},[383,6425,399],{}," FS-ISAC's common end date proposal addresses a real feature of finance: interconnection means a firm's security depends partly on its counterparties. A shared deadline reduces the risk that slow movers undermine the sector's protection. Financial firms can factor the idea into their planning by aligning their own target dates with the sector's direction, rather than migrating in isolation.",{"title":8,"searchDepth":84,"depth":84,"links":6428},[6429],{"id":6406,"depth":84,"text":6407},"2025-01-01","FS-ISAC has called for the financial sector to adopt a common end date for post-quantum migration, so interconnected firms move on a shared timeline.",[6433,6436,6439],{"q":6434,"a":6435},"What is FS-ISAC's common end date call?","FS-ISAC has called for the financial sector to adopt a common end date for post-quantum migration. The idea is that interconnected financial firms should aim for a shared deadline, so the sector moves together rather than at widely different paces.",{"q":6437,"a":6438},"Why propose a shared deadline?","Financial firms interconnect heavily, so the security of a transaction can depend on both parties. If firms migrate on very different timelines, laggards weaken the whole system. A common end date coordinates the sector so protection advances together.",{"q":6440,"a":6441},"Is the common end date binding?","No. FS-ISAC is an industry information-sharing body, so its call is a coordinating proposal rather than a regulation. Its influence depends on firms and regulators embracing the shared-timeline idea, which some supervisors echo in their own guidance.",[342],[227,100],{},"2026-08-26","\u002Fnews\u002Ffs-isac-common-end-date-call",[6448],{"label":6449,"url":6450},"Financial Services Information Sharing and Analysis Center (FS-ISAC), \"Post-quantum cryptography: a common migration end date for the financial sector,\" 2025.","https:\u002F\u002Fwww.fsisac.com\u002F",[6452,6453],{"label":1331,"url":1332},{"label":4412,"url":4413},{"title":6401,"description":6431},"FS-ISAC Calls for a Common Post-Quantum End Date","fs-isac-common-end-date-call","news\u002Ffs-isac-common-end-date-call",[257,132,368,2862,260],"FS-ISAC has called for the financial sector to adopt a common end date for post-quantum migration, so interconnected firms move on a shared, coordinated timeline.","TkHQexplIxwonISPs1MEU8nzuPXjoiZ32G-DzY3FS7g",{"id":6462,"title":6463,"author":7,"authorTitle":8,"authorUrl":9,"body":6464,"canonical":9,"category":92,"date":6430,"description":6492,"draft":95,"extension":96,"faqs":6493,"findingsSource":9,"geo":6503,"image":417,"industries":6505,"keyFindings":9,"meta":6506,"modified":6507,"navigation":103,"path":6508,"pullquote":9,"recommendations":9,"references":6509,"related":6513,"seo":6518,"seoTitle":6519,"signposts":9,"slug":6520,"stats":9,"stem":6521,"tags":6522,"tldr":6523,"__hash__":6524},"news\u002Fnews\u002Fiso-iec-sc27-standing-document-pqc.md","ISO\u002FIEC JTC1 SC27 Maintains a Standing Document on Post-Quantum Cryptography",{"type":11,"value":6465,"toc":6489},[6466,6470,6475,6478,6481,6484],[14,6467,6469],{"id":6468},"isoiec-jtc1-sc27-maintains-a-standing-document-on-post-quantum-cryptography","ISO\u002FIEC JTC1 SC27 maintains a standing document on post-quantum cryptography",[19,6471,6472],{},[383,6473,6474],{},"1 JANUARY 2025, GENEVA",[19,6476,6477],{},"ISO\u002FIEC JTC1 SC27, the subcommittee responsible for information security standards, maintains a standing document on post-quantum cryptography. The document serves as a working reference for the subcommittee's members rather than a published international standard. It informs the subcommittee's ongoing work instead of imposing requirements on organizations.",[19,6479,6480],{},"A working reference plays a coordinating role. It captures the subcommittee's current understanding of post-quantum cryptography and keeps its members aligned as formal standards develop. For outside observers, watching the standing document offers early insight into the direction ISO\u002FIEC standards may take before those standards reach final form.",[19,6482,6483],{},"The distinction from a published standard is important. Organizations certify against the published ISO\u002FIEC standards, not against an internal working reference, so the standing document carries no compliance obligation. Its value is as a signal of where international standardization on post-quantum cryptography is heading, which helps organizations anticipate future standards.",[19,6485,6486,6488],{},[383,6487,399],{}," The SC27 standing document is a window into how international information-security standards will treat post-quantum cryptography, maintained by the body that writes them. It binds no one, but it signals direction. Organizations that track ISO\u002FIEC standards can watch the standing document to anticipate the post-quantum requirements that future published standards are likely to carry.",{"title":8,"searchDepth":84,"depth":84,"links":6490},[6491],{"id":6468,"depth":84,"text":6469},"ISO\u002FIEC JTC1 SC27 maintains a standing document on post-quantum cryptography as a working reference for its members, rather than a published standard.",[6494,6497,6500],{"q":6495,"a":6496},"What is the SC27 standing document?","ISO\u002FIEC JTC1 SC27, the subcommittee responsible for information security standards, maintains a standing document on post-quantum cryptography. It is a working reference for the subcommittee's members, not a published international standard, so it informs ongoing standards work rather than imposing requirements.",{"q":6498,"a":6499},"Why does a working reference matter?","A standing document captures the subcommittee's current understanding and coordinates its members as formal standards develop. Watching it offers insight into the direction ISO\u002FIEC standards on post-quantum cryptography may take before those standards are finalised.",{"q":6501,"a":6502},"Is the standing document a standard?","No. It is a working reference internal to the subcommittee, distinct from the published ISO\u002FIEC standards that organizations certify against. Organizations should not treat it as a requirement, but as a signal of where international standardization is heading.",[6504],"geneva",[228,100],{},"2026-08-28","\u002Fnews\u002Fiso-iec-sc27-standing-document-pqc",[6510],{"label":6511,"url":6512},"ISO\u002FIEC JTC1 SC27, \"Standing document on post-quantum cryptography,\" working reference.","https:\u002F\u002Fwww.iso.org\u002Fcommittee\u002F45306.html",[6514,6515],{"label":3161,"url":3207},{"label":6516,"url":6517},"ITU-T Continues Studying Quantum-Resistant Support","\u002Fnews\u002Fitu-t-studying-quantum-resistant-support",{"title":6463,"description":6492},"ISO\u002FIEC SC27 Keeps a Standing Document on PQC","iso-iec-sc27-standing-document-pqc","news\u002Fiso-iec-sc27-standing-document-pqc",[438,368,2862,549,260],"ISO\u002FIEC JTC1 SC27 maintains a standing document on post-quantum cryptography that serves as a working reference for its members rather than a published standard.","X3yR8Cu6hb1yyqzRqy22PWMp7cnl9lo_od6WCaB2pw8",{"id":6526,"title":6527,"author":7,"authorTitle":8,"authorUrl":9,"body":6528,"canonical":9,"category":92,"date":6430,"description":6555,"draft":95,"extension":96,"faqs":6556,"findingsSource":9,"geo":6566,"image":417,"industries":6567,"keyFindings":9,"meta":6568,"modified":6507,"navigation":103,"path":6517,"pullquote":9,"recommendations":9,"references":6569,"related":6573,"seo":6576,"seoTitle":6516,"signposts":9,"slug":6577,"stats":9,"stem":6578,"tags":6579,"tldr":6580,"__hash__":6581},"news\u002Fnews\u002Fitu-t-studying-quantum-resistant-support.md","ITU-T Continues Studying Quantum-Resistant Support for Networks and Certificates",{"type":11,"value":6529,"toc":6552},[6530,6534,6538,6541,6544,6547],[14,6531,6533],{"id":6532},"itu-t-continues-studying-quantum-resistant-support","ITU-T continues studying quantum-resistant support",[19,6535,6536],{},[383,6537,6474],{},[19,6539,6540],{},"The ITU-T, the standardization arm of the International Telecommunication Union, continues studying quantum-resistant support. It published recommendation X.1811 in 2021, scoped specifically to 5G, and its Study Group 17 under Question 11 is examining changes to X.509 certificates. The work remains in study across much of its scope rather than settled into broad recommendations.",[19,6542,6543],{},"The X.509 work is the piece with the widest reach. X.509 is the standard format for the digital certificates that underpin secure connections and identity across the internet, so adapting it for post-quantum algorithms is necessary for quantum-resistant certificates to work at scale. That is why a dedicated study group examines the changes the format needs.",[19,6545,6546],{},"X.1811's narrower scope shows the ITU-T addressing specific domains first. By covering 5G in 2021 while the broader certificate work continues, the ITU-T delivered targeted guidance where it could, leaving the larger X.509 question to ongoing study. Organizations should treat the ITU-T's quantum-resistant guidance as developing rather than complete.",[19,6548,6549,6551],{},[383,6550,399],{}," The ITU-T's work matters most for the certificate ecosystem, where X.509 changes will shape how quantum-resistant certificates function across networks. With X.1811 covering 5G and the X.509 work still under study, the guidance is evolving. Organizations that rely on telecom standards or digital certificates should track Study Group 17, since its recommendations will influence how vendors build and deploy post-quantum certificates.",{"title":8,"searchDepth":84,"depth":84,"links":6553},[6554],{"id":6532,"depth":84,"text":6533},"The ITU-T continues studying quantum-resistant support, with X.1811 scoped to 5G and a study group examining changes to X.509 certificates.",[6557,6560,6563],{"q":6558,"a":6559},"What has the ITU-T done on quantum-resistant support?","The ITU-T published X.1811 in 2021, scoped to 5G, and its Study Group 17 (Question 11) continues studying changes to X.509 certificates. The work remains in study rather than settled recommendations across the board, so the ITU-T is still developing its quantum-resistant guidance.",{"q":6561,"a":6562},"Why does X.509 matter for post-quantum?","X.509 is the standard format for digital certificates that underpin secure connections and identity on the internet. Adapting it for post-quantum algorithms is necessary for quantum-resistant certificates to work widely, which is why a study group is examining the needed changes.",{"q":6564,"a":6565},"Is the ITU-T work complete?","No. X.1811 addresses 5G specifically, and the broader X.509 work is still under study. Organizations should view the ITU-T's quantum-resistant guidance as developing, and track Study Group 17 for recommendations that affect certificates.",[6504],[3063,228],{},[6570],{"label":6571,"url":6572},"International Telecommunication Union, Telecommunication Standardization Sector (ITU-T), \"X.1811 and Study Group 17 Question 11 work on quantum-resistant support,\" 2021 onward.","https:\u002F\u002Fwww.itu.int\u002Fen\u002FITU-T\u002F",[6574,6575],{"label":6463,"url":6508},{"label":2803,"url":2847},{"title":6527,"description":6555},"itu-t-studying-quantum-resistant-support","news\u002Fitu-t-studying-quantum-resistant-support",[438,547,368,2862,260],"The ITU-T continues studying quantum-resistant support, with its 2021 X.1811 recommendation scoped to 5G and a study group examining changes to X.509 certificates.","q4G2BwvFpCWpe8tjL1Kh08m-uxwtM8Ra_rBssZjuT7o",{"id":6583,"title":6584,"author":7,"authorTitle":8,"authorUrl":9,"body":6585,"canonical":9,"category":92,"date":6613,"description":6614,"draft":95,"extension":96,"faqs":6615,"findingsSource":9,"geo":6625,"image":417,"industries":6626,"keyFindings":9,"meta":6627,"modified":6382,"navigation":103,"path":4291,"pullquote":9,"recommendations":9,"references":6628,"related":6632,"seo":6635,"seoTitle":6636,"signposts":9,"slug":6637,"stats":9,"stem":6638,"tags":6639,"tldr":6640,"__hash__":6641},"news\u002Fnews\u002Fdutch-aivd-cwi-tno-migration-handbook.md","Dutch AIVD, CWI and TNO Publish a Post-Quantum Migration Handbook and Free Tool",{"type":11,"value":6586,"toc":6610},[6587,6591,6596,6599,6602,6605],[14,6588,6590],{"id":6589},"dutch-aivd-cwi-and-tno-publish-a-post-quantum-migration-handbook","Dutch AIVD, CWI and TNO publish a post-quantum migration handbook",[19,6592,6593],{},[383,6594,6595],{},"3 DECEMBER 2024, THE HAGUE",[19,6597,6598],{},"The Dutch intelligence service AIVD, the national research institute CWI and the applied-research organization TNO published a post-quantum migration handbook on 3 December 2024. The handbook sets out a three-step approach and comes with a free tool called PQChoiceAssistant. Together they give organizations a practical, vendor-neutral starting point rather than abstract advice.",[19,6600,6601],{},"PQChoiceAssistant lowers the barrier to entry. The tool helps an organization choose appropriate post-quantum options for its situation, which matters for teams that lack deep in-house cryptographic expertise. By pairing the handbook's method with a tool that applies it, the three organizations made the first steps of migration accessible to a wider range of organizations.",[19,6603,6604],{},"The handbook carries added weight because of who wrote it. The AIVD has said that Q-Day, the point at which a quantum computer can break current cryptography, could arrive by 2030. An intelligence service making that estimate gives the handbook's call to start now a sharper edge than a purely technical publication would carry.",[19,6606,6607,6609],{},[383,6608,399],{}," The handbook turns the Netherlands' post-quantum thinking into usable guidance, and the free PQChoiceAssistant tool means organizations can act on it without buying anything first. The AIVD's view that Q-Day could come by 2030 frames the timeline: planning that starts now has a realistic chance of finishing in time, while delay narrows the window. The three-step approach gives teams a concrete place to begin.",{"title":8,"searchDepth":84,"depth":84,"links":6611},[6612],{"id":6589,"depth":84,"text":6590},"2024-12-03","The Dutch AIVD, CWI and TNO published a post-quantum migration handbook in December 2024, with a three-step approach and a free PQChoiceAssistant tool.",[6616,6619,6622],{"q":6617,"a":6618},"What does the handbook provide?","The handbook sets out a three-step migration approach and comes with a free tool called PQChoiceAssistant. Together they give organizations a practical, vendor-neutral starting point for planning a post-quantum migration rather than abstract guidance.",{"q":6620,"a":6621},"What is PQChoiceAssistant?","PQChoiceAssistant is a free tool published alongside the handbook. It helps organizations choose appropriate post-quantum options for their situation, lowering the barrier for teams that lack deep in-house cryptographic expertise to begin planning.",{"q":6623,"a":6624},"What is the AIVD's view on Q-Day?","The AIVD has said Q-Day, the point at which a quantum computer can break current cryptography, could arrive by 2030. That estimate underlines why the handbook urges organizations to begin migration planning now rather than waiting.",[3975],[419,100],{},[6629],{"label":6630,"url":6631},"AIVD, CWI and TNO, \"The PQC Migration Handbook,\" 2nd ed., Dec. 3, 2024.","https:\u002F\u002Fwww.aivd.nl\u002Fdocumenten\u002Fpublicaties\u002F2024\u002F12\u002F03\u002Fthe-pqc-migration-handbook",[6633,6634],{"label":3921,"url":3922},{"label":818,"url":819},{"title":6584,"description":6614},"Dutch AIVD, CWI and TNO Publish PQC Handbook","dutch-aivd-cwi-tno-migration-handbook","news\u002Fdutch-aivd-cwi-tno-migration-handbook",[132,133,368,549,260],"The Dutch AIVD, CWI and TNO published a post-quantum migration handbook in December 2024 with a three-step approach and a free PQChoiceAssistant tool.","sEerJ5SSRsasFa4orUV2aFQhBguc4I8XpONLl1-XO1k",{"id":6643,"title":5103,"author":7,"authorTitle":8,"authorUrl":9,"body":6644,"canonical":9,"category":92,"date":6672,"description":6673,"draft":95,"extension":96,"faqs":6674,"findingsSource":9,"geo":6684,"image":417,"industries":6685,"keyFindings":9,"meta":6686,"modified":6507,"navigation":103,"path":5104,"pullquote":9,"recommendations":9,"references":6687,"related":6691,"seo":6694,"seoTitle":6695,"signposts":9,"slug":6696,"stats":9,"stem":6697,"tags":6698,"tldr":6699,"__hash__":6700},"news\u002Fnews\u002Faustralia-ism-1917-gov-crypto-pqc-by-2030.md",{"type":11,"value":6645,"toc":6669},[6646,6650,6655,6658,6661,6664],[14,6647,6649],{"id":6648},"australias-ism-1917-requires-new-government-cryptography-to-support-pqc-by-2030","Australia's ISM-1917 requires new government cryptography to support PQC by 2030",[19,6651,6652],{},[383,6653,6654],{},"1 DECEMBER 2024, CANBERRA",[19,6656,6657],{},"The Australian Signals Directorate's Information Security Manual added control 1917, which requires new government cryptography to support post-quantum algorithms by 2030. The control names ML-DSA-87 and ML-KEM-1024 for the post-quantum schemes, with SHA-384 or SHA-512 for hashing and AES-256 for symmetric encryption. It gives Australian agencies a precise technical target rather than a general requirement.",[19,6659,6660],{},"The control targets new cryptography. It shapes what agencies build and buy from now on, rather than forcing an immediate rip-and-replace of everything in place. As agencies renew systems through 2030, the control steers the estate toward post-quantum support, so the migration happens through the normal refresh cycle instead of a single disruptive event.",[19,6662,6663],{},"The choice of parameter sets signals a conservative posture. ML-DSA-87 and ML-KEM-1024 are the highest-security configurations of their standards, so selecting them favours a larger security margin over performance. That trade-off fits government data, which often must stay protected for long periods and justifies the extra cost of the strongest options.",[19,6665,6666,6668],{},[383,6667,399],{}," ISM-1917 turns Australia's post-quantum intent into a concrete control with named algorithms and a 2030 date for new cryptography. By tying the requirement to new systems, it makes the migration manageable through routine renewal. Agencies and their suppliers can specify ML-DSA-87 and ML-KEM-1024 in new procurements now, aligning with both the control and the international NIST standards behind it.",{"title":8,"searchDepth":84,"depth":84,"links":6670},[6671],{"id":6648,"depth":84,"text":6649},"2024-12-01","Australia's ISM control 1917 requires new government cryptography to support post-quantum algorithms by 2030, naming ML-DSA-87, ML-KEM-1024 and AES-256.",[6675,6678,6681],{"q":6676,"a":6677},"What does ISM-1917 require?","ISM control 1917 requires new Australian government cryptography to support post-quantum algorithms by 2030. It names ML-DSA-87 and ML-KEM-1024 for the post-quantum schemes, alongside SHA-384 or SHA-512 for hashing and AES-256 for symmetric encryption.",{"q":6679,"a":6680},"Does it cover existing systems?","The control targets new cryptography, so it shapes what agencies build and buy going forward rather than forcing an immediate replacement of everything in place. That approach steers the estate toward post-quantum support as systems are renewed through 2030.",{"q":6682,"a":6683},"Why name the strongest parameter sets?","ML-DSA-87 and ML-KEM-1024 are the highest-security parameter sets of their standards. Choosing them gives government systems a larger