Canadian CFDIR issues voluntary post-quantum guidance
12 JUNE 2023, OTTAWA
Canada's financial-sector resiliency body, CFDIR, issued voluntary post-quantum guidance on 12 June 2023 and updated it on 31 July 2025. The guidance sets out a five-phase roadmap, advises firms to ask their vendors for post-quantum roadmaps, and tells firms to prioritise protecting data that must stay confidential for more than ten years.
The ten-year focus targets the clearest exposure. Data that must remain confidential for over a decade is the data most at risk from harvest-now-decrypt-later, where an adversary records encrypted data today and decrypts it once a quantum computer can break it. Protecting long-lived data first addresses the exposure that is already real, regardless of when a quantum computer arrives.
Asking vendors for roadmaps reflects how much firms depend on third parties. A firm's post-quantum readiness is only as strong as the readiness of the products it relies on, so requesting vendor roadmaps turns supply-chain exposure into a visible, manageable question rather than a hidden risk. The five-phase structure then gives firms an ordered path to follow.
Why it matters. The CFDIR guidance gives Canadian financial firms a practical, voluntary roadmap and two concrete priorities: protect long-lived data and press vendors for their plans. Because it is voluntary, its value depends on firms adopting it, but its advice targets the real exposure that harvest-now-decrypt-later creates. Firms can start by inventorying data with a life beyond ten years and asking their key vendors for roadmaps.