For city and county CIOs and CISOs, heads of digital, transport and infrastructure directors, procurement leads, mayors' offices and the councillors who sign the budget
Be ready when the cabinet, the auditor or the regulator asks.
In fifteen minutes you will know which resident records and street systems are already exposed to harvest now, decrypt later collection, what NIS2, the Cyber Resilience Act, the EU wallet rules, the NCSC and the US agencies now expect of a city, and the first 90 days of a plan your chief executive or cabinet can approve.
Step 1 of 5
An adversary does not need a quantum computer to start on a city. It records the encrypted traffic between your cameras, controllers, portals and cloud now, and reads it when one arrives. A city holds two kinds of long-lived secret: the records of its residents, kept for years or decades under care, tax and benefits rules, and the keys and identities of the street itself, built into controllers and cameras that stay bolted to lamp posts for fifteen or twenty years. If the record or the asset outlives the algorithm protecting it, the exposure is already there.
| Record or asset type | How long it stays sensitive | Confidential until, if created in 2026 |
|---|---|---|
| Children's social care records (England) | Until the 75th anniversary of the child's birth | 2101 for a child born in 2026 |
| Council tax, benefits and housing records | Typically current year plus six, matching the six-year limit on recovery action | 2033 |
| Citizen identity credentials and biometrics (eID, the EU Digital Identity Wallet) | Useful to an attacker for the holder's lifetime; a face or fingerprint cannot be reissued | 2090s and beyond |
| ANPR reads in the National ANPR Service | Deleted after 12 months (National ANPR Standards, version 3.5) | 2027, but the live camera link is what gets recorded |
| Firmware signing keys and PKI roots in street assets (signal controllers, lighting, EV chargers, meters, building management) | Life of the asset, 15 to 20 years | 2041 to 2046 |
| Procurement records and contract documents | Three years from entry into the contract (Procurement Act 2023, section 98); commercially sensitive for the whole term | 2029 and the length of the contract |
Durations from the Care Planning, Placement and Case Review (England) Regulations 2010, the Council Tax (Administration and Enforcement) Regulations 1992, the National ANPR Standards and the Procurement Act 2023. Asset lives are typical, not statutory. Check the retention schedule your own authority publishes.
Signal controllers, CCTV and ANPR cameras, lighting central management, EV chargers and smart meters authenticate and sign firmware with RSA or ECC in hardware that is replaced every 15 to 20 years. Most of it was never designed to take a new algorithm.
You will know which asset classes can be updated in the field, which must be replaced, and how to write the next tender so the replacement is not exposed too.
The city data platform, the IoT backhaul, the integrator's cloud and the open data APIs run on TLS, OAuth tokens and signed datasets. Nothing moves until both ends move, and most of the ends belong to suppliers.
You will know which platforms, integrators and cloud providers set your timeline, and the questions that get a straight answer out of them.
Portals, payments, parking, permits and the digital identity residents will hold in a wallet from 2026 rest on digital signatures. Once a quantum computer exists, a forged credential is an immediate problem, not a future one.
You will know which identity, payment and portal services need a route to ML-DSA signatures, and which national schemes you depend on for it.
Free readiness check
Eight questions mapped to what your auditor, your regulator and your cabinet or council can ask. You get a score, your top three priorities and the next step that closes your biggest gap. Nothing is sent anywhere.
Start the checkStep 2 of 5
CISA, NSA, the FBI and the UK, Australian, Canadian and New Zealand cyber centres publish Cybersecurity Best Practices for Smart Cities on 19 April. DSIT publishes the Secure Connected Places playbook on 16 May, two years after the NCSC's connected places principles.
NIST publishes FIPS 203, 204 and 205 on 13 August. Member States had to transpose NIS2, which covers central and regional public administration, by 17 October. The Cyber Resilience Act enters into force on 10 December. MHCLG launches the Cyber Assessment Framework for local government.
CRA reporting obligations apply from 11 September. Member States must offer EU Digital Identity Wallets by year end and have national PQC roadmaps in place. NIST IR 8547 is final on 27 October.
From 11 December, connected products placed on the EU market must meet the CRA's essential requirements. Every sensor, controller and charger a city buys after that date is in scope.
EU high-risk use cases, including critical infrastructure, migrated by year end. The NCSC wanted discovery and a plan done by 2028. NIST deprecates RSA and ECC.
NIST disallows them. The NCSC timeline and the EU roadmap both end here. A signal controller installed in 2026 is still on the street.
You show: A migration lead across every directorate, a cryptographic inventory that includes the street, and a phased plan with the 2028, 2030 and 2035 milestones.
You show: A policy that addresses quantum cryptanalysis and names FIPS 203, 204 and 205, with review dates and an owner.
You show: Tender clauses requiring PQC roadmaps, crypto-agility and CRA conformity for every connected product and platform, in the categories where products already exist.
You show: Every controller, camera, light and charger listed with its algorithm, its update path and its replacement date.
UK councils. MHCLG's Cyber Assessment Framework for local government asks councils to identify essential services and critical systems, self-assess, get an independent assurance review and plan the fixes; it is voluntary and it does not yet name post-quantum cryptography, so the evidence an assessor expects comes from the NCSC timeline: discovery and a plan by 2028, highest-priority migration by 2031, complete by 2035. The Cyber Security and Resilience Bill, introduced on 12 November 2025 and still before Parliament, reforms the NIS Regulations 2018; a council is in scope only where it operates a regulated service, but the managed service providers it depends on are the Bill's target. Read the NCSC position explained.