security margin, which suits data that must stay protected for long periods, consistent with a conservative national posture.",[1506],[419,100],{},[6688],{"label":6689,"url":6690},"Australian Signals Directorate, \"Information Security Manual,\" control ISM-1917, Dec. 2024.","https:\u002F\u002Fwww.cyber.gov.au\u002Fresources-business-and-government\u002Fessential-cyber-security\u002Fism",[6692,6693],{"label":2280,"url":2281},{"label":2673,"url":2674},{"title":5103,"description":6673},"Australia ISM-1917 Requires PQC Support by 2030","australia-ism-1917-gov-crypto-pqc-by-2030","news\u002Faustralia-ism-1917-gov-crypto-pqc-by-2030",[438,1338,134,368,439],"Australia's ISM control 1917 requires new government cryptography to support post-quantum algorithms by 2030, naming ML-DSA-87, ML-KEM-1024, SHA-384\u002F512 and AES-256.","3r9_mA0n6NI2X_ePwsDUu94SMJ3iRQSixfSPGmrQT-E",{"id":6702,"title":4540,"author":7,"authorTitle":8,"authorUrl":9,"body":6703,"canonical":9,"category":92,"date":6731,"description":6732,"draft":95,"extension":96,"faqs":6733,"findingsSource":9,"geo":6743,"image":417,"industries":6744,"keyFindings":9,"meta":6745,"modified":6746,"navigation":103,"path":4541,"pullquote":9,"recommendations":9,"references":6747,"related":6751,"seo":6754,"seoTitle":6755,"signposts":9,"slug":6756,"stats":9,"stem":6757,"tags":6758,"tldr":6759,"__hash__":6760},"news\u002Fnews\u002Fjapan-fsa-study-group-urges-banks-start-now.md",{"type":11,"value":6704,"toc":6728},[6705,6709,6714,6717,6720,6723],[14,6706,6708],{"id":6707},"japan-fsa-study-group-urges-banks-to-start-post-quantum-work-now","Japan FSA study group urges banks to start post-quantum work now",[19,6710,6711],{},[383,6712,6713],{},"26 NOVEMBER 2024, TOKYO",[19,6715,6716],{},"A study group convened by Japan's Financial Services Agency urged banks on 26 November 2024 to start post-quantum work now. The group recommended a cryptographic inventory, investment in crypto agility, and a phased approach that targets the mid-2030s for priority systems. The message puts the emphasis on beginning immediately rather than waiting for a quantum computer to appear.",[19,6718,6719],{},"The study group's report is guidance rather than a binding rule, but it signals the direction the agency expects. Japanese banks should read it as a strong supervisory expectation that could harden into firmer requirements over time, much as voluntary guidance in other jurisdictions has preceded formal rules.",[19,6721,6722],{},"Putting the inventory first reflects the practical order of the work. A bank cannot migrate cryptography it has not located, so mapping where and how cryptography is used provides the foundation. Every later step, prioritising systems, building crypto agility and migrating in phases, depends on having that picture of the starting point.",[19,6724,6725,6727],{},[383,6726,399],{}," The FSA study group gives Japanese banks a clear, practical starting sequence: inventory first, then crypto agility, then phased migration toward the mid-2030s for priority systems. Because it comes from the financial supervisor's orbit, banks should treat it as more than optional advice. Those that begin the inventory now will be ready as the agency's expectations firm up and the sector's 2035 horizon approaches.",{"title":8,"searchDepth":84,"depth":84,"links":6729},[6730],{"id":6707,"depth":84,"text":6708},"2024-11-26","A Japan FSA study group urged banks in November 2024 to start post-quantum work now, recommending inventory, crypto agility and a phased approach.",[6734,6737,6740],{"q":6735,"a":6736},"What did the FSA study group recommend?","The study group recommended that banks start now with a cryptographic inventory, build crypto agility, and take a phased approach, targeting the mid-2030s for priority systems. It frames post-quantum readiness as work to begin immediately rather than later.",{"q":6738,"a":6739},"Is the FSA recommendation binding?","The study group's report is guidance rather than a binding rule. It signals the direction the Financial Services Agency expects, so Japanese banks should treat it as a strong supervisory expectation that may harden into firmer requirements over time.",{"q":6741,"a":6742},"Why start with an inventory?","A bank cannot migrate cryptography it has not located, so an inventory of where and how cryptography is used is the foundation. The study group puts it first because every later step, prioritisation, crypto agility and phased migration, depends on knowing the starting point.",[4527],[227,100],{},"2026-08-24",[6748],{"label":6749,"url":6750},"Financial Services Agency of Japan, \"Study group report on post-quantum cryptography for financial institutions,\" Nov. 26, 2024.","https:\u002F\u002Fwww.fsa.go.jp\u002Fen\u002F",[6752,6753],{"label":4543,"url":4530},{"label":1331,"url":1332},{"title":4540,"description":6732},"Japan FSA Study Group Urges Banks to Start Now","japan-fsa-study-group-urges-banks-start-now","news\u002Fjapan-fsa-study-group-urges-banks-start-now",[257,133,549,368,260],"A Japan FSA study group urged banks in November 2024 to start post-quantum work now, recommending inventory, crypto agility and a phased approach into the mid-2030s.","WBz1I_-EKRNsjjCht9O-oCMAhQZy1eaBggpP6aVETWc",{"id":6762,"title":6763,"author":7,"authorTitle":8,"authorUrl":9,"body":6764,"canonical":9,"category":92,"date":6795,"description":6796,"draft":95,"extension":96,"faqs":6797,"findingsSource":9,"geo":6804,"image":417,"industries":6805,"keyFindings":9,"meta":6806,"modified":6807,"navigation":103,"path":6808,"pullquote":9,"recommendations":9,"references":6809,"related":6813,"seo":6819,"seoTitle":6820,"signposts":9,"slug":6821,"stats":9,"stem":6822,"tags":6823,"tldr":6825,"__hash__":6826},"news\u002Fnews\u002Fnist-draft-ir-8547-2030-2035-transition-dates.md","NIST Draft Sets 2030 and 2035 Dates for Leaving Vulnerable Encryption",{"type":11,"value":6765,"toc":6792},[6766,6770,6775,6778,6781,6784,6787],[14,6767,6769],{"id":6768},"nist-draft-sets-2030-and-2035-dates-for-leaving-vulnerable-encryption","NIST draft sets 2030 and 2035 dates for leaving vulnerable encryption",[19,6771,6772],{},[383,6773,6774],{},"12 NOVEMBER 2024, GAITHERSBURG",[19,6776,6777],{},"NIST Internal Report 8547, \"Transition to Post-Quantum Cryptography Standards,\" appeared as an initial public draft. It sets out a proposed schedule for leaving quantum-vulnerable public-key cryptography, with 2030 and 2035 as the dates that a Yahoo Tech article of 14 May 2026 repeats. The 2035 date matches the goal in National Security Memorandum 10 of 2022.",[19,6779,6780],{},"Federal agencies and contractors are affected first, since NIST guidance governs federal use. Regulated entities and vendors that follow NIST algorithm transitions as a baseline are also affected.",[19,6782,6783],{},"The draft has become a reference point for industry planning. The Yahoo Tech article reports survey figures showing that only 5 percent of organizations have a defined quantum strategy and only 5 percent have implemented quantum-resistant encryption. It repeats the 2030 and 2035 dates and describes migration as a present-tense compliance obligation.",[19,6785,6786],{},"The document in question is a draft, so its dates are a proposal and not yet a final NIST schedule.",[19,6788,6789,6791],{},[383,6790,399],{}," Boards and CISOs now have two planning dates, 2030 and 2035, drawn from NIST's draft and consistent with the 2035 goal in the 2022 national security memorandum. Because the schedule is a draft, organizations should expect it to change, but the survey figures suggest most firms have not yet started. This suggests that organizations that begin inventories early will face less pressure when final deadlines arrive.",{"title":8,"searchDepth":84,"depth":84,"links":6793},[6794],{"id":6768,"depth":84,"text":6769},"2024-11-12","NIST draft IR 8547 proposes 2030 and 2035 dates for leaving quantum-vulnerable cryptography. It is a draft, but gives boards planning anchors.",[6798,6801],{"q":6799,"a":6800},"Are the 2030 and 2035 dates final?","No. The document is a draft, so its dates are a proposal and not yet a final NIST schedule. Organizations should expect it to change but can still use the dates for planning.",{"q":6802,"a":6803},"How prepared are organizations for these dates?","A Yahoo Tech article of 14 May 2026 reports that only 5 percent of organizations have a defined quantum strategy and only 5 percent have implemented quantum-resistant encryption, so early inventories reduce later pressure.",[5157],[100,419],{},"2026-08-20","\u002Fnews\u002Fnist-draft-ir-8547-2030-2035-transition-dates",[6810],{"label":6811,"url":6812},"Yahoo Tech, \"Post-quantum cryptography migration is already behind schedule,\" May 14, 2026.","https:\u002F\u002Ftech.yahoo.com\u002Fcybersecurity\u002Farticles\u002Fpost-quantum-cryptography-migration-already-153928703.html",[6814,6817],{"label":6815,"url":6816},"NSM-10 Sets 2035 Goal for Quantum-Resistant Cryptography","\u002Fnews\u002Fnational-security-memorandum-10-2035-quantum-resistant-goal",{"label":6818,"url":121},"Global PQC Mandates and Deadlines",{"title":6763,"description":6796},"NIST Draft IR 8547 Sets 2030 and 2035 PQC Dates","nist-draft-ir-8547-2030-2035-transition-dates","news\u002Fnist-draft-ir-8547-2030-2035-transition-dates",[438,2157,1338,6824,134],"NSM-10","NIST draft IR 8547 proposes 2030 and 2035 dates for leaving quantum-vulnerable cryptography, and though it is a draft, it gives boards planning anchors.","vmcPDPupOeHpQr1Dc55aVl07QIcB4hRyKB5owSlFosI",{"id":6828,"title":6829,"author":7,"authorTitle":8,"authorUrl":9,"body":6830,"canonical":9,"category":220,"date":6858,"description":6859,"draft":95,"extension":96,"faqs":6860,"findingsSource":9,"geo":6870,"image":417,"industries":6872,"keyFindings":9,"meta":6873,"modified":6445,"navigation":103,"path":6874,"pullquote":9,"recommendations":9,"references":6875,"related":6882,"seo":6885,"seoTitle":6886,"signposts":9,"slug":6887,"stats":9,"stem":6888,"tags":6889,"tldr":6890,"__hash__":6891},"news\u002Fnews\u002Fbanque-de-france-mas-post-quantum-email-trial.md","Banque de France and MAS Exchange Post-Quantum Encrypted Email Across Continents",{"type":11,"value":6831,"toc":6855},[6832,6836,6841,6844,6847,6850],[14,6833,6835],{"id":6834},"banque-de-france-and-mas-exchange-post-quantum-encrypted-email-across-continents","Banque de France and MAS exchange post-quantum encrypted email across continents",[19,6837,6838],{},[383,6839,6840],{},"5 NOVEMBER 2024, PARIS AND SINGAPORE",[19,6842,6843],{},"The Banque de France and the Monetary Authority of Singapore announced that they completed a joint experiment in post-quantum cryptography, according to the Banque de France's press release. Post-quantum algorithms resist attack by future quantum computers. The two central banks exchanged digitally signed and encrypted emails protected by the CRYSTALS-Dilithium signature scheme and the CRYSTALS-Kyber key-encapsulation scheme, a method for agreeing on secret keys, using Microsoft Outlook with a post-quantum plugin. The messages crossed continents over standard internet infrastructure, not a dedicated network.",[19,6845,6846],{},"The Banque de France reports that the trial showed post-quantum email security is practical. It also draws a broader lesson: standardizing algorithms is not enough, because application protocols, public key infrastructure, digital certificates and secure email standards must also carry them. The release points to possible use in payment networks, and both institutions plan to extend experimentation to critical financial transactions, in particular cross-border payment network transactions. The Banque de France added that it had anticipated experiments of this kind with partners since 2022.",[19,6848,6849],{},"Finextra's report is consistent with the central bank account. It adds that the algorithms followed recommendations from France's ANSSI, the national cybersecurity agency, and NIST standards, and that the partners saw potential for integration into payment networks. This was a technical trial of email. It was not a test of a payment system and not a regulatory instrument, and it creates no obligation for any institution. The payment-network application remains a stated intention, not a result.",[19,6851,6852,6854],{},[383,6853,399],{}," Central banks are testing post-quantum tools on live, cross-border communication, which suggests supervisors will treat this as a normal part of planning. The finding that certificates, protocols and email standards must change as well as the algorithms is a useful warning: organizations should expect migration to touch many systems, not one cryptographic library. Nothing here is mandatory, but the stated plan to move toward cross-border payment transactions indicates where pilots may head next.",{"title":8,"searchDepth":84,"depth":84,"links":6856},[6857],{"id":6834,"depth":84,"text":6835},"2024-11-05","The Banque de France and MAS exchanged post-quantum encrypted email across continents. The trial is voluntary but shows where pilots may head.",[6861,6864,6867],{"q":6862,"a":6863},"Is the Banque de France and MAS trial mandatory for banks?","No. It was a technical email experiment, not a regulatory instrument, and it creates no obligation for any institution. The extension toward cross-border payment transactions is a stated intention, not a result.",{"q":6865,"a":6866},"What did the trial show about migration scope?","The Banque de France said standardizing algorithms is not enough. Application protocols, public key infrastructure, certificates and secure email standards must also be updated, so organizations should expect migration to touch many systems.",{"q":6868,"a":6869},"Which algorithms did the trial use?","The two central banks used the CRYSTALS-Dilithium signature scheme and the CRYSTALS-Kyber key-encapsulation scheme, following recommendations from France's ANSSI and NIST standards, within Microsoft Outlook using a post-quantum plugin.",[6871,1153],"paris",[227,228],{},"\u002Fnews\u002Fbanque-de-france-mas-post-quantum-email-trial",[6876,6879],{"label":6877,"url":6878},"Banque de France, \"Banque de France and Monetary Authority of Singapore conduct groundbreaking Post-quantum Cryptography experiment to enhance communication security,\" Nov. 5, 2024.","https:\u002F\u002Fwww.banque-france.fr\u002Fen\u002Fpress-release\u002Fbanque-de-france-and-monetary-authority-singapore-conduct-groundbreaking-post-quantum-cryptography",{"label":6880,"url":6881},"Finextra, \"Banque de France and Monetary Authority of Singapore complete post-quantum cryptography trial,\" undated.","https:\u002F\u002Fwww.finextra.com\u002Fnewsarticle\u002F45010\u002Fbanque-de-france-and-monetary-authority-of-singapore-complete-post-quantum-cryptography-trial",[6883,6884],{"label":1583,"url":1584},{"label":2056,"url":2057},{"title":6829,"description":6859},"Post-Quantum Email Trial: Banque de France and MAS","banque-de-france-mas-post-quantum-email-trial","news\u002Fbanque-de-france-mas-post-quantum-email-trial",[257,438,368,2862,260],"The Banque de France and the Monetary Authority of Singapore exchanged post-quantum encrypted email across continents in November 2024, a voluntary trial that hints where pilots may head.","8Q4wB3i2GoATO9BgtK2wKTXLittCbGDQkwPtiJ464DM",{"id":6893,"title":6389,"author":7,"authorTitle":8,"authorUrl":9,"body":6894,"canonical":9,"category":92,"date":6922,"description":6923,"draft":95,"extension":96,"faqs":6924,"findingsSource":9,"geo":6934,"image":417,"industries":6935,"keyFindings":9,"meta":6936,"modified":5946,"navigation":103,"path":6390,"pullquote":9,"recommendations":9,"references":6937,"related":6940,"seo":6943,"seoTitle":6944,"signposts":9,"slug":6945,"stats":9,"stem":6946,"tags":6947,"tldr":6948,"__hash__":6949},"news\u002Fnews\u002Fisrael-directive-364-underpins-quantum-letter.md",{"type":11,"value":6895,"toc":6919},[6896,6900,6905,6908,6911,6914],[14,6897,6899],{"id":6898},"israels-directive-364-underpins-the-bank-of-israel-quantum-letter","Israel's Directive 364 underpins the Bank of Israel quantum letter",[19,6901,6902],{},[383,6903,6904],{},"1 NOVEMBER 2024, TEL AVIV",[19,6906,6907],{},"The Bank of Israel issued Directive 364 in November 2024, consolidating earlier directives 357, 361 and 363 into a single cyber defence management framework. The directive does not mention quantum. Even so, it provides the supervisory legal hook on which the Bank of Israel built its January 2025 quantum preparedness letter.",[19,6909,6910],{},"This pattern is common among supervisors. Rather than write a standalone quantum rule, a regulator attaches the new expectation to an existing framework. Directive 364 supplies the authority, and the letter supplies the quantum-specific requirement, so the directive matters as the legal foundation precisely because the letter rests on it.",[19,6912,6913],{},"Consolidating the three earlier directives also simplifies the picture. By folding 357, 361 and 363 into one current framework, the Bank of Israel created a single, up-to-date hook that newer expectations can build on. That makes it easier for the supervisor to extend requirements, as the quantum letter shows, without reopening several separate directives.",[19,6915,6916,6918],{},[383,6917,399],{}," Directive 364 explains how the Bank of Israel could order quantum preparedness plans without a dedicated quantum regulation: the directive is the legal anchor, and the letter is the specific instruction. For banks, the lesson is that supervisory expectations can arrive through existing frameworks. Understanding which directive underpins a requirement helps a bank see where future expectations may attach.",{"title":8,"searchDepth":84,"depth":84,"links":6920},[6921],{"id":6898,"depth":84,"text":6899},"2024-11-01","Israel's Directive 364 consolidates earlier directives and provides the legal hook for the Bank of Israel's quantum preparedness letter, without naming quantum.",[6925,6928,6931],{"q":6926,"a":6927},"What is Directive 364?","Directive 364, issued in November 2024 by the Bank of Israel, consolidates earlier directives 357, 361 and 363 into a single cyber defence framework. It does not mention quantum, but it provides the supervisory legal hook on which the Bank of Israel built its quantum preparedness letter.",{"q":6929,"a":6930},"Why does a directive that omits quantum matter for PQC?","Supervisors often attach new expectations to existing frameworks rather than writing standalone rules. Directive 364 supplies the authority, and the January 2025 letter supplies the quantum-specific requirement, so the directive matters as the legal foundation even without naming quantum.",{"q":6932,"a":6933},"What did Directive 364 consolidate?","It consolidates earlier directives 357, 361 and 363 into one cyber defence management framework. Consolidating them simplifies the supervisory landscape and creates a single, current hook that newer expectations, including quantum preparedness, can build on.",[6379],[227,100],{},[6938],{"label":6939,"url":6386},"Bank of Israel, Banking Supervision Department, \"Directive 364: Cyber defence management,\" Nov. 2024.",[6941,6942],{"label":1928,"url":1929},{"label":1863,"url":1864},{"title":6389,"description":6923},"Israel's Directive 364 Underpins the Quantum Letter","israel-directive-364-underpins-quantum-letter","news\u002Fisrael-directive-364-underpins-quantum-letter",[257,134,368,259,260],"Israel's Directive 364, issued in November 2024, consolidates earlier directives and provides the legal hook for the Bank of