Resources
Everything ArcQubit publishes on post-quantum readiness in one place: our blog, company news, events, and long-form research. Written by the team that ships the tools and does the work.
Browse
Pick a track. Each is updated as we publish, so the hub always points to the latest.
Blog
Practical writing on post-quantum readiness, where quantum-vulnerable cryptography hides, and what a credible migration looks like.
News
Product releases, partnerships, credentials, and coverage from the ArcQubit team.
Events
Keynotes, conference sessions, board briefings, and live working sessions on quantum and PQC risk.
Whitepapers
Long-form, citable analysis translating NSM-10, FIPS 203/204/205, and CNSA 2.0 into engineering plans.
All resources
Every blog post, news item, and whitepaper we've published. Filter by your industry to see what applies to you across all three.
The US Department of War's post-quantum strategy requires all systems to support the new cryptography by the end of 2030, and reporting says those requirements will flow down to defense contractors through CMMC before rulemaking finishes.
Modern cryptography has three core types, symmetric-key, asymmetric-key, and hash functions, often extended to a fourth, hybrid cryptography, and quantum computers threaten the asymmetric type most.
Yes. Chrome negotiates the hybrid post-quantum key exchange X25519MLKEM768 by default for TLS 1.3 and QUIC, protecting key establishment against harvest-now-decrypt-later attacks.
QKD is limited by short distance, high dedicated-hardware cost, implementation flaws in real devices, a need for separate authentication, and poor scalability, which is why agencies favor post-quantum cryptography.
Google lowered the estimated cost of breaking Bitcoin signatures about twentyfold and independent studies put millions of coins at risk, so institutions that hold or custody digital assets should expect questions about address exposure and key management.
NATO set a quantum roadmap in September 2026 to adopt and implement post-quantum cryptography, with an action plan update by Q3 2027 and a pilot in Q4 2027.
The HHS preparedness office has signaled post-quantum migration guidance for hospitals and public health organizations, and because health records stay sensitive for decades, the harvest-now-decrypt-later exposure for this sector is real today.
CISA's guidance on post-quantum cryptography for operational technology warns that long equipment lifecycles, slow patching, and end-of-life systems make industrial migration the hardest, so operators should segment networks and start inventories now.
Assess quantum readiness on two dimensions, cybersecurity readiness and adoption readiness, plus the organizational enablers that support both, then turn the findings into a prioritized roadmap instead of a report.
Post-quantum cryptography replaces the encryption a future quantum computer could break, NIST has published the standards, and leaders should name an owner, fund discovery and ask five questions now.
The G7 financial roadmap targets 2030 to 2032 for critical systems and the ECB told eurozone banks that post-quantum migration must start now, which turns quantum readiness from a research topic into a supervised expectation.
Quantum advantage is not established for most business workloads, so screen each candidate on problem fit, classical limits, value magnitude and timeline alignment before you invest in experiments.
A PQC migration spans four environments no single team owns; running it from one dashboard turns a quarterly slide-deck scramble into a continuous, defensible program.
Quantum readiness runs along a four-position continuum from compliance to competitive advantage, and organizations that treat post-quantum mandates as a foundation rather than a finish line keep more strategic options open.
In 2022 CISA had RAND triage all 55 National Critical Functions for quantum risk; the finding was that a small number of upstream dependencies carry a disproportionate share of national risk.
For blockchain the harvest is not a risk but a design feature: every public key that ever transacted is already on an immutable ledger, so pre-launch is the only clean PQC migration path.
Ransomware in food and agriculture rose sharply through 2026 and the sector's traceability records depend on signatures that must stay trustworthy for years, yet almost no post-quantum migration planning exists for the sector in current reporting.
Treating quantum readiness as a one-time project leaves four hidden costs, restart, blind spots, fragmented strategy and compliance scrambles, so finance leaders should fund it as a sustained operating capability instead.
Enterprises run production AI on cryptographic foundations they cannot see; five questions define the AI visibility gap, and most teams cannot answer any of them today.
HHS and ASPR signalled in September 2026 that post-quantum guidance for hospitals is coming, while current resilience guidance still contains no post-quantum content.
Treat quantum readiness as a diversification problem: spread effort across technology platforms, use cases, partnerships and talent, because no one knows which hardware approach will win.
AI is a distinct, quantum-vulnerable cryptographic environment (ten layers from model provenance to guardrails) and it is the least mature of the four surfaces to migrate.
