EU technical standard 2024/1774 requires crypto updates as attacks advance
13 MARCH 2024, BRUSSELS
Commission Delegated Regulation (EU) 2024/1774, published on 13 March 2024, sets the technical standards that sit beneath DORA for financial firms. Article 6 requires an encryption policy that covers data at rest, in transit and in use. Article 7 covers key management. The regulation obliges firms to update their cryptography as cryptanalysis develops, so a firm cannot treat its encryption choices as fixed.
The standard names the quantum threat in recital 9, which signals that quantum sits within the kinds of cryptanalytic developments firms must track. The text stays technology-neutral: it describes outcomes rather than naming algorithms or setting a date, so the obligation remains valid as post-quantum standards mature.
That design places the judgment with the firm. A financial entity must decide when cryptanalytic progress, including progress toward quantum computers, warrants a cryptographic update, and must be able to show a supervisor the policy behind that decision. The requirement to update as attacks advance makes crypto agility a practical necessity rather than an optional goal.
Why it matters. The standard turns DORA's general resilience duty into a concrete cryptographic obligation for financial firms. Because it names quantum and requires updates as attacks advance, firms cannot defer the question until a deadline appears. Those that build encryption and key-management policies capable of swapping algorithms will meet the standard more easily than those with hard-coded cryptography.