Israel's quantum preparedness letter, though it never names quantum.","doElivJL4k4eqteTFz37wFqcpYMu5Y5PXzxgRdi7cNM",{"id":6951,"title":6952,"author":7,"authorTitle":8,"authorUrl":9,"body":6953,"canonical":9,"category":92,"date":6981,"description":6982,"draft":95,"extension":96,"faqs":6983,"findingsSource":9,"geo":6990,"image":417,"industries":6991,"keyFindings":9,"meta":6992,"modified":5946,"navigation":103,"path":6993,"pullquote":9,"recommendations":9,"references":6994,"related":6997,"seo":7001,"seoTitle":1072,"signposts":9,"slug":7002,"stats":9,"stem":7003,"tags":7004,"tldr":7005,"__hash__":7006},"news\u002Fnews\u002Fcisa-post-quantum-considerations-operational-technology.md","CISA Warns That Industrial Systems Face Special Obstacles in Post-Quantum Migration",{"type":11,"value":6954,"toc":6978},[6955,6959,6964,6967,6970,6973],[14,6956,6958],{"id":6957},"cisa-warns-that-industrial-systems-face-special-obstacles-in-post-quantum-migration","CISA warns that industrial systems face special obstacles in post-quantum migration",[19,6960,6961],{},[383,6962,6963],{},"OCTOBER 2024, ARLINGTON",[19,6965,6966],{},"CISA published \"Post-Quantum Considerations for Operational Technology\" in late October 2024. The CISA page itself carries no date; Industrial Cyber reports it on 29 October 2024. Operational technology (OT) means the systems that run physical processes such as power grids and factory lines.",[19,6968,6969],{},"The paper warns that OT faces particular obstacles in moving to post-quantum cryptography. According to Industrial Cyber, these include legacy equipment with decades-long lifespans, long patching cycles and strict safety testing, widespread use of end-of-life operating systems, and hardware that is hard to replace in live operations. Industrial Cyber reports these recommendations: segment OT networks to limit attacker access, build crypto agility (the ability to change algorithms without replacing infrastructure) into new platforms, protect remote access points first, layer classical and post-quantum protections, begin inventory and planning now, adopt zero trust architecture, and pilot post-quantum and hybrid approaches. Organizations should write their own transition roadmaps and use the NIST algorithms released in 2024. Owners and operators of industrial control systems and SCADA in energy, utilities, manufacturing, transportation and healthcare are affected, along with OT vendors and manufacturers.",[19,6971,6972],{},"Industrial Cyber quotes two practitioners with sharply different views. Tom Marsland of Cloud Range said the quantum threat to existing cryptography is real. John Terrill, chief information security officer at Phosphorus, called the paper \"just a shiny new distraction,\" arguing that OT teams have more immediate problems. CISA's January 2026 product-category list explicitly leaves OT and IoT devices outside its current scope, according to Infosecurity Magazine.",[19,6974,6975,6977],{},[383,6976,399],{}," Equipment with decades-long lifespans bought today may still be in service when quantum risk becomes real, so purchasing decisions now carry long-term exposure. The guidance is advisory, and practitioners disagree on urgency. Operators should expect OT to lag IT, which suggests building crypto agility requirements into new equipment purchases.",{"title":8,"searchDepth":84,"depth":84,"links":6979},[6980],{"id":6957,"depth":84,"text":6958},"2024-10-29","CISA's October 2024 paper says industrial systems face legacy gear and long patch cycles in post-quantum migration. Operators should plan crypto agility.",[6984,6987],{"q":6985,"a":6986},"Is the CISA OT guidance mandatory?","No. The guidance is advisory, and practitioners disagree on urgency: one called the quantum threat real, while another called the paper a distraction given more immediate OT problems.",{"q":6988,"a":6989},"What does CISA recommend for OT operators?","Per Industrial Cyber: segment OT networks, build crypto agility into new platforms, protect remote access first, layer classical and post-quantum protections, start inventory now, adopt zero trust and pilot hybrid approaches.",[98],[100,522,521],{},"\u002Fnews\u002Fcisa-post-quantum-considerations-operational-technology",[6995,6996],{"label":528,"url":529},{"label":531,"url":532},[6998,7000],{"label":6999,"url":816},"CISA, NSA and NIST Quantum-Readiness Factsheet",{"label":1427,"url":1413},{"title":6952,"description":6982},"cisa-post-quantum-considerations-operational-technology","news\u002Fcisa-post-quantum-considerations-operational-technology",[547,546,549,438],"CISA's October 2024 paper says industrial systems face legacy gear and long patch cycles in post-quantum migration, so operators should plan crypto agility.","JQPdCeURjkwnNfkzpfn9PpVzDln14sCK7ER1nSbFfdk",{"id":7008,"title":7009,"author":7,"authorTitle":8,"authorUrl":9,"body":7010,"canonical":9,"category":92,"date":7038,"description":7039,"draft":95,"extension":96,"faqs":7040,"findingsSource":9,"geo":7050,"image":417,"industries":7051,"keyFindings":9,"meta":7052,"modified":7053,"navigation":103,"path":7054,"pullquote":9,"recommendations":9,"references":7055,"related":7059,"seo":7062,"seoTitle":7063,"signposts":9,"slug":7064,"stats":9,"stem":7065,"tags":7066,"tldr":7067,"__hash__":7068},"news\u002Fnews\u002Fgsma-post-quantum-telco-guidance-series.md","GSMA Issues a Post-Quantum Guidance Series for Telecom Operators",{"type":11,"value":7011,"toc":7035},[7012,7016,7021,7024,7027,7030],[14,7013,7015],{"id":7014},"gsma-issues-a-post-quantum-guidance-series-for-telecom-operators","GSMA issues a post-quantum guidance series for telecom operators",[19,7017,7018],{},[383,7019,7020],{},"1 OCTOBER 2024, LONDON",[19,7022,7023],{},"The GSMA issued a post-quantum guidance series for telecom operators, documents PQ.03 through PQ.07, from October 2024 to May 2026. The series covers telecom use cases for post-quantum cryptography, addressing IoT, roaming, base stations and satellite. It gives operators guidance tailored to the varied parts of a telecom network rather than one general treatment.",[19,7025,7026],{},"Telecom needs this specificity. Networks include long-lived, specialised equipment and distinct use cases like roaming and satellite links, where generic post-quantum advice falls short. By addressing each use case, the series helps operators see the particular migration challenges of base stations, IoT devices and the other components that make up a modern network.",[19,7028,7029],{},"The series suits a broad audience within the industry. Telecom operators and their equipment suppliers can each find guidance relevant to the parts of the network they own, because the GSMA breaks the problem into use cases rather than treating the network as a single system. That structure lets teams focus on their own components without wading through irrelevant material.",[19,7031,7032,7034],{},[383,7033,399],{}," The GSMA series gives telecom operators post-quantum guidance matched to the real structure of their networks, from IoT and roaming to base stations and satellite. That use-case approach is valuable because telecom's specialised, long-lived equipment makes migration harder than in general IT. Operators can use the relevant documents in the series to plan migration for each part of their network, and suppliers can align their products accordingly.",{"title":8,"searchDepth":84,"depth":84,"links":7036},[7037],{"id":7014,"depth":84,"text":7015},"2024-10-01","The GSMA issued a post-quantum telecom guidance series from October 2024 to May 2026, covering IoT, roaming, base stations and satellite use cases.",[7041,7044,7047],{"q":7042,"a":7043},"What does the GSMA guidance series cover?","The series, documents PQ.03 through PQ.07 issued from October 2024 to May 2026, covers telecom use cases for post-quantum cryptography. It addresses IoT, roaming, base stations and satellite, giving operators guidance tailored to the varied parts of a telecom network.",{"q":7045,"a":7046},"Why does telecom need specific PQC guidance?","Telecom networks include long-lived, specialised equipment and distinct use cases like roaming and satellite, where general guidance falls short. Addressing each use case helps operators understand the specific migration challenges of base stations, IoT devices and other network components.",{"q":7048,"a":7049},"Who should use the GSMA series?","Telecom operators and their equipment suppliers are the main audience. Because the series breaks the network into use cases, teams responsible for different parts of the network can find guidance relevant to the systems they own and operate.",[4908],[3063,100],{},"2026-08-19","\u002Fnews\u002Fgsma-post-quantum-telco-guidance-series",[7056],{"label":7057,"url":7058},"GSMA, \"Post-Quantum Telco Network Guidance (PQ.03-PQ.07),\" Oct. 2024 to May 2026.","https:\u002F\u002Fwww.gsma.com\u002Fsolutions-and-impact\u002Ftechnologies\u002Fsecurity\u002F",[7060,7061],{"label":2803,"url":2847},{"label":2673,"url":2674},{"title":7009,"description":7039},"GSMA Issues a Post-Quantum Telco Guidance Series","gsma-post-quantum-telco-guidance-series","news\u002Fgsma-post-quantum-telco-guidance-series",[547,438,546,368,260],"The GSMA issued a post-quantum telecom guidance series from October 2024 to May 2026, covering use cases from IoT and roaming to base stations and satellite.","mdCszT3--AlURNN4RtrsQttlIYYkGa6otNZaO_gv9-0",{"id":7070,"title":7071,"author":7,"authorTitle":8,"authorUrl":9,"body":7072,"canonical":9,"category":92,"date":7100,"description":7101,"draft":95,"extension":96,"faqs":7102,"findingsSource":9,"geo":7112,"image":417,"industries":7113,"keyFindings":9,"meta":7114,"modified":6382,"navigation":103,"path":5892,"pullquote":9,"recommendations":9,"references":7115,"related":7119,"seo":7122,"seoTitle":7123,"signposts":9,"slug":7124,"stats":9,"stem":7125,"tags":7126,"tldr":7101,"__hash__":7127},"news\u002Fnews\u002Fuk-ncsc-endorses-ml-kem-768-ml-dsa-65.md","UK NCSC Endorses ML-KEM-768 and ML-DSA-65, Treating Hybrid as Interim Only",{"type":11,"value":7073,"toc":7097},[7074,7078,7083,7086,7089,7092],[14,7075,7077],{"id":7076},"uk-ncsc-endorses-ml-kem-768-and-ml-dsa-65","UK NCSC endorses ML-KEM-768 and ML-DSA-65",[19,7079,7080],{},[383,7081,7082],{},"14 AUGUST 2024, LONDON",[19,7084,7085],{},"The UK's National Cyber Security Centre endorsed specific post-quantum algorithms in its August 2024 guidance, version 2.0. It named ML-KEM-768 for key establishment and ML-DSA-65 for signatures, both specific parameter sets of the NIST standards. By naming configurations rather than general families, the NCSC gives UK organizations a clear default choice and removes ambiguity for vendors.",[19,7087,7088],{},"The guidance also sets the NCSC's position on hybrids. It treats hybrid schemes, which pair a classical algorithm with a post-quantum one, as an interim measure only. That stance differs from some European agencies that favour hybrids throughout the transition, and it points UK organizations toward pure post-quantum algorithms once they are confident in them.",[19,7090,7091],{},"Naming exact parameter sets aids interoperability and procurement. When an organization and its suppliers both know the NCSC expects ML-KEM-768 and ML-DSA-65, a contract can specify a concrete target instead of a vague requirement for post-quantum support. That precision reduces the risk of mismatched implementations that fail to interoperate.",[19,7093,7094,7096],{},[383,7095,399],{}," The NCSC's endorsement gives UK organizations a definite starting point: two named algorithms and a clear view that hybrids are temporary. Teams can specify ML-KEM-768 and ML-DSA-65 in procurement and architecture today, and plan to move off hybrids rather than treat them as the destination. That clarity makes it easier to align internal choices with national guidance and with the NIST standards behind it.",{"title":8,"searchDepth":84,"depth":84,"links":7098},[7099],{"id":7076,"depth":84,"text":7077},"2024-08-14","The UK NCSC endorsed ML-KEM-768 and ML-DSA-65 in August 2024 and treats hybrid schemes as an interim measure rather than a long-term goal.",[7103,7106,7109],{"q":7104,"a":7105},"Which algorithms does the NCSC endorse?","In its August 2024 guidance, version 2.0, the NCSC endorsed ML-KEM-768 for key establishment and ML-DSA-65 for signatures. These are specific parameter sets of the NIST standards, giving UK organizations a clear default choice rather than a menu of options.",{"q":7107,"a":7108},"Does the NCSC recommend hybrid schemes?","The NCSC treats hybrid schemes as an interim measure only, not a long-term goal. That differs from some European agencies that favour hybrids for the transition. The NCSC's position points organizations toward pure post-quantum algorithms once they are confident in them.",{"q":7110,"a":7111},"Why name specific parameter sets?","Naming ML-KEM-768 and ML-DSA-65 removes ambiguity. Organizations and vendors know exactly which configurations the NCSC expects, which aids interoperability and lets procurement specify a concrete target rather than a general requirement for post-quantum support.",[4908],[100,228],{},[7116],{"label":7117,"url":7118},"National Cyber Security Centre (NCSC), \"Next steps in preparing for post-quantum cryptography,\" version 2.0, Aug. 14, 2024.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fwhitepaper\u002Fnext-steps-preparing-for-post-quantum-cryptography",[7120,7121],{"label":4918,"url":4919},{"label":2673,"url":2674},{"title":7071,"description":7101},"UK NCSC Endorses ML-KEM-768 and ML-DSA-65","uk-ncsc-endorses-ml-kem-768-ml-dsa-65","news\u002Fuk-ncsc-endorses-ml-kem-768-ml-dsa-65",[1809,438,549,368,260],"YzDG3afGGXB8rbc1nQJwv0W69bssxCHye0YKF1BACHE",{"id":7129,"title":5956,"author":7,"authorTitle":8,"authorUrl":9,"body":7130,"canonical":9,"category":92,"date":7161,"description":7162,"draft":95,"extension":96,"faqs":7163,"findingsSource":9,"geo":7170,"image":417,"industries":7171,"keyFindings":9,"meta":7172,"modified":7173,"navigation":103,"path":2674,"pullquote":9,"recommendations":9,"references":7174,"related":7180,"seo":7187,"seoTitle":2673,"signposts":9,"slug":7188,"stats":9,"stem":7189,"tags":7190,"tldr":7191,"__hash__":7192},"news\u002Fnews\u002Fnist-approves-first-three-post-quantum-standards.md",{"type":11,"value":7131,"toc":7158},[7132,7136,7141,7144,7147,7150,7153],[14,7133,7135],{"id":7134},"nist-approves-its-first-three-post-quantum-standards","NIST approves its first three post-quantum standards",[19,7137,7138],{},[383,7139,7140],{},"13 AUGUST 2024, GAITHERSBURG",[19,7142,7143],{},"NIST, the US standards agency, approved its first three post-quantum cryptography standards: FIPS 203 (ML-KEM, a lattice-based method for two parties to establish a shared secret key), FIPS 204 (ML-DSA, a lattice-based digital signature scheme) and FIPS 205 (SLH-DSA, a hash-based signature scheme intended as a backup to the lattice approach). HIPAA Journal describes ML-KEM as the general-purpose choice for protecting traffic on public networks, ML-DSA as the main signature standard, and SLH-DSA as a backup signature method.",[19,7145,7146],{},"The standards closed a process NIST opened in 2016. Holland & Knight reports that the competition began with 82 candidate algorithms and ran through four elimination rounds over eight years. The motivation is the threat that a large-scale quantum computer could break widely used public-key systems, RSA in particular. Holland & Knight also stresses the \"harvest now, decrypt later\" problem, in which adversaries store encrypted traffic today so they can decrypt it once such a computer exists.",[19,7148,7149],{},"Federal agencies hold the clearest obligation. Holland & Knight ties the start of agency migration to follow-on OMB guidance and notes that agencies must inventory vulnerable systems. Federal IT contractors were already preparing implementations. Private companies that hold long-lived sensitive data face the harvest-now exposure and, in the law firm's words, a rising liability and reputational risk now that the standards are final.",[19,7151,7152],{},"NIST urged quick action. HIPAA Journal quotes Dustin Moody, who leads NIST's post-quantum standardization project, encouraging administrators to start integrating the algorithms immediately because full integration takes time. The same article says technology firms including Google, Apple, Signal and Zoom had already begun adopting them.",[19,7154,7155,7157],{},[383,7156,399],{}," These are the finalized NIST post-quantum standards covered by the sources, so vendors and buyers now have named algorithms to ask for. Organizations that hold data with a long confidentiality life should treat the harvest-now risk as a present exposure, not a future one. Because NIST says integration takes time, this suggests starting inventories and vendor conversations now.",{"title":8,"searchDepth":84,"depth":84,"links":7159},[7160],{"id":7134,"depth":84,"text":7135},"2024-08-13","NIST approved FIPS 203, 204 and 205, its first post-quantum encryption standards. Vendors and buyers now have named algorithms to request and plan around.",[7164,7167],{"q":7165,"a":7166},"Who has the clearest obligation under the NIST standards?","Federal agencies hold the clearest obligation, since they must inventory vulnerable systems and migrate after follow-on OMB guidance. Private companies with long-lived sensitive data face harvest-now, decrypt-later exposure and rising liability and reputational risk.",{"q":7168,"a":7169},"What should organizations do now that the standards are final?","NIST urged administrators to start integrating the algorithms immediately because full integration takes time. Practical first steps are cryptographic inventories and vendor conversations about support for ML-KEM, ML-DSA and SLH-DSA.",[5157],[100,419],{},"2026-08-18",[7175,7178],{"label":7176,"url":7177},"Holland & Knight, \"NIST Releases Three Post-Quantum Cryptography Standards,\" Aug. 2024.","https:\u002F\u002Fwww.hklaw.com\u002Fen\u002Finsights\u002Fpublications\u002F2024\u002F08\u002Fnist-releases-three-post-quantum-cryptography-standards",{"label":7179,"url":356},"HIPAA Journal, \"NIST Releases Finalized Post-Quantum Encryption Standards,\" Aug. 13, 2024.",[7181,7184],{"label":7182,"url":7183},"NIST PQC Standards Guide: FIPS 203, 204, 205","\u002Fblog\u002Fnist-pqc-standards-guide",{"label":7185,"url":7186},"What NIST Post-Quantum Standards Mean for You","\u002Fblog\u002Fwhat-nist-post-quantum-cryptography-standards-mean",{"title":5956,"description":7162},"nist-approves-first-three-post-quantum-standards","news\u002Fnist-approves-first-three-post-quantum-standards",[438,132,259,134,260],"NIST approved FIPS 203, 204 and 205, its first post-quantum encryption standards, so vendors and buyers now have named algorithms to request and plan around.","xDSPju2tgJLXpRwxfoEsX-sHoAqFKDhCjMbBUufMNIg",{"id":7194,"title":7195,"author":7,"authorTitle":8,"authorUrl":9,"body":7196,"canonical":9,"category":92,"date":7224,"description":7225,"draft":95,"extension":96,"faqs":7226,"findingsSource":9,"geo":7236,"image":417,"industries":7238,"keyFindings":9,"meta":7239,"modified":7240,"navigation":103,"path":2218,"pullquote":9,"recommendations":9,"references":7241,"related":7245,"seo":7248,"seoTitle":2217,"signposts":9,"slug":7249,"stats":9,"stem":7250,"tags":7251,"tldr":7252,"__hash__":7253},"news\u002Fnews\u002Fbahamas-dare-act-2024-digital-assets.md","The Bahamas DARE Act 2024 Regulates Staking, Stablecoins and