Building controllers and hotel systems often run 15 to 20 years, so encryption installed today will outlive the hardware, and vendors warn that harvest-now-decrypt-later exposure plus a 2027 to 2028 tipping point should move owners toward zero-trust designs now.
Three clocks run in parallel in every critical-infrastructure enterprise (the adversary’s, the quantum computer’s, and your own migration clock), and only the last one is yours to control.
Quantum technology has three pillars, sensing, computing and communications, each with its own timeline; for security, government agencies point to post-quantum cryptography, not quantum key distribution, as the main defense.
Evaluate quantum use cases by matching your problem type to an architecture (annealing, gate-model or hybrid) and passing a three-question fit test on classical limits, problem formulation and organizational capacity.
The CISO's post-quantum migration team and the CTO's quantum adoption team should share one evidence base, because migration timelines and adoption plans depend on the same long-lived systems.
Quantum readiness now means two things, post-quantum cryptography migration and quantum technology adoption, so leaders need one shared definition that covers both, which ArcQubit proposes below.
Post-quantum cryptography replaces public-key algorithms a quantum computer could break, and the first U.S. deadline arrives at the end of 2026, when new National Security System acquisitions must be CNSA 2.0 compliant.
Answer ten yes-or-no questions about ownership, inventory, data shelf life, vendors, TLS 1.3, crypto agility and pilots, and score one point per yes to find your stage: discovery, planning and pilots, or execution.
The US aviation regulator asked industry how to move air traffic systems to post-quantum cryptography, a research review found transport standards lack post-quantum certificate profiles, and port and road operators face trust decisions that will persist for decades.
For internet-facing TLS today, use hybrid key exchange, a classical algorithm combined with ML-KEM such as X25519MLKEM768, because it is widely deployed and stays secure if either component holds.
US Senate bill S. 5313, introduced in August 2026, would have FERC consider quantum risk in reliability standards and create a DOE post-quantum sandbox; it is a bill, not law.
Crypto agility is the ability to replace cryptographic algorithms without disrupting operations, achieved by keeping algorithm choices in configuration, using pluggable libraries, negotiating in the protocol and making key management agile.
A cryptographic inventory is a living record of every place your organization uses cryptography, built by combining code, network, certificate and configuration scans and stored in a cryptographic bill of materials (CBOM).
The Bank for International Settlements told banks to start the transition now with a cryptographic inventory, a Europol-linked framework shows how to rank what moves first, and Singapore signaled formal supervisory expectations later in 2026.
A post-quantum migration plan has five steps: inventory your cryptography, prioritize by data lifespan and exposure, pilot on low-risk systems, migrate in order of risk, and verify that systems use the new algorithms.
Chemical plants run control systems built to last decades, so the post-quantum migration collides with hardware that cannot easily be patched, while harvest-now-decrypt-later threatens long-lived process data and NIS2 sets the audit frame.
The United States, European Union, United Kingdom, Canada and Australia all publish post-quantum migration timelines, and most converge on 2035 for full migration, with the earliest hard dates in 2027 for U.S. National Security Systems acquisitions and 2030 for U.S. civilian key establishment.
An HKMA assessment in July 2026 scored Hong Kong banks 2.3 out of 10 on quantum readiness, set a target of 10 by 2030, and found about half lack a formal plan.
NIST has finalized three post-quantum standards, FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for signatures and FIPS 205 (SLH-DSA) as a hash-based backup, with FN-DSA and HQC still in progress.
Harvest now, decrypt later means an attacker copies encrypted data today and stores it until a quantum computer can decrypt it, so data that must stay secret for a decade or more is already at risk.
The EU's coordinated roadmap targets 2030 for high-risk critical infrastructure, and because substation equipment lasts 20 to 40 years, grid operators that install today's cryptography now will still run it when quantum attacks become feasible.
Singapore's CSA published a final post-quantum migration handbook and readiness index in July 2026, superseding its October 2025 draft, with emphasis on critical information infrastructure.
Australia's signals directorate published vendor-readiness questions for procurement, and an industry body names operational technology a priority because system lifecycles run 10 to 40 years, which puts manufacturers on both sides of the supply-chain migration problem.
Q-Day is the point when a quantum computer can break today's public-key encryption, and because no one knows the date, plan around how long your data must stay secret rather than around a prediction.
Post-quantum cryptography (PQC) is a family of encryption and digital signature algorithms designed to resist both classical and quantum attacks, and NIST published the first three standards in August 2024.
A July 2026 FINMA review of 60 institutions found banks and insurers lack post-quantum roadmaps, and recommended each build one by mid-2027.
