HNDL in Financial Services: Regulatory and Operational Implications
Financial services institutions hold the data categories with the longest regulatory retention periods, are documented targets of nation-state cyber…
Blog
Insights & News
Expert analysis, quantum security news, and industry developments from QSECDEF. 224 articles across insights and news.
Articles — page 2 of 8
CNSA 2.0 Compliance Guide: What US Defence Contractors Must Do
The NSA's preferred schedule had 2025 as the target year for software and firmware signing. That date has passed. This article works through each CNSA…
NIST Algorithm Deprecation Timeline: When RSA, ECC, and SHA-1 Are Officially Retired
NIST IR 8547 is not a threat assessment document. It is a schedule. This article provides the specific dates, specific algorithm names, and specific…
How to Calculate Your Organisation's HNDL Exposure
Harvest-now-decrypt-later exposure is calculable, not qualitative. An organisation that knows its network topology, data retention requirements, and…
The PQC Readiness Checklist Every CISO Should Run Through
Post-quantum cryptography readiness has a specific structure. Six areas must all advance for a migration to succeed: cryptographic discovery,…
NCSC PQC Migration Guidance: The UK Position Explained
On 20 March 2025 the NCSC published its first dedicated PQC migration timeline, setting milestones at 2028, 2031, and 2035. For operators of essential…
How DORA Shapes Quantum Security Preparedness in Financial Services
DORA's ICT risk management obligations are live. This article maps the specific Articles 6 and 9 obligations and their RTS implementations to…
ETSI Quantum Safe Cryptography Standards: A Guide for European Organisations
For organisations operating in the EU, ETSI standards are not an alternative to NIST — they are the regulatory translation layer. This article maps…
The CISO's Case for Quantum Security Investment in 2026
The board case for PQC investment changed materially in August 2024 when NIST published final standards and opened the deprecation clock. This article…
Long-Lived Data and Quantum Risk: What to Protect First
Not all data needs migrating at the same urgency. This article applies the Mosca inequality to specific data categories with specific confidentiality…
What the EU Cyber Resilience Act Means for Quantum-Vulnerable Products
The EU Cyber Resilience Act's main conformity obligations apply from December 2027. For manufacturers whose products use quantum-vulnerable…
Why Your GDPR Data Retention Schedule Needs a Post-Quantum Review
The obligation to protect personal data with measures 'appropriate to the risk' under UK GDPR Article 32 includes the current threat model. That model…
How to Build a Cryptographic Asset Register for Your Organisation
The most common reason PQC migration programmes stall at planning is the absence of a reliable answer to one question: what cryptographic assets do we…
Vendor Selection for PQC Migration: How to Evaluate Cryptographic Library and Platform Providers
A cryptographic library is not a commodity procurement. Choose a library without ML-KEM support today and you face a choice between deferring…
PQC Compliance Readiness: A Gap Analysis Framework for Security Teams
Multi-framework PQC compliance is the problem most organisations face in 2026. NIST IR 8547, CNSA 2.0, DORA, and NIS2 share a technical foundation but…
HNDL Risk Assessment Framework for Enterprise Security Teams
The Harvest Now, Decrypt Later attack is not a theoretical concern for 2033. The interception is happening now. A five-component operational framework…
Quantum Security for OT and SCADA Systems: A Practitioner's Assessment Framework
The PQC migration problem in operational technology environments is harder than in IT. Hardware cycles of ten to twenty years, compute-constrained…
Quantum Risk on the Board Agenda: A Practical Guide for CISOs
Getting quantum risk onto the board agenda is not the hard part. Most boards will hear "governments are retiring current encryption standards by 2030"…
ML-KEM Key Sizes and Performance: What Enterprise Architects Need to Know Before Deployment
FIPS 203 defines three parameter sets for ML-KEM. The choice between them carries real implications for performance, security margin, and integration…
NIS2 and Post-Quantum Cryptography: The Gap in Your Cyber Resilience Plan
Most NIS2 implementation programmes treat cryptography as a checklist item: TLS version current, certificates valid, data encrypted at rest,…
EU AI Act and Quantum Security: What Critical Infrastructure Operators Must Address Before August 2026
The EU AI Act's August 2026 enforcement threshold arrives for high-risk AI systems in critical infrastructure. What Article 15's state-of-the-art…
Post-Quantum Cryptography in PKI: Migration Planning for Certificate Authorities and Enterprise PKI Teams
PKI migration is the longest-lead item in most enterprise PQC programmes. Root CA sequencing, ML-DSA algorithm selection, HSM readiness, OCSP…
NIST IR 8547: The Transition Timeline and What It Means for Your Team
IR 8547 answers the question the FIPS standards do not: when must the old algorithms stop. A CISO and security architect guide to the deprecation and…
Which Data Is Most at Risk from HNDL Attacks Today
Not all encrypted data is equally exposed to Harvest Now, Decrypt Later attacks. A retail transaction from last Tuesday carries effectively no HNDL…
CNSA 2.0 Compliance Audit Framework: A Checklist for Sub-Tier Defence Suppliers
The audit companion to the sub-tier supplier guide. Where that article answers what you must do, this one answers whether you have done it. A 7-domain…
PQC Migration Timeline: What to Do in 2025, 2026, 2027, and Beyond
The waiting period is over. NIST finalised FIPS 203, 204, and 205 on 13 August 2024. The NCSC published its phased UK migration timeline in March…
CNSA 2.0 Sub-Tier Supplier Guide: What to Do When Your Prime Has Not Told You
Prime contractors are working through their own CMMC Level 2 assessments. Sub-tier enablement gets deprioritised. The absence of a formal notification…
DORA and Post-Quantum Cryptography: What Financial Services ICT Risk Managers Must Know
DORA has been live since January 2025. Its ICT risk management framework explicitly names quantum advancements as a cryptanalytic threat category.…
FIPS 203, 204, and 205: An Enterprise Implementation Decision Map
Knowing what each NIST post-quantum standard requires is the first problem. Sequencing them correctly is the second. This article provides the…
CNSA 2.0 vs CNSA 1.0: What Changed and What Defence Suppliers Must Do Differently
NSA's CNSA 2.0 replaces CNSA 1.0's public-key algorithms entirely. Defence suppliers who cannot demonstrate CNSA 2.0 algorithm support will not…
Stay Informed
Subscribe to the QSECDEF newsletter for weekly updates on quantum security, new lecture recordings, and upcoming events.
Subscribe to Newsletter