[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Fcanada-cfdir-voluntary-pqc-guidance":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Fcanada-cfdir-voluntary-pqc-guidance.md","Canadian CFDIR Issues Voluntary Post-Quantum Guidance for the Financial Sector","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"canadian-cfdir-issues-voluntary-post-quantum-guidance","Canadian CFDIR issues voluntary post-quantum guidance",[18,19,20],"p",{},[21,22,23],"strong",{},"12 JUNE 2023, OTTAWA",[18,25,26],{},"Canada's financial-sector resiliency body, CFDIR, issued voluntary post-quantum guidance on 12 June 2023 and updated it on 31 July 2025. The guidance sets out a five-phase roadmap, advises firms to ask their vendors for post-quantum roadmaps, and tells firms to prioritise protecting data that must stay confidential for more than ten years.",[18,28,29],{},"The ten-year focus targets the clearest exposure. Data that must remain confidential for over a decade is the data most at risk from harvest-now-decrypt-later, where an adversary records encrypted data today and decrypts it once a quantum computer can break it. Protecting long-lived data first addresses the exposure that is already real, regardless of when a quantum computer arrives.",[18,31,32],{},"Asking vendors for roadmaps reflects how much firms depend on third parties. A firm's post-quantum readiness is only as strong as the readiness of the products it relies on, so requesting vendor roadmaps turns supply-chain exposure into a visible, manageable question rather than a hidden risk. The five-phase structure then gives firms an ordered path to follow.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," The CFDIR guidance gives Canadian financial firms a practical, voluntary roadmap and two concrete priorities: protect long-lived data and press vendors for their plans. Because it is voluntary, its value depends on firms adopting it, but its advice targets the real exposure that harvest-now-decrypt-later creates. Firms can start by inventorying data with a life beyond ten years and asking their key vendors for roadmaps.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2023-06-12","Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data over ten years old.",false,"md",[49,52,55],{"q":50,"a":51},"What does the CFDIR guidance recommend?","The guidance, first issued on 12 June 2023 and updated on 31 July 2025, sets out a five-phase roadmap. It advises firms to ask their vendors for post-quantum roadmaps and to prioritise protecting data that must stay confidential for more than ten years.",{"q":53,"a":54},"Why focus on data with a life beyond ten years?","Data that must stay confidential for over a decade is most exposed to harvest-now-decrypt-later, where an adversary records it today and decrypts it once a quantum computer exists. Protecting long-lived data first targets the exposure that cannot wait for a quantum computer to arrive.",{"q":56,"a":57},"Is the CFDIR guidance mandatory?","No. The guidance is voluntary. It gives Canadian financial firms a shared roadmap and practical advice rather than imposing requirements, so firms can adopt it to coordinate their approach ahead of any binding rules.",[59],"ottawa","\u002Fassets\u002Fog-default.png",[62,63],"Financial Services","Cross-Sector",{},"2026-08-12",true,"\u002Fnews\u002Fcanada-cfdir-voluntary-pqc-guidance",[69],{"label":70,"url":71},"Canadian Financial Sector Resiliency Group \u002F CFDIR, \"Post-quantum cryptography guidance for the financial sector,\" Jun. 12, 2023; updated Jul. 31, 2025.","https:\u002F\u002Fwww.bankofcanada.ca\u002F",[73,76],{"label":74,"url":75},"Canada's Federal Migration Roadmap Sets 2031 and 2035 Deadlines","\u002Fnews\u002Fcanada-federal-migration-roadmap-itsm-40-001",{"label":77,"url":78},"G7 Financial-Sector Post-Quantum Roadmap Targets 2030 to 2032","\u002Fnews\u002Fg7-financial-sector-post-quantum-roadmap-2030-2032",{"title":5,"description":45},"Canadian CFDIR Issues Voluntary PQC Guidance","canada-cfdir-voluntary-pqc-guidance","news\u002Fcanada-cfdir-voluntary-pqc-guidance",[84,85,86,87,88],"financial services","PQC migration","supply chain","harvest now decrypt later","for enterprises","Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data with a life beyond ten years.","BYEjdRK3lN40wb4PvdzRXFCKNddhW_r3-OSozpPSI5c",1792182887316]