Custody",{"type":11,"value":7197,"toc":7221},[7198,7202,7207,7210,7213,7216],[14,7199,7201],{"id":7200},"the-bahamas-dare-act-2024-regulates-staking-stablecoins-and-custody","The Bahamas DARE Act 2024 regulates staking, stablecoins and custody",[19,7203,7204],{},[383,7205,7206],{},"30 JULY 2024, NASSAU",[19,7208,7209],{},"The Bahamas enacted the Digital Assets and Registered Exchanges Act, known as the DARE Act, on 30 July 2024. The Act regulates digital asset activities including staking, stablecoins and custody, setting a legal framework for a growing sector. It also bans algorithmic stablecoins outright, drawing a firm line around a model it treats as too risky.",[19,7211,7212],{},"The ban on algorithmic stablecoins reflects a clear judgment. These coins try to hold their value through algorithms rather than reserves, a design that has failed dramatically in some high-profile cases. By excluding them, The Bahamas keeps a risky model out of its regulated framework and signals that it prioritises user protection in how it defines the sector.",[19,7214,7215],{},"Custody is where the Act meets cryptography. Safeguarding digital assets depends on cryptographic keys and algorithms, so regulating custody brings cryptographic security into scope. As quantum-vulnerable algorithms become a concern, firms operating under the Act have a basis to consider quantum risk in how they protect the assets they hold.",[19,7217,7218,7220],{},[383,7219,399],{}," The DARE Act gives The Bahamas a structured regime for digital assets, covering staking, stablecoins and custody while banning algorithmic stablecoins. Its custody rules tie cryptographic security to regulation, which gives quantum risk a place in the framework. Firms under the Act can treat the cryptography protecting customer assets as a supervised concern that quantum developments will increasingly affect.",{"title":8,"searchDepth":84,"depth":84,"links":7222},[7223],{"id":7200,"depth":84,"text":7201},"2024-07-30","The Bahamas DARE Act 2024 regulates digital asset activities including staking, stablecoins and custody, and bans algorithmic stablecoins outright.",[7227,7230,7233],{"q":7228,"a":7229},"What does the DARE Act 2024 regulate?","The Digital Assets and Registered Exchanges Act 2024 regulates digital asset activities in The Bahamas, including staking, stablecoins and custody. It sets a legal framework for these activities and bans algorithmic stablecoins outright.",{"q":7231,"a":7232},"Why does the Act ban algorithmic stablecoins?","Algorithmic stablecoins attempt to hold their value through algorithms rather than reserves, a model that has failed dramatically in some cases. Banning them reflects a judgment that the risk to users is too high, so The Bahamas excludes them from its regulated framework.",{"q":7234,"a":7235},"How does the Act connect to cryptographic risk?","Custody of digital assets depends on cryptography, so regulating custody brings cryptographic security into scope. As quantum-vulnerable algorithms become a concern, firms operating under the Act have reason to consider quantum risk in how they safeguard assets.",[7237],"nassau",[227,100],{},"2026-08-21",[7242],{"label":7243,"url":7244},"Government of The Bahamas, \"Digital Assets and Registered Exchanges (DARE) Act 2024,\" Jul. 30, 2024.","https:\u002F\u002Fwww.scb.gov.bs\u002F",[7246,7247],{"label":2162,"url":2207},{"label":2214,"url":2215},{"title":7195,"description":7225},"bahamas-dare-act-2024-digital-assets","news\u002Fbahamas-dare-act-2024-digital-assets",[256,257,134,258,260],"The Bahamas DARE Act 2024 regulates digital asset activities including staking, stablecoins and custody, bans algorithmic stablecoins, and brings cryptographic custody into supervisory scope.","StJEVWWX1ePrNMY8cqwK-gBcA2hHMyPeKxezO1fOhpA",{"id":7255,"title":7256,"author":7,"authorTitle":8,"authorUrl":9,"body":7257,"canonical":9,"category":220,"date":7285,"description":7286,"draft":95,"extension":96,"faqs":7287,"findingsSource":9,"geo":7297,"image":417,"industries":7298,"keyFindings":9,"meta":7299,"modified":6382,"navigation":103,"path":7300,"pullquote":9,"recommendations":9,"references":7301,"related":7305,"seo":7308,"seoTitle":7256,"signposts":9,"slug":7309,"stats":9,"stem":7310,"tags":7311,"tldr":7286,"__hash__":7312},"news\u002Fnews\u002Foecd-primer-migration-urgent.md","OECD Primer Calls Post-Quantum Migration Urgent",{"type":11,"value":7258,"toc":7282},[7259,7263,7268,7271,7274,7277],[14,7260,7262],{"id":7261},"oecd-primer-calls-post-quantum-migration-urgent","OECD primer calls post-quantum migration urgent",[19,7264,7265],{},[383,7266,7267],{},"19 JUNE 2024, PARIS",[19,7269,7270],{},"The Organisation for Economic Co-operation and Development published a primer on post-quantum migration on 19 June 2024, framing the migration as urgent. As a primer, it introduces the issue to a policy audience, explaining the quantum threat and the need to migrate in terms aimed at policymakers rather than cryptographers.",[19,7272,7273],{},"The OECD's role gives the primer its reach. The organization informs economic policy across its member economies, so a primer that calls migration urgent helps put the issue on policymakers' agendas. It can shape how national governments think about the problem, even though the OECD sets no binding rules of its own.",[19,7275,7276],{},"The document is analysis, not regulation. The OECD produces guidance and research rather than legal requirements, so the primer's influence works through awareness and policy debate among member governments. That indirect route still matters, because national rules often follow the priorities that bodies like the OECD help establish.",[19,7278,7279,7281],{},[383,7280,399],{}," The OECD primer brings post-quantum migration to the attention of economic policymakers and labels it urgent, which helps move the issue up national agendas. It binds no one directly, but it shapes the policy debate that produces binding rules. Organizations can read it as a signal that governments across OECD economies are being told migration cannot wait, which often precedes firmer national requirements.",{"title":8,"searchDepth":84,"depth":84,"links":7283},[7284],{"id":7261,"depth":84,"text":7262},"2024-06-19","An OECD primer published in June 2024 frames post-quantum migration as urgent, bringing the issue to policymakers across its member economies.",[7288,7291,7294],{"q":7289,"a":7290},"What does the OECD primer say?","The primer, published on 19 June 2024, frames post-quantum migration as urgent. As a primer, it introduces the issue to a policy audience, explaining the quantum threat and the need to migrate in terms aimed at policymakers rather than cryptographers.",{"q":7292,"a":7293},"Why does an OECD primer matter?","The OECD informs economic policy across its member economies, so a primer that calls migration urgent helps put the issue on policymakers' agendas. It can shape national thinking even though the OECD itself sets no binding rules for members to follow.",{"q":7295,"a":7296},"Is the primer a binding instrument?","No. The OECD produces analysis and guidance rather than binding regulation. The primer's influence runs through raising awareness and shaping policy debate among member governments, not through any legal requirement on organizations.",[6871],[419,100],{},"\u002Fnews\u002Foecd-primer-migration-urgent",[7302],{"label":7303,"url":7304},"Organisation for Economic Co-operation and Development, \"A primer on post-quantum cryptography migration,\" Jun. 19, 2024.","https:\u002F\u002Fwww.oecd.org\u002F",[7306,7307],{"label":818,"url":819},{"label":815,"url":816},{"title":7256,"description":7286},"oecd-primer-migration-urgent","news\u002Foecd-primer-migration-urgent",[368,132,1078,258,439],"4YlTRONFU6CdXDRroV53ekWbCR_ccY2MsKDKe9YFEpA",{"id":7314,"title":7315,"author":7,"authorTitle":8,"authorUrl":9,"body":7316,"canonical":9,"category":92,"date":7344,"description":7345,"draft":95,"extension":96,"faqs":7346,"findingsSource":9,"geo":7356,"image":417,"industries":7357,"keyFindings":9,"meta":7358,"modified":7173,"navigation":103,"path":3218,"pullquote":9,"recommendations":9,"references":7359,"related":7363,"seo":7366,"seoTitle":7367,"signposts":9,"slug":7368,"stats":9,"stem":7369,"tags":7370,"tldr":7371,"__hash__":7372},"news\u002Fnews\u002Feu-commission-recommendation-2024-1101-coordinated-migration.md","European Commission Recommendation 2024\u002F1101 Urges Coordinated Post-Quantum Migration",{"type":11,"value":7317,"toc":7341},[7318,7322,7327,7330,7333,7336],[14,7319,7321],{"id":7320},"european-commission-recommendation-20241101-urges-coordinated-migration","European Commission recommendation 2024\u002F1101 urges coordinated migration",[19,7323,7324],{},[383,7325,7326],{},"11 APRIL 2024, BRUSSELS",[19,7328,7329],{},"The European Commission issued Recommendation (EU) 2024\u002F1101 on 11 April 2024, urging member states to coordinate their move to post-quantum cryptography. The recommendation is soft law: it sets direction and carries political weight, but it does not compel action or fix a legal deadline. Its purpose is to keep member states from migrating in isolation and ending up with incompatible approaches.",[19,7331,7332],{},"The recommendation asks each member state to develop a national post-quantum strategy and to use hybrid schemes during the transition. A hybrid scheme combines a classical algorithm with a post-quantum one, so a system stays secure even if either later proves weak. That caution fit the moment, because the post-quantum algorithms were still new when the Commission published the text.",[19,7334,7335],{},"To coordinate the work, the recommendation points to a sub-group of the NIS Cooperation Group as the venue where member states align their plans. Centralizing the coordination there gives the Commission a way to track progress and share practice across the European Union, even without binding force behind the request.",[19,7337,7338,7340],{},[383,7339,399],{}," The recommendation set the tone for the European Union's coordinated approach, favouring national strategies and hybrid schemes over a patchwork of national choices. It carries no deadline, so its influence depends on member states acting on it, but it established the coordination structure that later EU roadmap milestones build on. Organizations in Europe can read it as an early signal of the direction national rules would take.",{"title":8,"searchDepth":84,"depth":84,"links":7342},[7343],{"id":7320,"depth":84,"text":7321},"2024-04-11","The European Commission's April 2024 recommendation urges member states to coordinate post-quantum migration, develop national strategies and use hybrid schemes.",[7347,7350,7353],{"q":7348,"a":7349},"Is the recommendation binding?","No. Recommendation 2024\u002F1101 is soft law. It urges member states to act and coordinate rather than compelling them, so it carries political weight and sets direction without creating a legal obligation to migrate by a given date.",{"q":7351,"a":7352},"What does it ask member states to do?","It asks member states to develop national post-quantum strategies, coordinate their migrations, and use hybrid schemes during the transition. It also points to a sub-group of the NIS Cooperation Group as the venue for coordinating that work across the European Union.",{"q":7354,"a":7355},"Why recommend hybrid schemes?","Hybrid schemes combine a classical algorithm with a post-quantum one, so a system stays secure even if one of the two later proves weak. The recommendation favours hybrids during the transition because the post-quantum algorithms were still new when it was issued.",[416],[419,100],{},[7360],{"label":7361,"url":7362},"European Commission, \"Commission Recommendation (EU) 2024\u002F1101 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography,\" Official Journal of the European Union, Apr. 11, 2024.","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freco\u002F2024\u002F1101\u002Foj",[7364,7365],{"label":3214,"url":3215},{"label":1863,"url":1864},{"title":7315,"description":7345},"EU Recommendation 2024\u002F1101 Urges Coordinated PQC","eu-commission-recommendation-2024-1101-coordinated-migration","news\u002Feu-commission-recommendation-2024-1101-coordinated-migration",[1431,132,549,368,439],"The European Commission's April 2024 recommendation urges member states to coordinate post-quantum migration, develop national strategies and use hybrid schemes during the transition.","YxI-ExTRn8A0ybLjlZ2mo3Vgheg7vRz49Xr_ftm3teo",{"id":7374,"title":7375,"author":7,"authorTitle":8,"authorUrl":9,"body":7376,"canonical":9,"category":92,"date":7404,"description":7405,"draft":95,"extension":96,"faqs":7406,"findingsSource":9,"geo":7416,"image":417,"industries":7417,"keyFindings":9,"meta":7418,"modified":7173,"navigation":103,"path":7419,"pullquote":9,"recommendations":9,"references":7420,"related":7424,"seo":7427,"seoTitle":7428,"signposts":9,"slug":7429,"stats":9,"stem":7430,"tags":7431,"tldr":7432,"__hash__":7433},"news\u002Fnews\u002Fpci-dss-12-3-3-cryptographic-inventory.md","PCI DSS Requirement 12.3.3 Obliges a Cryptographic Inventory",{"type":11,"value":7377,"toc":7401},[7378,7382,7387,7390,7393,7396],[14,7379,7381],{"id":7380},"pci-dss-requirement-1233-obliges-a-cryptographic-inventory","PCI DSS requirement 12.3.3 obliges a cryptographic inventory",[19,7383,7384],{},[383,7385,7386],{},"31 MARCH 2024, GLOBAL",[19,7388,7389],{},"PCI DSS requirement 12.3.3 obliges organizations that handle payment card data to document and review the cryptographic cipher suites and protocols they use. In practical terms, it requires a cryptographic inventory. That requirement predates the quantum conversation, but it produces exactly the input any post-quantum migration needs first.",[19,7391,7392],{},"The link to post-quantum readiness is direct. A cryptographic inventory is the foundation of migration, because an organization cannot migrate cryptography it has not located. Requirement 12.3.3 forces that inventory for payment data, so an organization meeting the requirement already holds a map of where it uses cryptography for its most sensitive data flows.",[19,7394,7395],{},"The reach is wide. Organizations that store, process or transmit payment card data must comply with PCI DSS, which covers a broad range of merchants and service providers. Many organizations therefore already maintain the cryptographic inventory that post-quantum planning depends on, often without framing it as quantum preparation.",[19,7397,7398,7400],{},[383,7399,399],{}," PCI DSS 12.3.3 means many organizations already do the hardest first step of post-quantum migration, inventory, as a condition of handling payment card data. Teams can build on that existing inventory rather than start from scratch, extending it to cover quantum-vulnerable algorithms and migration priorities. Recognising the overlap turns a compliance obligation into a head start on quantum readiness.",{"title":8,"searchDepth":84,"depth":84,"links":7402},[7403],{"id":7380,"depth":84,"text":7381},"2024-03-31","PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, which is the foundation for post-quantum migration.",[7407,7410,7413],{"q":7408,"a":7409},"What does PCI DSS 12.3.3 require?","Requirement 12.3.3 obliges organizations that handle payment card data to document and review the cryptographic cipher suites and protocols they use. In effect, it requires a cryptographic inventory, which is exactly the first step any post-quantum migration needs.",{"q":7411,"a":7412},"How does 12.3.3 relate to post-quantum readiness?","A cryptographic inventory is the foundation of post-quantum migration, because an organization cannot migrate cryptography it has not located. Requirement 12.3.3 forces that inventory for payment data, so compliance already produces a key input for quantum planning.",{"q":7414,"a":7415},"Who must meet PCI DSS 12.3.3?","Organizations that store, process or transmit payment card data must comply with PCI DSS, including requirement 12.3.3. That covers a wide range of merchants and service providers, so many organizations already hold the cryptographic inventory that post-quantum planning requires.",[225],[227,228],{},"\u002Fnews\u002Fpci-dss-12-3-3-cryptographic-inventory",[7421],{"label":7422,"url":7423},"PCI Security Standards Council, \"Payment Card Industry Data Security Standard v4.0, Requirement 12.3.3,\" 2024.","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F",[7425,7426],{"label":4412,"url":4413},{"label":815,"url":816},{"title":7375,"description":7405},"PCI DSS 12.3.3 Requires a Cryptographic Inventory","pci-dss-12-3-3-cryptographic-inventory","news\u002Fpci-dss-12-3-3-cryptographic-inventory",[257,133,134,368,260],"PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, a step that doubles as the foundation for post-quantum migration.","yWuLLlnRBL_Xf2fdsymXUqef_K3_iwLFO4JhYdq-06U",{"id":7435,"title":7436,"author":7,"authorTitle":8,"authorUrl":9,"body":7437,"canonical":9,"category":92,"date":7465,"description":7466,"draft":95,"extension":96,"faqs":7467,"findingsSource":9,"geo":7477,"image":417,"industries":7478,"keyFindings":9,"meta":7479,"modified":6807,"navigation":103,"path":6267,"pullquote":9,"recommendations":9,"references":7480,"related":7484,"seo":7487,"seoTitle":7488,"signposts":9,"slug":7489,"stats":9,"stem":7490,"tags":7491,"tldr":7492,"__hash__":7493},"news\u002Fnews\u002Feu-technical-standard-2024-1774-crypto-updates.md","EU Technical Standard 2024\u002F1774 Requires Firms to Update Cryptography as Attacks Advance",{"type":11,"value":7438,"toc":7462},[7439,7443,7448,7451,7454,7457],[14,7440,7442],{"id":7441},"eu-technical-standard-20241774-requires-crypto-updates-as-attacks-advance","EU technical standard 2024\u002F1774 requires crypto updates as attacks advance",[19,7444,7445],{},[383,7446,7447],{},"13 MARCH 2024, BRUSSELS",[19,7449,7450],{},"Commission Delegated Regulation (EU) 2024\u002F1774, published on 13 March 2024, sets the technical standards that sit beneath DORA for financial firms. Article 6 requires an encryption policy that covers data at rest, in transit and in use. Article 7 covers key management. The regulation obliges firms to update their cryptography as cryptanalysis develops, so a firm cannot treat its encryption choices as fixed.",[19,7452,7453],{},"The standard names the quantum threat in recital 9, which signals that quantum sits within the kinds of cryptanalytic developments firms must track. The text stays technology-neutral: it describes outcomes rather than naming algorithms or setting a date, so the obligation remains valid as post-quantum standards mature.",[19,7455,7456],{},"That design places the judgment with the firm. A financial entity must decide when cryptanalytic progress, including progress toward quantum computers, warrants a cryptographic update, and must be able to show a supervisor the policy behind that decision. The requirement to update as attacks advance makes crypto agility a practical necessity rather than an optional goal.",[19,7458,7459,7461],{},[383,7460,399],{}," The standard turns DORA's general resilience duty into a concrete cryptographic obligation for financial firms. Because it names quantum and requires updates as attacks advance, firms cannot defer the question until a deadline appears. Those that build encryption and key-management policies capable of swapping algorithms will meet the standard more easily than those with hard-coded cryptography.",{"title":8,"searchDepth":84,"depth":84,"links":7463},[7464],{"id":7441,"depth":84,"text":7442},"2024-03-13","EU delegated regulation 2024\u002F1774 requires financial