All Post-Quantum, PQC Posts
-
Post-Quantum, PQC, Quantum Security
The Cryptographic Iceberg Inside a Mobile Banking Transaction
A single mobile banking payment triggers millions of cryptographic function calls across nine parties. Here's what actually happens - from silicon to settlement - and why it matters for quantum readiness. The Cryptographic Iceberg Inside a Mobile Banking Transaction 320 function calls before you even type an amount It takes roughly half a second. You press your thumb against the sensor, your banking app opens,…
Read More » -
Quantum Policies
NIS2, DORA, and the EU Post-Quantum Roadmap
If you are a CISO under NIS2 or DORA, you are already expected to run a risk-management system that tracks material, evolving threats - and to implement “state‑of‑the‑art” controls appropriate to the risk. The EU’s PQC roadmap is effectively saying: quantum is now one of those evolving threats you must govern. The most important conceptual shift for leadership teams is this: the EU is not (yet)…
Read More » -
Quantum Policies
The Complete US Post-Quantum Cryptography (PQC) Regulatory Framework in 2026
Three pillars anchor the US PQC framework: the Quantum Computing Cybersecurity Preparedness Act (federal law that no executive order can undo), NSM-10's 2035 migration target (still in force), and NIST's finalized FIPS standards (published August 2024). The Trump administration's June 2025 executive order streamlined, rather than eliminated, PQC obligations, removing prescriptive procurement mandates while retaining the CISA product category list and a TLS 1.3 deadline…
Read More » -
Quantum Policies
No Single Law, No Single Excuse: How Canada Regulates PQC Without Saying “Quantum”
Canada's visible PQC guidance - three documents published mid-2025 - is just the tip. Beneath it sits a layered enforcement framework spanning financial regulation, critical infrastructure law, privacy obligations, and securities disclosure that collectively creates binding pressure for quantum readiness. OSFI already requires federally regulated financial institutions to maintain "strong cryptographic technologies" and has issued a direct quantum readiness bulletin. The pending CCSPA would add…
Read More » -
Post-Quantum, PQC, Quantum Security
Telecom Quantum Readiness: Why the Urgency and Where to Start
An increasing number of telecom leaders have been pinging me lately about quantum readiness. And frankly, that’s exactly what they should be doing. New regulations and mandates are emerging left and right (in various jurisdictions and across the industry) requiring critical infrastructure to become quantum-safe in the coming years. As someone who used to run global telecom cybersecurity practices - and served as interim CISO…
Read More » -
Post-Quantum, PQC, Quantum Security
Quantum Key Distribution (QKD): Why Countries Differ on Its Future
Quantum Key Distribution (QKD) - a method of securing communications using quantum physics - has become a flashpoint of debate worldwide. Recent news (like Google’s announcement favoring post-quantum algorithms over QKD) highlights how divided opinions are. Some nations are investing heavily in QKD networks as the next frontier of secure communications, while others remain skeptical and prioritize post-quantum cryptography (PQC). United States and Allies: Emphasizing…
Read More » -
Post-Quantum, PQC, Quantum Security
Rethinking CBOM
The simplest way to explain CBOM is still the best. If SBOM is the ingredients list for software, CBOM is the ingredients list for the security assumptions that software depends on. Where SBOM tracks components and dependencies, CBOM tracks cryptographic assets - algorithms, protocols, certificates, keys, and related material - and the relationships that turn "implemented somewhere" into "actually used here." This is not happening…
Read More » -
Post-Quantum, PQC, Quantum Security
Why We Need a Quantum Security ISAC
Quantum computing promises revolutionary capabilities, but it also poses unprecedented threats to cybersecurity. Experts warn of a looming “Quantum Apocalypse” scenario - the day when a sufficiently advanced quantum computer can crack encryption like RSA or ECC, exposing sensitive data that was once considered secure. And of course, there's the already present "harvest now, decrypt later." The potential impact of cryptography-breaking quantum computers is global…
Read More »