Malaysia launched a national post-quantum migration plan and a sandbox in July 2026, building on November 2025 work, without setting dated deadlines.
While the headlines fixate on 2035, the UK expects cryptographic discovery finished by 2028 and the EU expects national roadmaps by 2026, which makes discovery the deadline that actually starts the clock.
Quantum-vulnerable cryptography hides across seven distinct surfaces, and most scanning tools inspect only one of them.
The ECB ordered eurozone banks to submit AI cyber action plans to their supervisory teams by 31 October 2026, and said post-quantum adoption must start now.
The U.S., UK, and EU have set post-quantum deadlines that converge between 2030 and 2035, so a multinational enterprise faces one overlapping clock rather than three separate programs.
Swift's Customer Security Controls Framework for 2026 adds no mandatory post-quantum control, so quantum readiness remains outside the framework's required controls for now.
The Pentagon is updating CMMC to align with NIST SP 800-171 Revision 3 through a July 2026 interim final rule, and says CMMC must later add post-quantum requirements.
Mexico set biometric bank rules in July 2026 requiring isolated encrypted storage of face and fingerprint data, with compliance due around late 2026; the rules are not post-quantum.
Bermuda's digital asset licensees grew to 49 by June 2026, operating under binding cyber-risk and custody rules that make cryptographic security a supervised matter.
Executive Order 14412 directs OMB to require U.S. federal high-impact systems to adopt post-quantum key establishment by 2030 and digital signatures by 2031, and it directs a rule that would put covered contractors on the same clock.
The Department of War's June 2026 strategy says systems must support post-quantum cryptography or be phased out by end-2030, so contractors should plan now.
OMB M-26-15 gives civilian agencies 120 days, about 22 October 2026, to submit post-quantum migration plans, so vendors should expect roadmap requests.
Australia's APRA signalled tougher quantum supervision in June 2026, telling firms to map cryptographic dependencies including third parties, using CPS 234 and CPS 230 as hooks.
Executive Order 14413 targets quantum research, commercialization and export controls, not migration, so encryption deadlines sit in EO 14412 and OMB M-26-15.
Executive Order 14412 directs federal systems to adopt post-quantum key establishment by the end of 2030 and post-quantum signatures by the end of 2031.
Executive Order 14412 directs a Federal Acquisition Regulation proposal within 180 days, requiring covered contractors to meet post-quantum obligations by the end of 2030.
Executive Order 14412 directs CISA and NIST to publish cryptography bill of materials minimum elements within 270 days, pointing to a March 2027 standard.
GSA's 2025 buyer's guide helps federal agencies acquire quantum-resistant cryptography and write crypto agile selection criteria, so vendors should expect matching language in procurement.
IETF RFC 9958, published in June 2026, explains post-quantum cryptography for engineers and warns that migration may need protocol redesign, not just an algorithm swap.
The UAE launched a national cryptography discovery platform in May 2026, pairing a discovery tool and national libraries with a national post-quantum readiness index.
G7 central banks published their first shared quantum report in May 2026, marking coordinated attention to how quantum computing affects the financial system.
Ericsson researchers urge telecom operators to migrate high-priority systems before 2031 and finish by 2035, with long-lived trust anchors built into infrastructure today posing the hardest problem, while ESA and Singapore show the work already underway.
South Korea widened its post-quantum pilots to telecom, finance, transport, defense and space in May 2026, aiming for cryptographic self-reliance by 2030.
An April 2026 ENISA review found hybrid key agreement more mature than hybrid signatures, offering a status check rather than a recommendation on which to adopt.
Crypto agility is no longer optional because the post-quantum algorithms mandated today will need replacing again, and infrastructure that cannot swap algorithms without a rebuild will make every future migration as expensive as this one.
Testimony prepared for a US Senate hearing urges water utilities to build a post-quantum transition plan aligned to NIST standards, but dedicated sector guidance is thin and most sources address critical-infrastructure operational technology in general.
No current reporting addresses post-quantum cryptography for dams directly, so operators must read across critical-infrastructure OT analysis, a 2023 quantum-key-distribution paper, and NIS2 obligations to judge their own long-lived control systems.
NIST's post-quantum cryptography standards, FIPS 203, 204, and 205, name the specific algorithms organizations must migrate to and point to a proposed federal timeline, deprecating 112-bit-strength quantum-vulnerable algorithms after 2030 and disallowing all quantum-vulnerable algorithms after 2035, that moves post-quantum migration from a research question toward a compliance deadline.