firms to update cryptography as cryptanalysis advances, with Articles 6 and 7 on encryption and key management.",[7468,7471,7474],{"q":7469,"a":7470},"What do Articles 6 and 7 require?","Article 6 requires an encryption policy covering data at rest, in transit and in use. Article 7 covers key management. Together they oblige financial firms to protect data cryptographically and to update their cryptography as cryptanalysis develops.",{"q":7472,"a":7473},"Does the standard name quantum?","Recital 9 names quantum, so the delegated regulation acknowledges the quantum threat without mandating a specific algorithm or date. The text is technology-neutral, requiring firms to keep cryptography current rather than prescribing which algorithms to use.",{"q":7475,"a":7476},"What does technology-neutral mean here?","The standard sets outcomes, not products. It requires firms to update cryptography as attacks advance, leaving the choice of algorithms to the firm. That approach lets the obligation stay valid as post-quantum standards mature without rewriting the regulation.",[416],[227,100],{},[7481],{"label":7482,"url":7483},"European Commission, \"Commission Delegated Regulation (EU) 2024\u002F1774,\" Official Journal of the European Union, Mar. 13, 2024.","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_del\u002F2024\u002F1774\u002Foj",[7485,7486],{"label":1863,"url":1864},{"label":3217,"url":3218},{"title":7436,"description":7466},"EU 2024\u002F1774 Requires Crypto Updates for Firms","eu-technical-standard-2024-1774-crypto-updates","news\u002Feu-technical-standard-2024-1774-crypto-updates",[663,257,549,134,260],"EU delegated regulation 2024\u002F1774 requires financial firms to maintain encryption and key-management policies and update cryptography as cryptanalysis advances, naming quantum in a recital.","T04PFk9FMXId4Ltx5_WGinB6LVV6vNBKoCTbiVgbjXo",{"id":7495,"title":7496,"author":7,"authorTitle":8,"authorUrl":9,"body":7497,"canonical":9,"category":92,"date":7525,"description":7526,"draft":95,"extension":96,"faqs":7527,"findingsSource":9,"geo":7537,"image":417,"industries":7538,"keyFindings":9,"meta":7539,"modified":7240,"navigation":103,"path":1584,"pullquote":9,"recommendations":9,"references":7540,"related":7543,"seo":7547,"seoTitle":7548,"signposts":9,"slug":7549,"stats":9,"stem":7550,"tags":7551,"tldr":7552,"__hash__":7553},"news\u002Fnews\u002Fsingapore-mas-advisory-inventory-and-plan.md","Singapore MAS Advisory Tells Financial Firms to Inventory and Plan for Post-Quantum",{"type":11,"value":7498,"toc":7522},[7499,7503,7508,7511,7514,7517],[14,7500,7502],{"id":7501},"singapore-mas-advisory-tells-firms-to-inventory-and-plan","Singapore MAS advisory tells firms to inventory and plan",[19,7504,7505],{},[383,7506,7507],{},"20 FEBRUARY 2024, SINGAPORE",[19,7509,7510],{},"The Monetary Authority of Singapore issued an advisory, MAS\u002FTCRS\u002F2024\u002F01, on 20 February 2024. It tells financial firms to inventory their cryptography and plan for post-quantum migration. The advisory sets the foundational steps, knowing what cryptography a firm has and planning the transition, as supervisory expectations rather than binding rules at this stage.",[19,7512,7513],{},"The document is an advisory, not a rule, but the MAS signalled that supervisory expectations would follow later in 2026. Firms should therefore treat the advisory as the first step toward firmer requirements rather than optional reading. Starting the inventory and plan now positions a firm to meet the expectations when they arrive.",[19,7515,7516],{},"Singapore's status as a major global financial centre gives the advisory reach beyond its borders. Expectations the MAS sets influence how internationally active firms manage quantum risk, because those firms often align their global practices with the standards of the key markets they operate in. An early advisory from such a regulator signals where sector expectations are heading.",[19,7518,7519,7521],{},[383,7520,399],{}," The MAS advisory gives financial firms a clear starting instruction, inventory and plan, and flags that supervisory expectations will follow in 2026. Because Singapore is a leading financial hub, the advisory's influence extends to internationally active firms. Those that complete a cryptographic inventory and build a migration plan now will be ready when the MAS turns its advisory into firmer supervisory expectations.",{"title":8,"searchDepth":84,"depth":84,"links":7523},[7524],{"id":7501,"depth":84,"text":7502},"2024-02-20","The Monetary Authority of Singapore issued a February 2024 advisory telling financial firms to inventory cryptography and plan for post-quantum migration.",[7528,7531,7534],{"q":7529,"a":7530},"What does the MAS advisory ask firms to do?","The advisory, MAS\u002FTCRS\u002F2024\u002F01 of 20 February 2024, tells financial firms to inventory their cryptography and plan for post-quantum migration. It sets the foundational steps, know what you have and plan the transition, as supervisory expectations rather than binding rules at this stage.",{"q":7532,"a":7533},"Is the MAS advisory binding?","The February 2024 document is an advisory, not a binding rule. The Monetary Authority of Singapore indicated that supervisory expectations would follow later in 2026, so firms should treat the advisory as the first step toward firmer requirements.",{"q":7535,"a":7536},"Why does Singapore matter for post-quantum finance?","Singapore is a major global financial centre, so expectations the MAS sets influence how internationally active firms manage quantum risk. An early advisory from such a regulator signals the direction supervisory expectations are likely to take across the sector.",[1153],[227,100],{},[7541],{"label":7542,"url":5040},"Monetary Authority of Singapore, \"Advisory on addressing the cybersecurity risks associated with quantum,\" MAS\u002FTCRS\u002F2024\u002F01, Feb. 20, 2024.",[7544,7546],{"label":7545,"url":1587},"Singapore MAS Publishes a QKD Sandbox Report Favouring PQC as the Foundation",{"label":1331,"url":1332},{"title":7496,"description":7526},"Singapore MAS Advisory: Inventory and Plan for PQC","singapore-mas-advisory-inventory-and-plan","news\u002Fsingapore-mas-advisory-inventory-and-plan",[257,133,368,132,260],"The Monetary Authority of Singapore issued an advisory in February 2024 telling financial firms to inventory cryptography and plan for post-quantum migration, with supervisory expectations to follow.","xFB1jbe-OPUxXSbNKfMrI7H7Kbq0CRyaK0AhLPuXyCo",{"id":7555,"title":7556,"author":7,"authorTitle":8,"authorUrl":9,"body":7557,"canonical":9,"category":220,"date":7585,"description":7586,"draft":95,"extension":96,"faqs":7587,"findingsSource":9,"geo":7596,"image":417,"industries":7597,"keyFindings":9,"meta":7598,"modified":6807,"navigation":103,"path":5713,"pullquote":9,"recommendations":9,"references":7599,"related":7603,"seo":7606,"seoTitle":7607,"signposts":9,"slug":7608,"stats":9,"stem":7609,"tags":7610,"tldr":7611,"__hash__":7612},"news\u002Fnews\u002Fwef-uk-fca-quantum-security-finance-white-paper.md","WEF and UK FCA Publish White Paper on Quantum Security for Finance",{"type":11,"value":7558,"toc":7582},[7559,7563,7568,7571,7574,7577],[14,7560,7562],{"id":7561},"wef-and-uk-fca-publish-a-white-paper-on-quantum-security-for-finance","WEF and UK FCA publish a white paper on quantum security for finance",[19,7564,7565],{},[383,7566,7567],{},"17 JANUARY 2024, LONDON",[19,7569,7570],{},"The World Economic Forum and the UK Financial Conduct Authority published a white paper on quantum security for the financial sector on 17 January 2024. The paper sets out principles and frameworks and aims to inform global regulatory approaches. It is a thought-leadership document rather than a set of binding rules, so firms should read it for direction rather than obligation.",[19,7572,7573],{},"The authorship is worth parsing. Although the FCA co-authored the paper, its content stays at the level of principles and frameworks, not FCA rules. That distinction matters for firms: the paper signals how regulatory thinking on quantum security is developing without creating a requirement they must meet. It describes a direction, not a deadline.",[19,7575,7576],{},"The main audience is regulators, policymakers and financial-sector risk leaders. By aligning global regulatory approaches to quantum security, the paper tries to reduce the chance that different jurisdictions pull the sector in incompatible directions. For a globally interconnected industry, that coordination is as valuable as any single technical recommendation.",[19,7578,7579,7581],{},[383,7580,399],{}," The paper is an early signal of where financial regulation on quantum security is heading, written with a regulator's involvement but short of regulation itself. Firms can use it to anticipate the principles future rules may embody, and to shape internal frameworks that will likely sit well with those rules. Treating it as foresight rather than compliance is the right reading.",{"title":8,"searchDepth":84,"depth":84,"links":7583},[7584],{"id":7561,"depth":84,"text":7562},"2024-01-17","The WEF and UK FCA published a January 2024 white paper on quantum security for finance, offering principles and frameworks rather than binding FCA rules.",[7588,7591,7594],{"q":7589,"a":7590},"What does the WEF and FCA white paper cover?","The January 2024 white paper sets out principles and frameworks for quantum security in the financial sector. It aims to inform global regulatory approaches, so it is a thought-leadership document rather than a set of binding rules for firms to follow.",{"q":7592,"a":7593},"Are these FCA rules?","No. Although the UK Financial Conduct Authority co-authored it, the white paper offers principles and frameworks, not FCA rules. Firms should not read it as a regulatory requirement, though it signals the direction regulatory thinking on quantum security is taking.",{"q":5154,"a":7595},"Regulators, policymakers and financial-sector risk leaders are the main audience. The paper helps align global regulatory approaches to quantum security, so it is most useful to those shaping or anticipating how rules in this area will develop.",[4908],[227,100],{},[7600],{"label":7601,"url":7602},"World Economic Forum and Financial Conduct Authority, \"Quantum Security for the Financial Sector: Informing Global Regulatory Approaches,\" Jan. 17, 2024.","https:\u002F\u002Fwww.weforum.org\u002Fpublications\u002F",[7604,7605],{"label":4921,"url":4922},{"label":1331,"url":1332},{"title":7556,"description":7586},"WEF and UK FCA White Paper on Quantum Finance","wef-uk-fca-quantum-security-finance-white-paper","news\u002Fwef-uk-fca-quantum-security-finance-white-paper",[257,368,258,2862,260],"The World Economic Forum and the UK FCA published a January 2024 white paper on quantum security for finance, offering principles and frameworks rather than FCA rules.","80U-RL80I2_V5z1x4ZOYv-iuo3MxpEufTmQAIC0DH4M",{"id":7614,"title":7615,"author":7,"authorTitle":8,"authorUrl":9,"body":7616,"canonical":9,"category":92,"date":7644,"description":7645,"draft":95,"extension":96,"faqs":7646,"findingsSource":9,"geo":7656,"image":417,"industries":7657,"keyFindings":9,"meta":7658,"modified":7173,"navigation":103,"path":7659,"pullquote":9,"recommendations":9,"references":7660,"related":7664,"seo":7667,"seoTitle":7668,"signposts":9,"slug":7669,"stats":9,"stem":7670,"tags":7671,"tldr":7672,"__hash__":7673},"news\u002Fnews\u002Ffinra-asks-securities-firms-start-dialogue.md","FINRA Asks Securities Firms to Start a Post-Quantum Dialogue",{"type":11,"value":7617,"toc":7641},[7618,7622,7627,7630,7633,7636],[14,7619,7621],{"id":7620},"finra-asks-securities-firms-to-start-a-post-quantum-dialogue","FINRA asks securities firms to start a post-quantum dialogue",[19,7623,7624],{},[383,7625,7626],{},"30 OCTOBER 2023, WASHINGTON",[19,7628,7629],{},"FINRA asked securities firms to start a dialogue on post-quantum cryptography on 30 October 2023. It framed the request around research and awareness, encouraging firms to engage with the topic rather than imposing a new regulatory requirement. The approach invites firms into the conversation instead of handing them a rule to follow.",[19,7631,7632],{},"The framing means the request creates no obligation. By treating the move as research and awareness, FINRA signals that it is paying attention to quantum risk and expects firms to begin thinking about it, without yet setting requirements. In regulatory practice, that kind of early signal often precedes firmer expectations down the line.",[19,7634,7635],{},"Starting with dialogue serves a purpose for an emerging risk. It lets a regulator raise awareness and gather understanding of the sector's readiness before deciding on rules. For securities firms, the open framing gives them time to engage with quantum risk on their own terms, and it gives FINRA insight it can use when it weighs whether to set requirements.",[19,7637,7638,7640],{},[383,7639,399],{}," FINRA's request puts post-quantum cryptography on securities firms' radar through dialogue rather than mandate. It carries no obligation, but it signals regulatory interest that may harden over time. Firms can use the opening to build internal awareness and start foundational work like cryptographic inventory, which readies them if FINRA moves from encouraging dialogue to setting expectations.",{"title":8,"searchDepth":84,"depth":84,"links":7642},[7643],{"id":7620,"depth":84,"text":7621},"2023-10-30","FINRA asked securities firms in October 2023 to start a dialogue on post-quantum cryptography, framing it as research and awareness, not a new requirement.",[7647,7650,7653],{"q":7648,"a":7649},"What did FINRA ask of securities firms?","On 30 October 2023, FINRA asked securities firms to start a dialogue on post-quantum cryptography. It framed the request around research and awareness, encouraging firms to engage with the topic rather than imposing a new regulatory requirement.",{"q":7651,"a":7652},"Does FINRA's request create an obligation?","No. FINRA framed the move as research and awareness, so it creates no new requirement. It signals that the regulator is paying attention to quantum risk and expects firms to begin thinking about it, which often precedes firmer expectations.",{"q":7654,"a":7655},"Why start with dialogue rather than rules?","Starting with dialogue lets a regulator raise awareness and gather understanding before setting rules. For an emerging risk like quantum, that approach gives firms time to engage and gives the regulator insight into the sector's readiness before deciding on requirements.",[342],[227,100],{},"\u002Fnews\u002Ffinra-asks-securities-firms-start-dialogue",[7661],{"label":7662,"url":7663},"Financial Industry Regulatory Authority, \"Quantum computing and the implications for the securities industry,\" Oct. 30, 2023.","https:\u002F\u002Fwww.finra.org\u002F",[7665,7666],{"label":5712,"url":5713},{"label":1331,"url":1332},{"title":7615,"description":7645},"FINRA Asks Securities Firms to Start a PQC Dialogue","finra-asks-securities-firms-start-dialogue","news\u002Ffinra-asks-securities-firms-start-dialogue",[257,368,258,1078,260],"FINRA asked securities firms in October 2023 to start a dialogue on post-quantum cryptography, framing the move as research and awareness rather than a new requirement.","lEdzFZ4z_PpbYTbzYVJMqQrIjcakTySElab3hW6lN_w",{"id":7675,"title":815,"author":7,"authorTitle":8,"authorUrl":9,"body":7676,"canonical":9,"category":92,"date":7707,"description":7708,"draft":95,"extension":96,"faqs":7709,"findingsSource":9,"geo":7716,"image":417,"industries":7717,"keyFindings":9,"meta":7718,"modified":7719,"navigation":103,"path":816,"pullquote":9,"recommendations":9,"references":7720,"related":7727,"seo":7732,"seoTitle":6999,"signposts":9,"slug":7733,"stats":9,"stem":7734,"tags":7735,"tldr":7736,"__hash__":7737},"news\u002Fnews\u002Fcisa-nsa-nist-quantum-readiness-factsheet.md",{"type":11,"value":7677,"toc":7704},[7678,7682,7687,7690,7693,7696,7699],[14,7679,7681],{"id":7680},"cisa-nsa-and-nist-urge-organizations-to-start-quantum-readiness-planning","CISA, NSA and NIST urge organizations to start quantum-readiness planning",[19,7683,7684],{},[383,7685,7686],{},"21 AUGUST 2023, ARLINGTON",[19,7688,7689],{},"CISA, the NSA and NIST jointly published the factsheet \"Quantum-Readiness: Migration to Post-Quantum Cryptography.\" CISA's alert announcing it describes the audience as organizations in general, with particular emphasis on those that support critical infrastructure, and says they should begin early planning for migration to post-quantum cryptographic standards.",[19,7691,7692],{},"The alert lists four recommended actions: create a quantum-readiness roadmap, conduct a cryptographic inventory, perform risk assessment and analysis, and engage with technology vendors. Security Magazine, writing on 29 August 2023, adds that the factsheet advises assessing supply-chain reliance on quantum-vulnerable cryptography and reviewing NIST's draft standards, and notes that NIST planned to release the first set of post-quantum standards in 2024. The factsheet does not define a numbered phase model.",[19,7694,7695],{},"Technology owners across the public and private sectors are affected, with critical infrastructure operators named first. The factsheet carries no legal mandate; it is guidance.",[19,7697,7698],{},"The standards NIST promised arrived on 13 August 2024. The federal requirements that formalize several of these steps, for example inventory and roadmap duties, appear in the 2026 OMB memorandum and executive order covered in other entries.",[19,7700,7701,7703],{},[383,7702,399],{}," This is voluntary guidance, but it gives executives a simple four-step starting list: roadmap, inventory, risk assessment and vendor engagement. Later federal requirements formalized several of these steps, so organizations that follow the factsheet early should be better placed. Critical infrastructure operators should expect scrutiny of their progress.",{"title":8,"searchDepth":84,"depth":84,"links":7705},[7706],{"id":7680,"depth":84,"text":7681},"2023-08-21","CISA, the NSA and NIST urged organizations to begin post-quantum migration planning in 2023. The voluntary factsheet lists four starting actions.",[7710,7713],{"q":7711,"a":7712},"Is the factsheet binding?","No. It carries no legal mandate and is voluntary guidance. Later federal requirements, covered in the 2026 OMB memorandum and executive order, formalized several of its steps such as inventory and roadmap duties.",{"q":7714,"a":7715},"Who should act on it?","Technology owners across the public and private sectors, with critical infrastructure operators named first. Security leaders can use its four-step list, and the factsheet also advises assessing supply-chain reliance on quantum-vulnerable cryptography.",[98],[100,419],{},"2026-08-12",[7721,7724],{"label":7722,"url":7723},"Cybersecurity and Infrastructure Security Agency, \"CISA, NSA, and NIST Publish Factsheet on Quantum Readiness,\" CISA, Aug. 21, 2023.