[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Fiso-27001-no-pqc-requirements":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Fiso-27001-no-pqc-requirements.md","ISO 27001 Has No Post-Quantum Requirements but Its Crypto Control Still Applies","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"iso-27001-has-no-post-quantum-requirements-but-its-crypto-control-still-applies","ISO 27001 has no post-quantum requirements but its crypto control still applies",[18,19,20],"p",{},[21,22,23],"strong",{},"25 OCTOBER 2022, GENEVA",[18,25,26],{},"The 2022 edition of ISO 27001, the widely used information security management standard, sets no post-quantum requirements. Its cryptography control is technology-neutral: it requires organizations to manage cryptographic risk without naming specific algorithms or mandating a post-quantum transition. The standard addresses cryptography in principle rather than prescribing particular technology.",[18,28,29],{},"That technology-neutral framing still touches quantum. A control that requires appropriate cryptography, without specifying which algorithms, expects an organization to account for the risks its cryptography faces. As the quantum threat grows, an organization meeting the control in good faith should weigh that risk, so the control can pull in quantum considerations even though it never names them.",[18,31,32],{},"The implication reaches into audits. Because the control requires managing cryptographic risk, an auditor or an organization applying the standard thoughtfully may treat quantum as part of that risk. The standard does not force the point, but its risk-based framing leaves room for it, which means ISO 27001 is not silent on quantum so much as indirect about it.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," ISO 27001 imposes no post-quantum mandate, yet its technology-neutral cryptography control gives organizations a reason to consider quantum risk as part of managing their cryptography. Organizations certified to the standard should not assume it exempts them from quantum concerns. Treating quantum as one of the cryptographic risks the control covers keeps an organization's risk management current as the threat develops.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2022-10-25","The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges managing cryptographic risk.",false,"md",[49,52,55],{"q":50,"a":51},"Does ISO 27001 require post-quantum cryptography?","No. The 2022 edition of ISO 27001 sets no post-quantum requirements. Its cryptography control is technology-neutral, so it requires organizations to manage cryptographic risk without naming specific algorithms or mandating a post-quantum transition.",{"q":53,"a":54},"How does a technology-neutral control relate to quantum?","A technology-neutral control requires appropriate cryptography without specifying which algorithms. As the quantum threat grows, an organization meeting the control in good faith should account for that risk, so the control can pull in quantum considerations without naming them.",{"q":56,"a":57},"Can an ISO 27001 audit raise quantum concerns?","Potentially. Because the control requires managing cryptographic risk, an auditor or an organization applying the standard thoughtfully may treat quantum as part of that risk. The standard does not force it, but its risk-based framing leaves room for it.",[59],"geneva","\u002Fassets\u002Fog-default.png",[62,63],"Information Technology","Cross-Sector",{},"2026-08-10",true,"\u002Fnews\u002Fiso-27001-no-pqc-requirements",[69],{"label":70,"url":71},"International Organization for Standardization, \"ISO\u002FIEC 27001:2022 Information security management systems,\" Oct. 25, 2022.","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001",[73,76],{"label":74,"url":75},"ISO\u002FIEC JTC1 SC27 Maintains a Standing Document on Post-Quantum Cryptography","\u002Fnews\u002Fiso-iec-sc27-standing-document-pqc",{"label":77,"url":78},"NIST Issues Crypto Agility Guidance in CSWP 39","\u002Fnews\u002Fnist-cswp-39-crypto-agility-guidance",{"title":5,"description":45},"ISO 27001 Has No Post-Quantum Requirements","iso-27001-no-pqc-requirements","news\u002Fiso-27001-no-pqc-requirements",[84,85,86,87,88],"federal compliance","quantum readiness","crypto-agility","quantum risk","for enterprises","The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges organizations to manage cryptographic risk.","-GaZE_t5Bm00ul1XHP78cd_xK2JHcd0b9rsyY-oBw-Q",1792182887441]