Research models significant quantum-attack success against nuclear plants under current postures and reports that full post-quantum migration cuts residual feasibility sharply, while field demonstrations so far test quantum key distribution rather than post-quantum algorithms.
Boards do not need quantum expertise, but they should ask management twelve questions on risk exposure, strategy, governance and investment, and expect written, evidence-based answers with named owners and dates.
Cloudflare reports that more than 60 percent of human-generated TLS traffic to its network already uses hybrid post-quantum protection, while UK and EU timelines put weight on software and cloud vendors to carry smaller customers through the migration.
Five common myths, from waiting for fault-tolerant hardware to treating readiness as a security-only task, lead organizations to delay quantum preparation that the evidence says should start now.
Post-quantum urgency is a prioritization problem: inventory your cryptography, rank systems by exposure and tractability, take quick wins, and use hybrid deployments only where full migration must wait.
Security and quantum-adoption teams should share one evidence base instead of running separate assessments, because the same discovery data informs both the risk you must defend against and the opportunities you may pursue.
An India task force set a 2029 deadline for critical infrastructure post-quantum migration in February 2026, with foundations by 2027 and crypto agility in procurement.
India's task force set 2027 to 2029 milestones for critical information infrastructure, the EU coordinated roadmap targets 2030 for high-risk systems, and Singapore published a migration handbook and readiness index for agencies and critical infrastructure.
Brazil added post-quantum algorithms ML-DSA and ML-KEM to its national ICP-Brasil certificate system in early 2026, making it a binding national standard.
Quantum maturity is a snapshot of where your organization stands today, while quantum readiness is a sustained capability to act as standards, threats and opportunities change, and boards should fund and measure the second.
CISA's January 2026 list names the technology categories that should support post-quantum standards such as FIPS 203, 204 and 205, serving as advisory guidance for procurement.
Germany's BSI advised in January 2026 against using Classic McEliece in new systems, citing cryptanalysis progress, as a precautionary update to its TR-02102-1 guidance.
Post-quantum cryptography migration removes the security risk from quantum computing, but quantum readiness also means managing the strategic risk of adopting quantum technology too slowly, so leaders need to plan for both.
Europol published a post-quantum prioritization method in January 2026 that ranks systems by shelf life, exposure and business impact, weighing risk against migration time.
A January 2026 Commission proposal would write post-quantum migration into NIS2 national strategies, with critical systems by 2030 and medium-risk systems by 2035.
The July 2024 OMB report to Congress built federal post-quantum migration on four precepts, estimated $7.1 billion for 2025 to 2035, and told agencies to inventory first and find unmigratable systems early.
The G7 Cyber Expert Group's January 2026 roadmap sets 2030 to 2032 for migrating critical financial systems and 2035 for the sector, and it is voluntary.
Quantum simulation targets chemistry where strong electron correlation defeats classical approximations, such as bond breaking, transition-metal active sites and excited states, but today's hardware limits work to small benchmark molecules.
In 2026 the U.S. government set dated post-quantum deadlines, and the dates already published for 2027 require organizations to define readiness, inventory cryptography, and assign one executive owner.
The Central Bank of Jordan issued a post-quantum roadmap for banks in January 2026, covering governance, inventory, prioritization and pilots, without a dated target.
An African consortium issued a post-quantum readiness white paper and formed a regional alliance in 2026, pointing to mobile money scale and free migration tools.
Federal quantum momentum turns into audit questions about where quantum-vulnerable cryptography lives, so the first step of any quantum adoption plan is a cryptographic inventory, not new hardware.
Saudi Arabia's National Cryptographic Standards do not yet accept post-quantum algorithms, and an update consulted in December 2025 was not final as of early 2026.
Project Leap completed its second phase in December 2025, testing post-quantum signatures in live payment systems and finding they work but add processing time.
A December 2025 IDB and OAS report found Latin American and Caribbean cyber maturity improving but flagged gaps in software quality, critical infrastructure protection and cyber insurance.
Germany's BSI estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040, a 15-year path that could compress to about 10 years.
Japan set a government post-quantum target of 2035 in principle in November 2025, and will publish a detailed migration roadmap in FY2026.
CARICOM and IMPACS updated the Caribbean cybersecurity action plan in October 2025, adding an incident response pillar to strengthen regional cyber resilience.
The PKI Consortium published a draft five-level post-quantum maturity model in October 2025, letting vendors self-grade from Initial to Optimized on a voluntary basis.