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2023\u002F08\u002F21\u002Fcisa-nsa-and-nist-publish-factsheet-quantum-readiness",{"label":7725,"url":7726},"Security Magazine, \"CISA publishes resource for migrating to post-quantum cryptography,\" Aug. 29, 2023.","https:\u002F\u002Fwww.securitymagazine.com\u002Farticles\u002F99833-cisa-publishes-resource-for-migrating-to-post-quantum-cryptography",[7728,7729],{"label":1072,"url":525},{"label":7730,"url":7731},"PQC Migration Roadmap for Enterprises","\u002Fblog\u002Fpqc-migration-roadmap",{"title":815,"description":7708},"cisa-nsa-nist-quantum-readiness-factsheet","news\u002Fcisa-nsa-nist-quantum-readiness-factsheet",[133,438,546,368,260],"CISA, the NSA and NIST urged organizations to begin post-quantum migration planning in 2023, and the voluntary factsheet lists four starting actions.","r6H3YLgrfiMeKShFM9re9gdsLhqHb41iXv0W0xu0FOs",{"id":7739,"title":3150,"author":7,"authorTitle":8,"authorUrl":9,"body":7740,"canonical":9,"category":92,"date":7768,"description":7769,"draft":95,"extension":96,"faqs":7770,"findingsSource":9,"geo":7780,"image":417,"industries":7781,"keyFindings":9,"meta":7782,"modified":7783,"navigation":103,"path":3151,"pullquote":9,"recommendations":9,"references":7784,"related":7787,"seo":7790,"seoTitle":7791,"signposts":9,"slug":7792,"stats":9,"stem":7793,"tags":7794,"tldr":7795,"__hash__":7796},"news\u002Fnews\u002Fsouth-korea-national-pqc-master-plan.md",{"type":11,"value":7741,"toc":7765},[7742,7746,7751,7754,7757,7760],[14,7743,7745],{"id":7744},"south-korea-plans-a-staged-national-post-quantum-master-plan","South Korea plans a staged national post-quantum master plan",[19,7747,7748],{},[383,7749,7750],{},"12 JULY 2023, SEOUL",[19,7752,7753],{},"South Korea announced a national post-quantum master plan on 12 July 2023, structured in stages. The plan calls for action plans in 2024, foundations by 2030, and full deployment by 2035. Sequencing the work this way lets groundwork precede the building of foundations, which in turn precedes deployment across government systems.",[19,7755,7756],{},"The 2030 foundations stage is the pivot. It focuses on the standards, infrastructure and preparatory work that deployment depends on, sitting between the early 2024 action plans and the final 2035 target. By carving out a dedicated foundations phase, the plan gives the country time to prepare rather than rushing straight from planning to deployment.",[19,7758,7759],{},"South Korea's timeline fits the international pattern. Its 2035 deployment target aligns with the horizon the United States, the European Union, the United Kingdom and Japan use, and its staged structure resembles the risk-based sequencing other jurisdictions have adopted. That alignment helps Korean organizations that operate internationally plan a single coherent transition.",[19,7761,7762,7764],{},[383,7763,399],{}," South Korea's master plan gives its public sector a clear, staged path to 2035, with a 2030 foundations milestone marking the halfway point. The alignment with other major jurisdictions means Korean organizations can plan against a timeline that matches their international peers. Agencies and suppliers can use the stages to pace their own cryptographic discovery and migration work.",{"title":8,"searchDepth":84,"depth":84,"links":7766},[7767],{"id":7744,"depth":84,"text":7745},"2023-07-12","South Korea set a staged national post-quantum master plan in July 2023: action plans in 2024, foundations by 2030 and deployment by 2035.",[7771,7774,7777],{"q":7772,"a":7773},"What are the stages of South Korea's plan?","The plan is staged: action plans in 2024, foundations by 2030, and deployment by 2035. Announced on 12 July 2023, it sequences the national transition so that groundwork precedes building foundations, which in turn precedes full deployment.",{"q":7775,"a":7776},"What does the 2030 foundations stage involve?","The 2030 stage focuses on building the foundations for migration, the standards, infrastructure and groundwork that deployment depends on. It sits between the 2024 action plans and the 2035 deployment target, giving the country time to prepare before the final push.",{"q":7778,"a":7779},"How does South Korea's timeline compare?","South Korea's 2035 deployment target aligns with the horizon used by the United States, the European Union, the United Kingdom and Japan. The staged structure, with a 2030 foundations milestone, resembles the risk-based sequencing other jurisdictions have adopted.",[3137],[419,100],{},"2026-08-14",[7785],{"label":7786,"url":3144},"Government of the Republic of Korea, \"National master plan for the transition to post-quantum cryptography,\" Jul. 12, 2023.",[7788,7789],{"label":3147,"url":3148},{"label":4543,"url":4530},{"title":3150,"description":7769},"South Korea Plans a National Post-Quantum Master Plan","south-korea-national-pqc-master-plan","news\u002Fsouth-korea-national-pqc-master-plan",[132,2157,1338,368,439],"South Korea set a staged national post-quantum master plan in July 2023, with action plans in 2024, foundations by 2030 and deployment by 2035.","DOrSL7qf3I2sdMUNr7bXzjKan_9foV7zPhTF0tXoL3E",{"id":7798,"title":5470,"author":7,"authorTitle":8,"authorUrl":9,"body":7799,"canonical":9,"category":92,"date":7827,"description":7828,"draft":95,"extension":96,"faqs":7829,"findingsSource":9,"geo":7839,"image":417,"industries":7840,"keyFindings":9,"meta":7841,"modified":7719,"navigation":103,"path":5471,"pullquote":9,"recommendations":9,"references":7842,"related":7846,"seo":7850,"seoTitle":7851,"signposts":9,"slug":7852,"stats":9,"stem":7853,"tags":7854,"tldr":7855,"__hash__":7856},"news\u002Fnews\u002Fcanada-cfdir-voluntary-pqc-guidance.md",{"type":11,"value":7800,"toc":7824},[7801,7805,7810,7813,7816,7819],[14,7802,7804],{"id":7803},"canadian-cfdir-issues-voluntary-post-quantum-guidance","Canadian CFDIR issues voluntary post-quantum guidance",[19,7806,7807],{},[383,7808,7809],{},"12 JUNE 2023, OTTAWA",[19,7811,7812],{},"Canada's financial-sector resiliency body, CFDIR, issued voluntary post-quantum guidance on 12 June 2023 and updated it on 31 July 2025. The guidance sets out a five-phase roadmap, advises firms to ask their vendors for post-quantum roadmaps, and tells firms to prioritise protecting data that must stay confidential for more than ten years.",[19,7814,7815],{},"The ten-year focus targets the clearest exposure. Data that must remain confidential for over a decade is the data most at risk from harvest-now-decrypt-later, where an adversary records encrypted data today and decrypts it once a quantum computer can break it. Protecting long-lived data first addresses the exposure that is already real, regardless of when a quantum computer arrives.",[19,7817,7818],{},"Asking vendors for roadmaps reflects how much firms depend on third parties. A firm's post-quantum readiness is only as strong as the readiness of the products it relies on, so requesting vendor roadmaps turns supply-chain exposure into a visible, manageable question rather than a hidden risk. The five-phase structure then gives firms an ordered path to follow.",[19,7820,7821,7823],{},[383,7822,399],{}," The CFDIR guidance gives Canadian financial firms a practical, voluntary roadmap and two concrete priorities: protect long-lived data and press vendors for their plans. Because it is voluntary, its value depends on firms adopting it, but its advice targets the real exposure that harvest-now-decrypt-later creates. Firms can start by inventorying data with a life beyond ten years and asking their key vendors for roadmaps.",{"title":8,"searchDepth":84,"depth":84,"links":7825},[7826],{"id":7803,"depth":84,"text":7804},"2023-06-12","Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data over ten years old.",[7830,7833,7836],{"q":7831,"a":7832},"What does the CFDIR guidance recommend?","The guidance, first issued on 12 June 2023 and updated on 31 July 2025, sets out a five-phase roadmap. It advises firms to ask their vendors for post-quantum roadmaps and to prioritise protecting data that must stay confidential for more than ten years.",{"q":7834,"a":7835},"Why focus on data with a life beyond ten years?","Data that must stay confidential for over a decade is most exposed to harvest-now-decrypt-later, where an adversary records it today and decrypts it once a quantum computer exists. Protecting long-lived data first targets the exposure that cannot wait for a quantum computer to arrive.",{"q":7837,"a":7838},"Is the CFDIR guidance mandatory?","No. The guidance is voluntary. It gives Canadian financial firms a shared roadmap and practical advice rather than imposing requirements, so firms can adopt it to coordinate their approach ahead of any binding rules.",[5460],[227,100],{},[7843],{"label":7844,"url":7845},"Canadian Financial Sector Resiliency Group \u002F CFDIR, \"Post-quantum cryptography guidance for the financial sector,\" Jun. 12, 2023; updated Jul. 31, 2025.","https:\u002F\u002Fwww.bankofcanada.ca\u002F",[7847,7849],{"label":7848,"url":5463},"Canada's Federal Migration Roadmap Sets 2031 and 2035 Deadlines",{"label":1331,"url":1332},{"title":5470,"description":7828},"Canadian CFDIR Issues Voluntary PQC Guidance","canada-cfdir-voluntary-pqc-guidance","news\u002Fcanada-cfdir-voluntary-pqc-guidance",[257,132,759,259,260],"Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data with a life beyond ten years.","BYEjdRK3lN40wb4PvdzRXFCKNddhW_r3-OSozpPSI5c",{"id":7858,"title":7859,"author":7,"authorTitle":8,"authorUrl":9,"body":7860,"canonical":9,"category":92,"date":7888,"description":7889,"draft":95,"extension":96,"faqs":7890,"findingsSource":9,"geo":7900,"image":417,"industries":7901,"keyFindings":9,"meta":7902,"modified":7783,"navigation":103,"path":7903,"pullquote":9,"recommendations":9,"references":7904,"related":7908,"seo":7911,"seoTitle":7912,"signposts":9,"slug":7913,"stats":9,"stem":7914,"tags":7915,"tldr":7916,"__hash__":7917},"news\u002Fnews\u002Findia-national-quantum-mission.md","India's National Quantum Mission Funds Quantum Capability, Not Migration",{"type":11,"value":7861,"toc":7885},[7862,7866,7871,7874,7877,7880],[14,7863,7865],{"id":7864},"indias-national-quantum-mission-funds-quantum-capability-not-migration","India's National Quantum Mission funds quantum capability, not migration",[19,7867,7868],{},[383,7869,7870],{},"19 APRIL 2023, NEW DELHI",[19,7872,7873],{},"India launched its National Quantum Mission on 19 April 2023 to fund the development of quantum technology capability. The mission invests in building India's quantum science and industry. It is not an instrument that directs organizations to migrate to post-quantum cryptography, so it should not be read as a migration mandate.",[19,7875,7876],{},"The distinction is worth drawing clearly. The mission funds quantum capability, while India's dated migration expectations come from other instruments, such as the 2026 task force report that set critical-infrastructure deadlines. Treating the National Quantum Mission as a migration rule would misattribute what it does and overlook where the actual deadlines originate.",[19,7878,7879],{},"Capability building and migration serve different goals. One develops the science and industry that let a country participate in quantum technology; the other protects existing systems against the threat quantum computers pose. Both matter, but conflating them would misread India's posture, where investment in quantum technology sits alongside separate, later steps on cryptographic migration.",[19,7881,7882,7884],{},[383,7883,399],{}," The National Quantum Mission shows India investing in quantum technology as a national capability, distinct from its post-quantum migration policy. Organizations tracking India's requirements should look to the task force deadlines and MeitY and CERT-In guidance for migration obligations, not to the mission. Understanding the difference clarifies what India requires of organizations today versus what it is building for the longer term.",{"title":8,"searchDepth":84,"depth":84,"links":7886},[7887],{"id":7864,"depth":84,"text":7865},"2023-04-19","India's National Quantum Mission, launched in April 2023, funds quantum technology capability rather than directing post-quantum cryptography migration.",[7891,7894,7897],{"q":7892,"a":7893},"What is India's National Quantum Mission?","Launched on 19 April 2023, the National Quantum Mission funds the development of quantum technology capability in India. It is an investment in building quantum science and industry, not an instrument directing organizations to migrate to post-quantum cryptography.",{"q":7895,"a":7896},"Does the mission require post-quantum migration?","No. The mission funds quantum capability rather than mandating migration. India's dated migration expectations come from other instruments, such as the 2026 task force report on critical infrastructure, not from the National Quantum Mission.",{"q":7898,"a":7899},"Why distinguish capability funding from migration?","Building quantum technology and migrating to post-quantum cryptography are different goals. One develops the science and industry; the other protects systems against quantum attack. Confusing them would misread what the mission does, so the distinction matters for understanding India's posture.",[3650],[419,228],{},"\u002Fnews\u002Findia-national-quantum-mission",[7905],{"label":7906,"url":7907},"Government of India, \"National Quantum Mission,\" approved Apr. 19, 2023.","https:\u002F\u002Fdst.gov.in\u002Fnational-quantum-mission",[7909,7910],{"label":5288,"url":3723},{"label":1651,"url":1652},{"title":7859,"description":7889},"India's National Quantum Mission Funds Capability","india-national-quantum-mission","news\u002Findia-national-quantum-mission",[368,2862,1078,258,439],"India's National Quantum Mission, launched in April 2023, funds the development of quantum technology capability rather than directing any post-quantum cryptography migration for organizations.","5KcHzNEzTiYAgdHu07NkDcVGovC4_YipR7FF7hMaSC8",{"id":7919,"title":7920,"author":7,"authorTitle":8,"authorUrl":9,"body":7921,"canonical":9,"category":92,"date":7949,"description":7950,"draft":95,"extension":96,"faqs":7951,"findingsSource":9,"geo":7961,"image":417,"industries":7962,"keyFindings":9,"meta":7963,"modified":7053,"navigation":103,"path":7964,"pullquote":9,"recommendations":9,"references":7965,"related":7968,"seo":7971,"seoTitle":7972,"signposts":9,"slug":7973,"stats":9,"stem":7974,"tags":7975,"tldr":7976,"__hash__":7977},"news\u002Fnews\u002Fcayman-cybersecurity-rule-update-vasps.md","Cayman Extends Its Cybersecurity Rule to Virtual Asset Service Providers",{"type":11,"value":7922,"toc":7946},[7923,7927,7932,7935,7938,7941],[14,7924,7926],{"id":7925},"cayman-extends-its-cybersecurity-rule-to-virtual-asset-service-providers","Cayman extends its cybersecurity rule to virtual asset service providers",[19,7928,7929],{},[383,7930,7931],{},"14 APRIL 2023, GEORGE TOWN",[19,7933,7934],{},"The Cayman Islands extended its cybersecurity rule to virtual asset service providers on 14 April 2023. The move brought VASPs under the same cybersecurity expectations as other regulated entities, broadening the rule's scope to cover the digital asset sector. It signalled that the jurisdiction treats virtual asset businesses as subject to the same baseline security obligations.",[19,7936,7937],{},"Extending a rule is a beginning rather than an end. A 2025 review found gaps that remained to be addressed, which shows supervisors expect to refine expectations as they see how firms implement them. The review turned the initial extension into an ongoing process of tightening, rather than a one-time change that settled the matter.",[19,7939,7940],{},"Cybersecurity obligations connect naturally to quantum risk. The rule covers the protection of systems and data, which depends on cryptography, so quantum-vulnerable algorithms fall within its concern as the threat grows. VASPs under the rule have a basis to treat quantum risk as part of the cybersecurity obligations they already must meet.",[19,7942,7943,7945],{},[383,7944,399],{}," Cayman's extension of its cybersecurity rule to VASPs placed digital asset firms under a recognised security baseline, and the 2025 review shows the regulator intends to keep refining it. Because the rule covers the cryptography protecting systems and data, it gives quantum risk a home among existing obligations. VASPs can address quantum readiness as part of meeting a cybersecurity rule that already applies to them.",{"title":8,"searchDepth":84,"depth":84,"links":7947},[7948],{"id":7925,"depth":84,"text":7926},"2023-04-14","The Cayman Islands extended its cybersecurity rule to virtual asset service providers in April 2023; a 2025 review found gaps still to be addressed.",[7952,7955,7958],{"q":7953,"a":7954},"What did Cayman's 2023 cybersecurity update do?","On 14 April 2023, the Cayman Islands extended its cybersecurity rule to cover virtual asset service providers. That brought VASPs under the same cybersecurity expectations as other regulated entities, broadening the rule's scope to the digital asset sector.",{"q":7956,"a":7957},"What did the 2025 review find?","A 2025 review found gaps that remained to be addressed. The finding shows that extending a rule to a new sector is a starting point, and that supervisors expect to refine expectations as they see how firms implement them in practice.",{"q":7959,"a":7960},"How does this connect to quantum readiness?","Cybersecurity rules cover the protection of systems and data, which depends on cryptography. As quantum-vulnerable algorithms become a concern, VASPs under the rule have a basis to treat quantum risk as part of the cybersecurity obligations they must meet.",[5824],[227,100],{},"\u002Fnews\u002Fcayman-cybersecurity-rule-update-vasps",[7966],{"label":7967,"url":5830},"Cayman Islands Monetary Authority, \"Rule and Statement of Guidance on Cybersecurity for Regulated Entities,\" Apr. 14, 2023.",[7969,7970],{"label":2214,"url":2215},{"label":2162,"url":2207},{"title":7920,"description":7950},"Cayman Extends Its Cybersecurity Rule to VASPs","cayman-cybersecurity-rule-update-vasps","news\u002Fcayman-cybersecurity-rule-update-vasps",[256,257,134,368,260],"The Cayman Islands extended its cybersecurity rule to virtual asset service providers in April 2023, and a 2025 review found gaps that remained to be addressed.","o-1CJUzeouoKN5xLqxVCuc1Al57Imk2lnfaSGXROas4",{"id":7979,"title":7980,"author":7,"authorTitle":8,"authorUrl":9,"body":7981,"canonical":9,"category":92,"date":8009,"description":8010,"draft":95,"extension":96,"faqs":8011,"findingsSource":9,"geo":8021,"image":417,"industries":8022,"keyFindings":9,"meta":8023,"modified":8024,"navigation":103,"path":8025,"pullquote":9,"recommendations":9,"references":8026,"related":8030,"seo":8033,"seoTitle":8034,"signposts":9,"slug":8035,"stats":9,"stem":8036,"tags":8037,"tldr":8038,"__hash__":8039},"news\u002Fnews\u002Faustralia-soci-act-risk-programs-silent-on-quantum.md","Australia's SOCI Act Requires Risk Programs but Stays Silent on Quantum",{"type":11,"value":7982,"toc":8006},[7983,7987,7992,7995,7998,8001],[14,7984,7986],{"id":7985},"australias-soci-act-requires-risk-programs-but-stays-silent-on-quantum","Australia's SOCI Act requires risk programs but stays silent on quantum",[19,7988,7989],{},[383,7990,7991],{},"16 FEBRUARY 2023, CANBERRA",[19,7993,7994],{},"Australia's Security of Critical Infrastructure Act requires responsible entities to maintain risk management programs for critical infrastructure, with the relevant obligations commencing on 16 February 2023. The Act does not mention quantum. It imposes a broad duty to manage risk rather than naming specific threats, so there is no quantum-specific requirement in its text.",[19,7996,7997],{},"That broad duty is where quantum risk enters. Because the Act requires entities to manage risks to critical infrastructure, cryptographic and quantum risk can fall within those general obligations even without being named. An