ISO 27001 has no post-quantum requirements but its crypto control still applies
25 OCTOBER 2022, GENEVA
The 2022 edition of ISO 27001, the widely used information security management standard, sets no post-quantum requirements. Its cryptography control is technology-neutral: it requires organizations to manage cryptographic risk without naming specific algorithms or mandating a post-quantum transition. The standard addresses cryptography in principle rather than prescribing particular technology.
That technology-neutral framing still touches quantum. A control that requires appropriate cryptography, without specifying which algorithms, expects an organization to account for the risks its cryptography faces. As the quantum threat grows, an organization meeting the control in good faith should weigh that risk, so the control can pull in quantum considerations even though it never names them.
The implication reaches into audits. Because the control requires managing cryptographic risk, an auditor or an organization applying the standard thoughtfully may treat quantum as part of that risk. The standard does not force the point, but its risk-based framing leaves room for it, which means ISO 27001 is not silent on quantum so much as indirect about it.
Why it matters. ISO 27001 imposes no post-quantum mandate, yet its technology-neutral cryptography control gives organizations a reason to consider quantum risk as part of managing their cryptography. Organizations certified to the standard should not assume it exempts them from quantum concerns. Treating quantum as one of the cryptographic risks the control covers keeps an organization's risk management current as the threat develops.