Public-safety radio standards already strengthened symmetric encryption against the quantum threat, but a NIST-style post-quantum migration for emergency communications and legacy 911 infrastructure barely registers in current reporting.
The UK NCSC launched an Assured Cyber Security Consultancy pilot for post-quantum migration on 1 October 2025, running through March 2027.
Vendors and regulators are converging on 2030 and 2035 milestones for healthcare cryptography, and because patient records need decades of protection, harvest-now-decrypt-later is an active concern even though much of the current reporting is vendor-authored.
Colombia's financial supervisor flagged quantum among emerging risks in September 2025, amid a sharp rise in cyberattacks, without yet imposing a requirement.
A September 2025 MAS sandbox report positions post-quantum cryptography as the foundation for financial security and quantum key distribution as suited to niche point-to-point links.
Australia's ASD published planning guidance in September 2025 setting a plan by end-2026, commencement by end-2028 and completion by end-2030, under its LATICE framework.
NIST finalized SP 800-227 in September 2025, giving practitioners implementation guidance for key establishment mechanisms that supports FIPS 203 and future HQC.
Brazil dropped blockchain from its Drex pilot in August 2025, with no public central bank digital currency platform expected before 2027 and no post-quantum requirement yet.
India's MeitY and CERT-In published a quantum readiness white paper in July 2025, offering guidance on preparing for post-quantum cryptography without setting a deadline.
BIS Papers No. 158, published in July 2025, urges banks to start post-quantum work now, with inventory as the foundation and crypto agility, defense in depth and hybrid schemes.
Twenty-one European agencies, including Norway, renewed a joint statement in July 2025 urging organizations to treat post-quantum planning as core risk management.
Canada's federal migration roadmap sets high-priority systems by end-2031 and the rest by end-2035, with post-quantum clauses in contracts signed after April 2026.
The EU post-quantum roadmap, published in June 2025, sets national strategies by end-2026, high-risk migration by end-2030 and medium-risk systems by end-2035.
The Bank of Japan joined the G7 central bank quantum working group in June 2025, and the group produced a reference report in May 2026.
The EU certification group ECCG is adding post-quantum cryptography to its scheme, with version 2.0 published in May 2025 and a version 3 draft in public review.
UK CMORG published voluntary post-quantum guidance for financial institutions in April 2025, setting strategic direction that aligns with NCSC and NIST.
Japan's CRYPTREC issued post-quantum guidance in April 2025 and revised its Ciphers List in March 2026 with an ML-KEM table, with ML-DSA and SLH-DSA evaluations in 2026.
The Cayman Islands moved virtual asset service providers from registration to licensing from April 2025, requiring cybersecurity plans as a condition of a licence.
The UK NCSC set three post-quantum deadlines in March 2025: discovery and planning by 2028, early migration by 2031 and complete migration by 2035.
NIST chose HQC as a fifth post-quantum algorithm and backup to ML-KEM, targeting a final standard in 2027, but organizations should keep migrating to ML-KEM now.
NIST's CSWP 39 explains how to replace cryptographic algorithms without disrupting systems, and the 29 June 2026 update supersedes the December 2025 final.
Europol's Quantum Safe Financial Forum issued a call to action in February 2025, saying existing EU rules suffice and urging hybrid schemes, inventories and crypto agility.
China opened a call for next-generation commercial cryptographic algorithms in February 2025, with a 30 June 2026 deadline for public-key proposals.
The Czech cybersecurity agency NUKIB set a post-quantum algorithm baseline in February 2025, naming ML-KEM-1024, ML-DSA-87, SLH-DSA and hybrid schemes, with no deadlines.
The EU Digital Operational Resilience Act has applied to financial firms since January 2025, and cryptography enters its scope through Article 9 and delegated technical standards.
South Korea selected four home-grown post-quantum algorithms in January 2025: AIMer and HAETAE for signatures, and NTRU+ and SMAUG-T for key establishment.
The Bank of Israel ordered banks in January 2025 to submit quantum preparedness plans within one year, with the harvest-now-decrypt-later threat at the centre.
The ITU-T continues studying quantum-resistant support, with its 2021 X.1811 recommendation scoped to 5G and a study group examining changes to X.509 certificates.
ISO/IEC JTC1 SC27 maintains a standing document on post-quantum cryptography that serves as a working reference for its members rather than a published standard.
FS-ISAC has called for the financial sector to adopt a common end date for post-quantum migration, so interconnected firms move on a shared, coordinated timeline.
The Dutch AIVD, CWI and TNO published a post-quantum migration handbook in December 2024 with a three-step approach and a free PQChoiceAssistant tool.