entity's risk program should account for threats to the cryptography its systems depend on, since a failure of that cryptography would threaten the infrastructure the Act protects.",[19,7999,8000],{},"The silence on quantum is therefore not an exemption. A risk management obligation is broad by design, so an emerging threat to critical infrastructure cryptography sits within it. Entities that read the Act's silence as permission to ignore quantum would misjudge how a general duty applies to a specific and growing risk.",[19,8002,8003,8005],{},[383,8004,399],{}," The SOCI Act shows how quantum risk can bind critical infrastructure operators even without a dedicated rule: a general risk-management duty already covers it. Australian entities under the Act should fold quantum into their risk programs rather than wait for the Act to name it. Doing so also prepares them for sector supervisors, such as APRA, who are already making quantum expectations explicit.",{"title":8,"searchDepth":84,"depth":84,"links":8007},[8008],{"id":7985,"depth":84,"text":7986},"2023-02-16","Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but stays silent on quantum, so cryptographic risk enters via general duties.",[8012,8015,8018],{"q":8013,"a":8014},"What does the SOCI Act require?","The Security of Critical Infrastructure Act requires responsible entities to maintain risk management programs for critical infrastructure, with the relevant obligations commencing on 16 February 2023. The Act does not mention quantum, so it imposes no quantum-specific duty.",{"q":8016,"a":8017},"How does quantum risk fit under the SOCI Act?","Because the Act requires entities to manage risks to critical infrastructure, cryptographic and quantum risk can fall within those general duties even though the Act never names quantum. An entity's risk program should account for threats to the cryptography its systems depend on.",{"q":8019,"a":8020},"Does silence on quantum mean entities can ignore it?","No. A risk management obligation is broad by design, so an emerging threat to critical infrastructure cryptography sits within it. Entities should treat quantum as one of the risks their program must consider, rather than reading the Act's silence as an exemption.",[1506],[419,100],{},"2026-08-17","\u002Fnews\u002Faustralia-soci-act-risk-programs-silent-on-quantum",[8027],{"label":8028,"url":8029},"Government of Australia, \"Security of Critical Infrastructure Act: risk management program obligations,\" commenced Feb. 16, 2023.","https:\u002F\u002Fwww.cisc.gov.au\u002F",[8031,8032],{"label":5106,"url":2273},{"label":5103,"url":5104},{"title":7980,"description":8010},"Australia's SOCI Act Requires Risk Programs","australia-soci-act-risk-programs-silent-on-quantum","news\u002Faustralia-soci-act-risk-programs-silent-on-quantum",[546,134,368,258,439],"Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but does not mention quantum, so cryptographic risk enters through its general duties.","SH8n7KPSP9XtHE5YZFdu74WbSJ70v7ubCnA1P1l9ySs",{"id":8041,"title":8042,"author":7,"authorTitle":8,"authorUrl":9,"body":8043,"canonical":9,"category":92,"date":8071,"description":8072,"draft":95,"extension":96,"faqs":8073,"findingsSource":9,"geo":8083,"image":417,"industries":8084,"keyFindings":9,"meta":8085,"modified":7173,"navigation":103,"path":8086,"pullquote":9,"recommendations":9,"references":8087,"related":8091,"seo":8096,"seoTitle":8097,"signposts":9,"slug":8098,"stats":9,"stem":8099,"tags":8100,"tldr":8101,"__hash__":8102},"news\u002Fnews\u002Fus-quantum-computing-cybersecurity-preparedness-act-2022.md","US Quantum Computing Cybersecurity Preparedness Act Requires Federal Inventories",{"type":11,"value":8044,"toc":8068},[8045,8049,8054,8057,8060,8063],[14,8046,8048],{"id":8047},"us-quantum-computing-cybersecurity-preparedness-act-requires-federal-inventories","US Quantum Computing Cybersecurity Preparedness Act requires federal inventories",[19,8050,8051],{},[383,8052,8053],{},"21 DECEMBER 2022, WASHINGTON",[19,8055,8056],{},"The Quantum Computing Cybersecurity Preparedness Act, signed on 21 December 2022, requires federal agencies to inventory their quantum-vulnerable systems and plan migration to post-quantum cryptography. By placing these duties in legislation, Congress made them a matter of law rather than guidance, so agencies must carry them out rather than treat them as optional.",[19,8058,8059],{},"The Act works alongside NSM-10. The national security memorandum sets executive-branch policy, while the Act gives the inventory and migration duties statutory backing from Congress. The two reinforce each other, pushing federal agencies toward the same inventory-first approach from both the executive and legislative directions.",[19,8061,8062],{},"Requiring inventory first reflects the logic of migration. An agency cannot migrate systems it has not identified, so finding its quantum-vulnerable systems is the necessary starting point. By mandating that step, the Act lays the groundwork for the migration planning that follows and that later instruments, such as the 2026 OMB memorandum, build on.",[19,8064,8065,8067],{},[383,8066,399],{}," The Act turned federal post-quantum preparation into a legal requirement in 2022, well before the standards were final, by mandating inventory and migration planning. It gave the executive branch's policy goals statutory weight and set the inventory-first pattern that later federal rules continue. Agencies and their suppliers can trace today's deadlines back to the duties this Act established.",{"title":8,"searchDepth":84,"depth":84,"links":8069},[8070],{"id":8047,"depth":84,"text":8048},"2022-12-21","The US Quantum Computing Cybersecurity Preparedness Act of 2022 requires federal agencies to inventory quantum-vulnerable systems and plan post-quantum migration.",[8074,8077,8080],{"q":8075,"a":8076},"What does the Act require?","The Quantum Computing Cybersecurity Preparedness Act of 2022 requires federal agencies to inventory their quantum-vulnerable systems and plan migration to post-quantum cryptography. It makes those duties a matter of law rather than guidance, so agencies must carry them out.",{"q":8078,"a":8079},"How does the Act differ from NSM-10?","NSM-10 is a national security memorandum setting executive-branch policy, while the Act is legislation passed by Congress. The two reinforce each other: both push federal inventory and migration, with the Act giving the duties statutory backing.",{"q":8081,"a":8082},"Why does an inventory requirement come first?","An agency cannot migrate systems it has not identified, so inventory is the necessary first step. By requiring agencies to find their quantum-vulnerable systems, the Act lays the groundwork for the migration planning that follows.",[342],[419,100],{},"\u002Fnews\u002Fus-quantum-computing-cybersecurity-preparedness-act-2022",[8088],{"label":8089,"url":8090},"U.S. Congress, \"Quantum Computing Cybersecurity Preparedness Act,\" Public Law 117-260, Dec. 21, 2022.","https:\u002F\u002Fwww.congress.gov\u002Fbill\u002F117th-congress\u002Fhouse-bill\u002F7535",[8092,8094],{"label":8093,"url":6816},"National Security Memorandum 10 Sets a 2035 Quantum-Resistant Goal",{"label":8095,"url":2352},"OMB M-23-02 Orders Agencies to Inventory Quantum-Vulnerable Cryptography",{"title":8042,"description":8072},"US Quantum Computing Cybersecurity Prep Act 2022","us-quantum-computing-cybersecurity-preparedness-act-2022","news\u002Fus-quantum-computing-cybersecurity-preparedness-act-2022",[134,133,132,6824,439],"The US Quantum Computing Cybersecurity Preparedness Act of 2022 requires federal agencies to inventory quantum-vulnerable systems and plan migration to post-quantum cryptography.","LVy6lm-2uQ5_SB_2A-KBUXkRlzhgQLO_PEsi7YwRlpY",{"id":8104,"title":8105,"author":7,"authorTitle":8,"authorUrl":9,"body":8106,"canonical":9,"category":92,"date":8137,"description":8138,"draft":95,"extension":96,"faqs":8139,"findingsSource":9,"geo":8146,"image":417,"industries":8147,"keyFindings":9,"meta":8148,"modified":987,"navigation":103,"path":2352,"pullquote":9,"recommendations":9,"references":8149,"related":8153,"seo":8156,"seoTitle":2351,"signposts":9,"slug":8157,"stats":9,"stem":8158,"tags":8159,"tldr":8160,"__hash__":8161},"news\u002Fnews\u002Fomb-m-23-02-inventory-quantum-vulnerable-cryptography.md","OMB Orders Federal Agencies to Inventory Quantum-Vulnerable Cryptography",{"type":11,"value":8107,"toc":8134},[8108,8112,8117,8120,8123,8126,8129],[14,8109,8111],{"id":8110},"omb-orders-federal-agencies-to-inventory-quantum-vulnerable-cryptography","OMB orders federal agencies to inventory quantum-vulnerable cryptography",[19,8113,8114],{},[383,8115,8116],{},"18 NOVEMBER 2022, WASHINGTON",[19,8118,8119],{},"The Office of Management and Budget issued memorandum M-23-02, \"Migrating to Post-Quantum Cryptography.\" Its stated authority is National Security Memorandum 10, issued on 4 May 2022. The memorandum applies to federal executive agencies and excludes national security systems.",[19,8121,8122],{},"Agencies must inventory cryptographic systems vulnerable to quantum computers, focusing on high-impact systems and high-value assets. The inventory must describe each system's algorithms, key lengths, vendors, hosting arrangements and data lifecycle, and agencies must assess the funding needed to transition.",[19,8124,8125],{},"Deadlines include 30 days to designate an inventory and migration lead, 90 days for the Office of the National Cyber Director to release collection instructions, a first inventory due 4 May 2023 and annually after that, and, within a year, a CISA strategy for automated assessment tools. The target for completing migration is 2035.",[19,8127,8128],{},"The stated objective is to prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography before future quantum computers can compromise currently encrypted federal data.",[19,8130,8131,8133],{},[383,8132,399],{}," This memorandum is a binding instruction to federal agencies, and it set the template for inventory work: which algorithms, which keys, which vendors, which hosting, and what data lifecycle. Vendors serving agencies should expect customers to ask for exactly this information. Other organizations can use the same fields as a reasonable model for their own inventory.",{"title":8,"searchDepth":84,"depth":84,"links":8135},[8136],{"id":8110,"depth":84,"text":8111},"2022-11-18","OMB M-23-02 requires federal agencies to inventory quantum-vulnerable cryptography annually from 4 May 2023. Vendors should expect inventory requests.",[8140,8143],{"q":8141,"a":8142},"What must the inventory describe?","Each system's algorithms, key lengths, vendors, hosting arrangements and data lifecycle, and agencies must assess the funding needed to transition. Vendors serving agencies should expect customers to request exactly this information.",{"q":8144,"a":8145},"Is the memorandum binding?","Yes for federal executive agencies, as an OMB instruction, though it excludes national security systems. Other organizations are not bound but can use the same inventory fields as a model for their own work.",[342],[100,419],{},[8150],{"label":8151,"url":8152},"Office of Management and Budget, \"M-23-02, Migrating to Post-Quantum Cryptography,\" The White House, Nov. 18, 2022.","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2022\u002F11\u002FM-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf",[8154,8155],{"label":6815,"url":6816},{"label":2354,"url":2336},{"title":8105,"description":8138},"omb-m-23-02-inventory-quantum-vulnerable-cryptography","news\u002Fomb-m-23-02-inventory-quantum-vulnerable-cryptography",[133,438,6824,2157,134],"OMB M-23-02 requires federal agencies to inventory quantum-vulnerable cryptography annually from 4 May 2023, so vendors should expect inventory requests.","kOaPkmbAhvDH3HtNojus3gu2AOJQ1Irsko42LXJEZtU",{"id":8163,"title":8164,"author":7,"authorTitle":8,"authorUrl":9,"body":8165,"canonical":9,"category":92,"date":8193,"description":8194,"draft":95,"extension":96,"faqs":8195,"findingsSource":9,"geo":8205,"image":417,"industries":8206,"keyFindings":9,"meta":8207,"modified":8208,"navigation":103,"path":8209,"pullquote":9,"recommendations":9,"references":8210,"related":8214,"seo":8217,"seoTitle":8218,"signposts":9,"slug":8219,"stats":9,"stem":8220,"tags":8221,"tldr":8222,"__hash__":8223},"news\u002Fnews\u002Fiso-27001-no-pqc-requirements.md","ISO 27001 Has No Post-Quantum Requirements but Its Crypto Control Still Applies",{"type":11,"value":8166,"toc":8190},[8167,8171,8176,8179,8182,8185],[14,8168,8170],{"id":8169},"iso-27001-has-no-post-quantum-requirements-but-its-crypto-control-still-applies","ISO 27001 has no post-quantum requirements but its crypto control still applies",[19,8172,8173],{},[383,8174,8175],{},"25 OCTOBER 2022, GENEVA",[19,8177,8178],{},"The 2022 edition of ISO 27001, the widely used information security management standard, sets no post-quantum requirements. Its cryptography control is technology-neutral: it requires organizations to manage cryptographic risk without naming specific algorithms or mandating a post-quantum transition. The standard addresses cryptography in principle rather than prescribing particular technology.",[19,8180,8181],{},"That technology-neutral framing still touches quantum. A control that requires appropriate cryptography, without specifying which algorithms, expects an organization to account for the risks its cryptography faces. As the quantum threat grows, an organization meeting the control in good faith should weigh that risk, so the control can pull in quantum considerations even though it never names them.",[19,8183,8184],{},"The implication reaches into audits. Because the control requires managing cryptographic risk, an auditor or an organization applying the standard thoughtfully may treat quantum as part of that risk. The standard does not force the point, but its risk-based framing leaves room for it, which means ISO 27001 is not silent on quantum so much as indirect about it.",[19,8186,8187,8189],{},[383,8188,399],{}," ISO 27001 imposes no post-quantum mandate, yet its technology-neutral cryptography control gives organizations a reason to consider quantum risk as part of managing their cryptography. Organizations certified to the standard should not assume it exempts them from quantum concerns. Treating quantum as one of the cryptographic risks the control covers keeps an organization's risk management current as the threat develops.",{"title":8,"searchDepth":84,"depth":84,"links":8191},[8192],{"id":8169,"depth":84,"text":8170},"2022-10-25","The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges managing cryptographic risk.",[8196,8199,8202],{"q":8197,"a":8198},"Does ISO 27001 require post-quantum cryptography?","No. The 2022 edition of ISO 27001 sets no post-quantum requirements. Its cryptography control is technology-neutral, so it requires organizations to manage cryptographic risk without naming specific algorithms or mandating a post-quantum transition.",{"q":8200,"a":8201},"How does a technology-neutral control relate to quantum?","A technology-neutral control requires appropriate cryptography without specifying which algorithms. As the quantum threat grows, an organization meeting the control in good faith should account for that risk, so the control can pull in quantum considerations without naming them.",{"q":8203,"a":8204},"Can an ISO 27001 audit raise quantum concerns?","Potentially. Because the control requires managing cryptographic risk, an auditor or an organization applying the standard thoughtfully may treat quantum as part of that risk. The standard does not force it, but its risk-based framing leaves room for it.",[6504],[228,100],{},"2026-08-10","\u002Fnews\u002Fiso-27001-no-pqc-requirements",[8211],{"label":8212,"url":8213},"International Organization for Standardization, \"ISO\u002FIEC 27001:2022 Information security management systems,\" Oct. 25, 2022.","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001",[8215,8216],{"label":6463,"url":6508},{"label":4665,"url":4666},{"title":8164,"description":8194},"ISO 27001 Has No Post-Quantum Requirements","iso-27001-no-pqc-requirements","news\u002Fiso-27001-no-pqc-requirements",[134,368,549,258,260],"The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges organizations to manage cryptographic risk.","-GaZE_t5Bm00ul1XHP78cd_xK2JHcd0b9rsyY-oBw-Q",{"id":8225,"title":4601,"author":7,"authorTitle":8,"authorUrl":9,"body":8226,"canonical":9,"category":92,"date":8254,"description":8255,"draft":95,"extension":96,"faqs":8256,"findingsSource":9,"geo":8266,"image":417,"industries":8268,"keyFindings":9,"meta":8269,"modified":7783,"navigation":103,"path":4602,"pullquote":9,"recommendations":9,"references":8270,"related":8274,"seo":8278,"seoTitle":8279,"signposts":9,"slug":8280,"stats":9,"stem":8281,"tags":8282,"tldr":8283,"__hash__":8284},"news\u002Fnews\u002Feu-backed-caribbean-cyber-training-centre-lac4.md",{"type":11,"value":8227,"toc":8251},[8228,8232,8237,8240,8243,8246],[14,8229,8231],{"id":8230},"eu-backed-caribbean-cyber-training-centre-lac4-serves-27-countries","EU-backed Caribbean cyber training centre LAC4 serves 27 countries",[19,8233,8234],{},[383,8235,8236],{},"26 MAY 2022, SANTO DOMINGO",[19,8238,8239],{},"The EU-backed Latin America and Caribbean Cyber Competence Centre, LAC4, launched on 26 May 2022 and serves 27 member countries. It builds cyber skills across the region through training and capacity development. While LAC4 is not quantum-specific, the capacity it creates matters for how the region will handle emerging risks, including quantum.",[19,8241,8242],{},"Skills are the link to quantum readiness. Post-quantum migration demands skilled people, and that expertise is scarce in every region. A centre that raises regional cyber competence builds the human capacity that quantum readiness will draw on, so investment in general cyber skills today supports the specialised work migration will require tomorrow.",[19,8244,8245],{},"Regional capacity is what makes LAC4 effective. Smaller countries often lack the resources to build cyber expertise on their own, so a shared centre serving 27 countries pools effort and spreads skills more widely than any single nation could manage. That collective model strengthens the whole region's ability to respond to risks that no member could fully address alone.",[19,8247,8248,8250],{},[383,8249,399],{}," LAC4 builds the regional cyber skills base that underpins any future quantum work in Latin America and the Caribbean. It does not address quantum directly, but post-quantum migration cannot happen without skilled people, and the centre develops exactly that capacity across 27 countries. The region's quantum readiness will rest in part on the foundation that shared training institutions like LAC4 provide.",{"title":8,"searchDepth":84,"depth":84,"links":8252},[8253],{"id":8230,"depth":84,"text":8231},"2022-05-26","The EU-backed LAC4 cyber training centre, launched in 2022, serves 27 member countries, building regional cyber skills that underpin quantum readiness.",[8257,8260,8263],{"q":8258,"a":8259},"What is LAC4?","LAC4 is the Latin America and Caribbean Cyber Competence Centre, an EU-backed cyber training centre launched on 26 May 2022. It serves 27 member countries, building cyber skills across the region through training and capacity development.",{"q":8261,"a":8262},"How does cyber training relate to quantum readiness?","Post-quantum migration demands skilled people, and skills are scarce everywhere. A training centre that raises regional cyber competence builds the human capacity that quantum readiness will draw on, even though LAC4 is not quantum-specific.",{"q":8264,"a":8265},"Why does regional capacity matter?","Smaller countries often lack the resources to build cyber expertise alone. A shared centre serving 27 countries pools effort and spreads skills more widely than any single nation could, strengthening the region's collective ability to handle emerging risks like quantum.",[8267],"santo-domingo",[419,100],{},[8271],{"label":8272,"url":8273},"European Union, \"Latin America and Caribbean Cyber Competence Centre (LAC4),\" launched May 26, 2022.","https:\u002F\u002Fwww.lac4.eu\u002F",[8275,8276],{"label":4352,"url":4353},{"label":8277,"url":4222},"African Consortium Issues a Post-Quantum Readiness Paper and Forms an Alliance",{"title":4601,"description":8255},"EU-Backed Caribbean Cyber Training Centre LAC4","eu-backed-caribbean-cyber-training-centre-lac4","news\u002Feu-backed-caribbean-cyber-training-centre-lac4",[368,546,1078,132,439],"The EU-backed LAC4 cyber training centre, launched in May 2022, serves 27 member countries, building the regional cyber skills that underpin future quantum readiness.","tDKlCrenVUuXm5VBAZ4KBlHkLCV9_pHK6maiDc_FCjA",{"id":8286,"title":8287,"author":7,"authorTitle":8,"authorUrl":9,"body":8288,"canonical":9,"category":92,"date":8319,"description":8320,"draft":95,"extension":96,"faqs":8321,"findingsSource":9,"geo":8328,"image":417,"industries":8329,"keyFindings":9,"meta":8330,"modified":8208,"navigation":103,"path":6816,"pullquote":9,"recommendations":9,"references":8331,"related":8335,"seo":8338,"seoTitle":8339,"signposts":9,"slug":8340,"stats":9,"stem":8341,"tags":8342,"tldr":8343,"__hash__":8344},"news\u002Fnews\u002Fnational-security-memorandum-10-2035-quantum-resistant-goal.md","The 2022 National Security Memorandum Set a 2035 Goal for Quantum-Resistant Cryptography",{"type":11,"value":8289,"toc":8316},[8290,8294,8299,8302,8305,8308,8311],[14,8291,8293],{"id":8292},"_2022-national-security-memorandum-set-2035-goal-for-quantum-resistant-cryptography","2022 national security memorandum set 2035 goal for quantum-resistant cryptography",[19,8295,8296],{},[383,8297,8298],{},"4 MAY 2022, WASHINGTON",[19,8300,8301],{},"The White House issued National Security Memorandum 10 under the title \"Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems.\" It has two goals, in the archived White House text: maintain US leadership in quantum information science, and mitigate risks from a cryptanalytically relevant quantum computer, meaning one powerful enough to break current cryptography. It states that such a machine would be capable of breaking much of the public-key cryptography used on digital systems across the United States. The memorandum sets a goal of transitioning vulnerable cryptographic systems to quantum-resistant cryptography by 2035.",[19,8303,8304],{},"It lists taskings. Within 90 days, agencies set up quantum information science liaisons, NIST starts an industry working group on quantum-resistant adoption and establishes a Post-Quantum Cryptography Migration Project. Within 180 days, CISA engages critical infrastructure partners and OMB sets cryptographic inventory requirements. Within a year, federal agencies submit inventories of vulnerable IT systems. By 31 December 2023, Defense assesses quantum risk to the industrial base and the NSA implements symmetric-key protections for national security systems.",[19,8306,8307],{},"The memorandum's own scope reaches federal civilian agencies, national security system operators, critical infrastructure owners and operators, the private sector, academia, and state, local and tribal governments.",[19,8309,8310],{},"OMB turned the inventory tasking into memorandum M-23-02 in November 2022.",[19,8312,8313,8315],{},[383,8314,399],{}," This memorandum is the origin of the 2035 target that later federal documents repeat. Its explicit reach to critical infrastructure and the private sector suggests that organizations outside government should treat 2035 as a planning anchor. Its taskings also show the sequence organizations should expect: inventories first, then migration.",{"title":8,"searchDepth":84,"depth":84,"links":8317},[8318],{"id":8292,"depth":84,"text":8293},"2022-05-04","The 2022 National Security Memorandum 10 set a 2035 goal for moving vulnerable systems to quantum-resistant cryptography. Later federal papers repeat it.",[8322,8325],{"q":8323,"a":8324},"What taskings did the memorandum include?","Within 90 days NIST starts a migration project, within 180 days OMB sets inventory requirements, and within a year agencies submit inventories of vulnerable systems. Defense and the NSA had tasks due by 31 December 2023.",{"q":8326,"a":8327},"Why does it matter outside government?","It is the origin of the 2035 target later federal documents repeat, and it explicitly reaches critical infrastructure and the private sector. Organizations outside government can treat 2035 as a planning anchor and start with inventories.",[342],[100,419],{},[8332],{"label":8333,"url":8334},"The White House (archived), \"National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems,\" May 4, 2022.","https:\u002F\u002Fbidenwhitehouse.archives.gov\u002Fbriefing-room\u002Fstatements-releases\u002F2022\u002F05\u002F04\u002Fnational-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems",[8336,8337],{"label":2351,"url":2352},{"label":2349,"url":124},{"title":8287,"description":8320},"NSM-10 Sets a 2035 Quantum-Resistant Goal","national-security-memorandum-10-2035-quantum-resistant-goal","news\u002Fnational-security-memorandum-10-2035-quantum-resistant-goal",[6824,438,2157,133,134],"National Security Memorandum 10 set a 2035 goal for moving vulnerable systems to quantum-resistant cryptography, and later federal papers repeat it.","lbqZpsFc3XW-jx8YKxF8gd2El9o4fN0jbDIBBafnP8U",{"id":8346,"title":3921,"author":7,"authorTitle":8,"authorUrl":9,"body":8347,"canonical":9,"category":92,"date":8375,"description":8376,"draft":95,"extension":96,"faqs":8377,"findingsSource":9,"geo":8387,"image":417,"industries":8388,"keyFindings":9,"meta":8389,"modified":7719,"navigation":103,"path":3922,"pullquote":9,"recommendations":9,"references":8390,"related":8394,"seo":8397,"seoTitle":8398,"signposts":9,"slug":8399,"stats":9,"stem":8400,"tags":8401,"tldr":8402,"__hash__":8403},"news\u002Fnews\u002Ffrance-anssi-phased-hybrid-path.md",{"type":11,"value":8348,"toc":8372},[8349,8353,8358,8361,8364,8367],[14,8350,8352],{"id":8351},"frances-anssi-sets-a-phased-hybrid-path-to-post-quantum-cryptography","France's ANSSI sets a phased hybrid path to post-quantum cryptography",[19,8354,8355],{},[383,8356,8357],{},"4 JANUARY 2022, PARIS",[19,8359,8360],{},"France's cybersecurity agency, ANSSI, set out its post-quantum views on 4 January 2022, followed by a 2023 update and a 2026 paper on crypto agility. ANSSI favours a phased transition rather than a single switch, and it makes hybrid schemes mandatory for long-term products from 2025. A hybrid scheme pairs a classical algorithm with a post-quantum one, so a system stays secure if either later proves weak.",[19,8362,8363],{},"Targeting long-term products first reflects the harvest-now-decrypt-later risk. These products hold data that must stay confidential for many years, which is the data an adversary gains most from recording today and decrypting later. Requiring hybrids there protects the most exposed data while keeping a trusted classical algorithm as a fallback during the transition.",[19,8365,8366],{},"ANSSI aligns its position with Germany's BSI, so Europe's two most influential cybersecurity agencies present a consistent phased, hybrid-first approach. That alignment helps vendors who sell across both markets, because they can plan one transition that satisfies both agencies rather than reconciling two different sets of expectations.",[19,8368,8369,8371],{},[383,8370,399],{}," ANSSI's phased, hybrid-first path has shaped the European approach since 2022, and its alignment with the BSI gives vendors a stable target. Organizations building long-term products for the French market face a 2025 hybrid expectation already, so those that adopted hybrids early are ahead of the curve. The 2026 crypto agility paper reinforces that flexible systems ease every future transition.",{"title":8,"searchDepth":84,"depth":84,"links":8373},[8374],{"id":8351,"depth":84,"text":8352},"2022-01-04","France's ANSSI set a phased hybrid approach from 2022, making hybrid schemes mandatory for long-term products from 2025, aligned with Germany's BSI.",[8378,8381,8384],{"q":8379,"a":8380},"What is ANSSI's phased approach?","ANSSI set out its post-quantum views in January 2022, with a 2023 follow-up and a 2026 crypto agility paper. It favours a phased transition and makes hybrid schemes mandatory for long-term products from 2025, so the most durable systems adopt protection first.",{"q":8382,"a":8383},"Why require hybrids for long-term products?","Long-term products hold data that must stay confidential for many years, which is exactly the data most exposed to harvest-now-decrypt-later. Requiring hybrids there protects that data while keeping a classical algorithm in place in case a post-quantum one proves weak.",{"q":8385,"a":8386},"Is ANSSI aligned with Germany's BSI?","Yes. ANSSI aligns its position with Germany's BSI, so the two leading European agencies present a consistent phased, hybrid-first approach. That alignment helps vendors who sell across both markets plan a single transition rather than two divergent ones.",[6871],[419,100],{},[8391],{"label":8392,"url":8393},"Agence nationale de la sécurité des systèmes d information (ANSSI), \"ANSSI views on the Post-Quantum Cryptography transition,\" Jan. 4, 2022.","https:\u002F\u002Fcyber.gouv.fr\u002Fen\u002Fpublications\u002Fanssi-views-post-quantum-cryptography-transition",[8395,8396],{"label":3869,"url":3914},{"label":3214,"url":3215},{"title":3921,"description":8376},"France ANSSI Sets a Phased Hybrid PQC Path","france-anssi-phased-hybrid-path","news\u002Ffrance-anssi-phased-hybrid-path",[1431,549,438,132,439],"France's ANSSI set a phased hybrid approach from 2022, making hybrid schemes mandatory for long-term products from 2025 and aligning its position with Germany's BSI.","B2Nm9UqZ6wDOazeqeKTnu9jhJTO_2iNhuI8VGafBB9U",{"id":8405,"title":8406,"author":7,"authorTitle":8,"authorUrl":9,"body":8407,"canonical":9,"category":220,"date":8435,"description":8436,"draft":95,"extension":96,"faqs":8437,"findingsSource":9,"geo":8447,"image":417,"industries":8448,"keyFindings":9,"meta":8449,"modified":7719,"navigation":103,"path":819,"pullquote":9,"recommendations":9,"references":8450,"related":8454,"seo":8457,"seoTitle":8458,"signposts":9,"slug":8459,"stats":9,"stem":8460,"tags":8461,"tldr":8462,"__hash__":8463},"news\u002Fnews\u002Fnist-2021-paper-migration-is-hard-and-slow.md","NIST 2021 Paper Warns Post-Quantum Migration Is Hard and Slow, Urges Discovery Now",{"type":11,"value":8408,"toc":8432},[8409,8413,8418,8421,8424,8427],[14,8410,8412],{"id":8411},"nist-2021-paper-warns-post-quantum-migration-is-hard-and-slow","NIST 2021 paper warns post-quantum migration is hard and slow",[19,8414,8415],{},[383,8416,8417],{},"28 APRIL 2021, GAITHERSBURG",[19,8419,8420],{},"NIST published the cybersecurity white paper \"Getting Ready for Post-Quantum Cryptography\" on 28 April 2021, more than three years before it finalized the first standards. The paper made a blunt point: migrating to post-quantum cryptography is hard and slow. It estimated a 5 to 15 year gap between standardizing new algorithms and completing their rollout across an organization's systems.",[19,8422,8423],{},"The paper used that estimate to argue for starting cryptographic discovery immediately. Discovery means finding where an organization uses cryptography, and that work does not depend on which algorithm eventually replaces the vulnerable one. An organization can map its cryptographic dependencies while the standards are still in draft, so that migration can begin the moment the standards arrive rather than starting from a blank page.",[19,8425,8426],{},"The paper also pushed organizations toward crypto agility, the ability to swap cryptographic algorithms without re-engineering the systems around them. Teams that build this flexibility find each future transition easier, not just the current one. The combination of early discovery and crypto agility is the foundation the paper recommended laying before any specific algorithm was chosen.",[19,8428,8429,8431],{},[383,8430,399],{}," The 2021 paper set the expectation that migration measures in years, not months, and that framing still holds. The standards it anticipated arrived in 2024, and the 5 to 15 year estimate underpins the federal deadlines that now run to 2030, 2031 and 2035. Organizations that started discovery when the paper urged it are years into the work; those that have not should treat the estimate as a reason to begin now.",{"title":8,"searchDepth":84,"depth":84,"links":8433},[8434],{"id":8411,"depth":84,"text":8412},"2021-04-28","A 2021 NIST paper warned post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.",[8438,8441,8444],{"q":8439,"a":8440},"How long does post-quantum migration take?","The 2021 NIST paper estimated a 5 to 15 year implementation gap between standardizing new algorithms and completing their rollout across an organization's systems. That estimate is why NIST urged organizations to begin discovery long before the standards were final.",{"q":8442,"a":8443},"Why start cryptographic discovery before the standards exist?","Discovery, finding where cryptography is used, is independent of which algorithm replaces it. The 2021 paper argued that organizations could do this slow, foundational work early so that migration could begin as soon as standards arrived rather than starting from zero.",{"q":8445,"a":8446},"Is a 2021 paper still relevant?","Yes. The standards it anticipated arrived in 2024, and the 5 to 15 year estimate still frames the timelines in later federal deadlines. Organizations that heeded its advice in 2021 are several years into the work the deadlines now require.",[5157],[100,228],{},[8451],{"label":8452,"url":8453},"W. Barker, W. Polk, and M. Souppaya, \"Getting Ready for Post-Quantum Cryptography,\" NIST Cybersecurity White Paper, Apr. 28, 2021.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fcswp\u002F04282021\u002Ffinal",[8455,8456],{"label":2673,"url":2674},{"label":815,"url":816},{"title":8406,"description":8436},"NIST 2021 Paper: PQ Migration Is Hard and Slow","nist-2021-paper-migration-is-hard-and-slow","news\u002Fnist-2021-paper-migration-is-hard-and-slow",[132,133,368,549,260],"A 2021 NIST paper warned that post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.","4m_mhdhF-70mxgb1Q10-G8MtNj9r2ITbdangGsV-ISE",{"id":8465,"title":8466,"author":7,"authorTitle":8,"authorUrl":9,"body":8467,"canonical":9,"category":92,"date":8495,"description":8496,"draft":95,"extension":96,"faqs":8497,"findingsSource":9,"geo":8507,"image":417,"industries":8508,"keyFindings":9,"meta":8509,"modified":8208,"navigation":103,"path":8510,"pullquote":9,"recommendations":9,"references":8511,"related":8515,"seo":8519,"seoTitle":8520,"signposts":9,"slug":8521,"stats":9,"stem":8522,"tags":8523,"tldr":8524,"__hash__":8525},"news\u002Fnews\u002Fnist-sp-800-208-stateful-hash-based-signatures.md","NIST Approves Stateful Hash-Based Signatures in SP 800-208 as an Interim Post-Quantum Option",{"type":11,"value":8468,"toc":8492},[8469,8473,8478,8481,8484,8487],[14,8470,8472],{"id":8471},"nist-approves-stateful-hash-based-signatures-in-sp-800-208","NIST approves stateful hash-based signatures in SP 800-208",[19,8474,8475],{},[383,8476,8477],{},"29 OCTOBER 2020, GAITHERSBURG",[19,8479,8480],{},"NIST published Special Publication 800-208 on 29 October 2020, approving stateful hash-based signature schemes for federal use. The publication covers LMS and XMSS, together with their multi-tree variants HSS and XMSSMT. These schemes resist quantum attack, so they gave organizations an approved post-quantum signature option nearly four years before NIST finalized its main standards in 2024.",[19,8482,8483],{},"The schemes carry one important condition. A stateful scheme must never reuse a one-time signing key, so the signer has to track which keys it has already used. Reusing a key breaks the security of the signature. That requirement makes these schemes best suited to controlled environments where the signer can manage state reliably, rather than to general-purpose signing across many systems.",[19,8485,8486],{},"Firmware and software signing fit that profile well. Signing often happens in a controlled release process, where an organization can enforce state management and sign a bounded number of items over a product's life. For broader signature needs, the later ML-DSA and SLH-DSA standards usually fit better because they do not require state tracking.",[19,8488,8489,8491],{},[383,8490,399],{}," SP 800-208 shows that an approved post-quantum signature option has existed since 2020 for the right use cases. Organizations that sign firmware or software can adopt stateful hash-based signatures today, provided they manage state carefully, and treat the 2024 standards as the general-purpose path. The choice between them depends on where and how the signing happens.",{"title":8,"searchDepth":84,"depth":84,"links":8493},[8494],{"id":8471,"depth":84,"text":8472},"2020-10-29","NIST approved stateful hash-based signatures in SP 800-208 in 2020, an interim post-quantum option for firmware and software signing that requires state tracking.",[8498,8501,8504],{"q":8499,"a":8500},"What does SP 800-208 approve?","SP 800-208 approves stateful hash-based signature schemes: LMS and XMSS, along with their multi-tree variants HSS and XMSSMT. These schemes resist quantum attack and gave organizations an approved post-quantum signature option years before the main 2024 standards.",{"q":8502,"a":8503},"Why does state tracking matter?","A stateful scheme must never reuse a one-time key. The signer tracks which keys it has used, and reusing one breaks the security of the scheme. That requirement makes these signatures best suited to controlled environments rather than general use.",{"q":8505,"a":8506},"Where do stateful hash-based signatures fit?","They suit firmware and software signing, where signing happens in a controlled setting and the signer can manage state reliably. For general-purpose signatures, the later ML-DSA and SLH-DSA standards are usually the better fit.",[5157],[100,228],{},"\u002Fnews\u002Fnist-sp-800-208-stateful-hash-based-signatures",[8512],{"label":8513,"url":8514},"D. Cooper et al., \"Recommendation for Stateful Hash-Based Signature Schemes,\" NIST Special Publication 800-208, Oct. 29, 2020.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F208\u002Ffinal",[8516,8517],{"label":2673,"url":2674},{"label":8518,"url":2855},"NIST Final Guidance on Key Establishment Mechanisms (SP 800-227)",{"title":8466,"description":8496},"NIST Approves Stateful Hash-Based Signatures","nist-sp-800-208-stateful-hash-based-signatures","news\u002Fnist-sp-800-208-stateful-hash-based-signatures",[438,549,759,368,260],"NIST approved stateful hash-based signatures in SP 800-208 in 2020, giving firmware and software signing an interim post-quantum option that requires careful state tracking.","Yzc0i-11uD_PemvPF9ORS-UNlq2ZVvLlDM8KaJtV4eE",1792182883152]