Quantum risk in chemicals

Yes. Chemicals is one of the other critical sectors in Annex II, which makes medium and large manufacturers, producers and distributors of chemical substances important entities, and a site that also operates a refinery, a gas terminal or a hydrogen plant is an Annex I energy entity as well. Article 21 then requires ten measures, including supply chain security and policies on the use of cryptography and, where appropriate, encryption, and Article 20 makes the management body approve and oversee them. Member States had until 17 October 2024 to transpose the directive, so the obligations now sit in national law.

Not in those words. Seveso III, which applies to over 11,000 installations across the EU, and COMAH 2015 in Great Britain are safety regimes: they ask an operator to prevent major accidents and limit their consequences through a major accident prevention policy and, for upper-tier sites, a safety report and a safety management system. The link to cryptography is that a control or safety system which can be reached, altered or impersonated is a major accident hazard, and in Great Britain HSE's operational guidance OG86 is how an inspector examines that. Put the cryptographic dependency of the SIS and the BPCS into the safety case and the modification plan, and the inspector's question has an answer.

Mostly not today, and that is fine as long as you know it. A logic solver certified under IEC 61511 changes only through the safety lifecycle, with a documented modification and a proof test, so the realistic plan is to separate its trust chain from the basic process control system now, protect every path into it with hybrid key exchange at the boundary, and schedule the algorithm change for the turnaround at which the vendor's firmware supports it. The ICS course works through the Purdue model layer by layer, including the Level 0 to 2 deferral strategy.

Because the recipe does not expire. A formulation, a catalyst system or a set of reaction conditions stays valuable for as long as the product sells, which in agrochemicals and speciality chemicals can be decades, and a trade secret has no legal end date. Any transfer of that recipe over RSA or ECDH key exchange, to a toll manufacturer, into a PLM system or across a vendor's remote tunnel, can be recorded today and read once a cryptographically relevant quantum computer exists. The HNDL Risk Calculator shows how far your data outlives the algorithm protecting it.

Two things. The analysers, sensors, dosing equipment, gateways and software you buy will have to meet the CRA's essential requirements when placed on the EU market from 11 December 2027, so your automation specification can ask for them now. And if you sell a connected product of your own, such as a smart dispensing system or monitoring device, you are a manufacturer under the Act, with vulnerability reporting from 11 September 2026 and a technical file that has to say how the product's cryptography can change during its support period.

Congress allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards to lapse on 28 July 2023. CISA can no longer require Top-Screens, inspect or enforce, which affected the 3,200 facilities previously designated as high-risk. Nothing has replaced it yet; CISA offers the voluntary ChemLock programme instead. The sector's own lesson came in January 2024, when the Chemical Security Assessment Tool was breached through an Ivanti appliance: CISA found no evidence of exfiltration and said the data was encrypted with AES-256, which is the symmetric part that holds up against a quantum computer. The remote-access path that let the attacker in is the part that does not.

Any that use RSA or ECDSA for key exchange, certificates or authentication: OPC UA security modes, TLS to historians, batch servers and MES, the VPN or remote-support tunnels your vendors use, and the EDI and AS2 links to suppliers and carriers. Modbus/TCP and PROFINET carry no cryptography at all, which is a different problem, and the symmetric parts such as AES-256 hold up. The OT Protocol Quantum Vulnerability Scanner maps this for the protocols you select.

More than the plant, usually. Toll manufacturers run your process under licence and hold the recipe. Raw material suppliers exchange orders over EDI with RSA key exchange. Carriers and terminals receive hazardous goods documentation, and customers trust a signed certificate of analysis for every batch. Any of that traffic recorded now is readable later, and a forged signature on a batch certificate arrives in a customer's plant as your product. NIS2 Article 21 puts supply chain security on your list, and your largest customers will flow their own requirements down. Start with the Third-Party Cryptographic Exposure Model and a questionnaire to every licensor and toll manufacturer.

With a cryptographic inventory that spans control, safety, site and enterprise systems; a map of which formulations, recipes and records must stay confidential beyond 2030; a classification of controllers and logic solvers by whether they can change algorithm by update, at a turnaround or not at all; and roadmaps requested from every automation vendor, licensor and toll manufacturer. Those four give the board the evidence to set priorities and fit the work to the turnaround calendar and the safety lifecycle.

Everything on this page. The two-minute readiness check scores your site and supply chain security programme and routes you to the right next step. The free tools, including the OT Protocol Quantum Vulnerability Scanner and the HNDL Risk Calculator, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Boards and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, risk and IT teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. OT and process control engineers, process safety leads and IT/OT integration teams take PQC Migration for Industrial Control Systems, the sector course for SCADA, DCS and ICS environments, and procurement and supplier security teams take Quantum-Safe Supply Chain Security for Manufacturers. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your OT, process safety and supply chain teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving chemicals who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The industrial courses are listed with their formats on the training pages: the ICS course is a half day of three hours, the supply chain workshop a full day of six hours.