Australia's ISM control 1917 requires new government cryptography to support post-quantum algorithms by 2030, naming ML-DSA-87, ML-KEM-1024, SHA-384/512 and AES-256.
A Japan FSA study group urged banks in November 2024 to start post-quantum work now, recommending inventory, crypto agility and a phased approach into the mid-2030s.
NIST draft IR 8547 proposes 2030 and 2035 dates for leaving quantum-vulnerable cryptography, and though it is a draft, it gives boards planning anchors.
The Banque de France and the Monetary Authority of Singapore exchanged post-quantum encrypted email across continents in November 2024, a voluntary trial that hints where pilots may head.
Israel's Directive 364, issued in November 2024, consolidates earlier directives and provides the legal hook for the Bank of Israel's quantum preparedness letter, though it never names quantum.
CISA's October 2024 paper says industrial systems face legacy gear and long patch cycles in post-quantum migration, so operators should plan crypto agility.
The GSMA issued a post-quantum telecom guidance series from October 2024 to May 2026, covering use cases from IoT and roaming to base stations and satellite.
The UK NCSC endorsed ML-KEM-768 and ML-DSA-65 in August 2024 and treats hybrid schemes as an interim measure rather than a long-term goal.
NIST approved FIPS 203, 204 and 205, its first post-quantum encryption standards, so vendors and buyers now have named algorithms to request and plan around.
The Bahamas DARE Act 2024 regulates digital asset activities including staking, stablecoins and custody, bans algorithmic stablecoins, and brings cryptographic custody into supervisory scope.
An OECD primer published in June 2024 frames post-quantum migration as urgent, bringing the issue to policymakers across its member economies.
The European Commission's April 2024 recommendation urges member states to coordinate post-quantum migration, develop national strategies and use hybrid schemes during the transition.
PCI DSS requirement 12.3.3 obliges organizations handling payment card data to inventory their cryptography, a step that doubles as the foundation for post-quantum migration.
EU delegated regulation 2024/1774 requires financial firms to maintain encryption and key-management policies and update cryptography as cryptanalysis advances, naming quantum in a recital.
The Monetary Authority of Singapore issued an advisory in February 2024 telling financial firms to inventory cryptography and plan for post-quantum migration, with supervisory expectations to follow.
The World Economic Forum and the UK FCA published a January 2024 white paper on quantum security for finance, offering principles and frameworks rather than FCA rules.
FINRA asked securities firms in October 2023 to start a dialogue on post-quantum cryptography, framing the move as research and awareness rather than a new requirement.
CISA, the NSA and NIST urged organizations to begin post-quantum migration planning in 2023, and the voluntary factsheet lists four starting actions.
South Korea set a staged national post-quantum master plan in July 2023, with action plans in 2024, foundations by 2030 and deployment by 2035.
Canada's CFDIR issued voluntary post-quantum guidance with a five-phase roadmap, advising firms to ask vendors for roadmaps and protect data with a life beyond ten years.
India's National Quantum Mission, launched in April 2023, funds the development of quantum technology capability rather than directing any post-quantum cryptography migration for organizations.
The Cayman Islands extended its cybersecurity rule to virtual asset service providers in April 2023, and a 2025 review found gaps that remained to be addressed.
Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but does not mention quantum, so cryptographic risk enters through its general duties.
The US Quantum Computing Cybersecurity Preparedness Act of 2022 requires federal agencies to inventory quantum-vulnerable systems and plan migration to post-quantum cryptography.
OMB M-23-02 requires federal agencies to inventory quantum-vulnerable cryptography annually from 4 May 2023, so vendors should expect inventory requests.
The 2022 edition of ISO 27001 sets no post-quantum requirements, but its technology-neutral cryptography control still obliges organizations to manage cryptographic risk.
The EU-backed LAC4 cyber training centre, launched in May 2022, serves 27 member countries, building the regional cyber skills that underpin future quantum readiness.
National Security Memorandum 10 set a 2035 goal for moving vulnerable systems to quantum-resistant cryptography, and later federal papers repeat it.
France's ANSSI set a phased hybrid approach from 2022, making hybrid schemes mandatory for long-term products from 2025 and aligning its position with Germany's BSI.
A 2021 NIST paper warned that post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.
NIST approved stateful hash-based signatures in SP 800-208 in 2020, giving firmware and software signing an interim post-quantum option that requires careful state tracking.
Your quantum exposure is knowable today. Run a scan and see where you stand.