NIS2 reaches central and regional public administration directly and lets each Member State bring local authorities in; the national transposition is the text to read. Article 21(2)(h) requires a policy on cryptography and encryption. The Interoperable Europe Act, Regulation (EU) 2024/903 of 13 March 2024, requires an interoperability assessment before a public body adopts new binding requirements and asks any body reusing a shared solution to assess its ability to manage its cyber security. From the end of 2026 your portals will be asked to accept the EU Digital Identity Wallet, whose signatures are a national scheme's problem and your dependency. Read the NIS2 analysis.
Street sensors, signal controllers, lighting nodes, EV chargers and meters are products with digital elements. Their manufacturers owe the CRA's essential requirements from 11 December 2027 and vulnerability reporting from 11 September 2026. A city cannot make a vendor ship ML-KEM, but it can refuse to buy a product with no algorithm update path and a 15-year life. Read what the CRA means for quantum-vulnerable products.
No federal order binds a city to a PQC date, but the direction is clear. Executive Order 14412 of 22 June 2026 sets 2030 and 2031 for federal high value assets, CISA's January 2026 product categories list where PQC products are already available, and the State and Local Cybersecurity Grant Program is the funding line a county IT director can point at. Use the federal language in your own procurement before a state mandate arrives.
Several cities and islands have deployed quantum key distribution across municipal fibre; André Xuereb's lecture on Malta's country-wide network is in the library below. QKD protects a point-to-point link between two trusted sites and nothing else: not the sensor at the kerb, not a signed dataset, not the resident's phone. A city that runs a QKD link still needs PQC. Read why QKD is not a substitute.
Public work aimed at connected places and local government, so you can reuse the language and benchmark your programme.
Published practical guidance on the Cyber Resilience Act ahead of the reporting obligations that apply from 11 September 2026.
Source: European Commission →Proposed targeted amendments to NIS2 to increase legal clarity and simplify compliance for the entities in scope.
Source: European Commission →Published its three-phase migration timeline to 2035, singling out operational technology and physical infrastructure for the constraints that infrequent replacement cycles impose.
Source: UK NCSC →Updated the Secure Connected Places playbook with a beta version shaped by local authority feedback: governance in a box, a principles primer, procurement and supply chain guidance, threat analysis and incident response.
Source: UK DSIT →Published Cybersecurity Best Practices for Smart Cities with the UK, Australian, Canadian and New Zealand cyber centres, recommending secure planning and design, proactive supply chain risk management and operational resilience.
Source: CISA →Published the Connected Places Cyber Security Principles for designing, building and operating a connected place, reviewed again in November 2024.
Source: UK NCSC →Step 3 of 5
Phases follow the EU roadmap and the NCSC timelines. For the street systems in the 2028 to 2031 phase, the full-day Quantum Security for Urban Mobility and Traffic Management Systems course works through signal control, SCADA, ANPR and V2X. For budget ranges, see our PQC migration cost benchmarks.
Need help delivering the plan? Our expert members are peer-reviewed suppliers, integrators and advisers. Meet the expert members →
Step 4 of 5
A migration succeeds or stalls on people. Match each role to the outcome you need from them, including the officers who write the tenders and the members who approve the budget.
$1,450 a seat · $1,087.50 for members
QSECDEF training · CPQCPM
Your brochure, the next cohort dates and the costs are ready on the next page.
Certified Quantum Business Professional
Self-paced, no physics background. Covers PQC, policy and PQC risk and migration management.
Free first session · included in membership
Get Session 1 freeIntroduction to Quantum Cyber Security
Six modules, 4 to 5 hours, certificated.
Free first module · included in membership
Get Module 1 freeQuantum-Safe Public Data Infrastructure and Open Data Security
Full day, 6 hours, in person or online. Covers PQC migration for FIWARE NGSI-LD context brokers, open data APIs and citizen portals, NIS2 Article 21 and GDPR Article 32, and procurement clause drafting for local authority IT contracts.
In person or online · enquire for dates and pricing
Enquire about this course Team membership brings your members, migration lead, security, platform and procurement teams up to speed together, tracks what each person has completed and certifies across the group. The business bootcamp and the Quantum Cyber Security course are included, plus 170+ expert lectures and the weekly call, and members pay less for CPQCPM.
See team membershipStep 5 of 5
A members-only structured Q&A for city CIOs and CISOs, heads of digital, transport and utility security leads, smart city programme directors and the elected members who sit on their boards. It runs under the Chatham House Rule and is facilitated by Anna Beata Kalisz Hedegaard, Founder of QSECDEF.
Practitioner lectures from the QSECDEF library that matter most to cities and local government: a country-wide QKD network, quantum-safe 5G and metro networks, cloud security after RSA, quantum optimisation for city operations, standardisation, legal frameworks and the mechanics of an inventory.
Expert Membership
Expert membership brings you into an open community working across sectors, opening up industry conversations, knowledge and access to experts. If you are building technology or consulting capabilities in this sector relevant to Quantum or Advanced AI, we want to hear from you.
Directly, only if your Member State says so. Directive (EU) 2022/2555 covers public administration entities of central government and, as each Member State defines it, regional government. Article 2(5) lets a Member State extend it to public administration entities at local level, and several have. A municipal water, district heating, transport or energy operator is a different matter: those are Annex I sectors in their own right, and the operator owes the Article 21 measures, including the policy on cryptography and encryption in Article 21(2)(h), whoever owns it. Read your national transposition, which was due by 17 October 2024, and note that the Commission proposed targeted amendments on 20 January 2026.
They are products with digital elements, so their manufacturers owe the CRA's essential cyber security requirements for anything placed on the EU market from 11 December 2027, and vulnerability and incident reporting from 11 September 2026. The Act does not name post-quantum algorithms. What it gives a city is leverage: a product with a 15-year life and no secure update path will struggle to show conformity, and a buyer is entitled to ask how the manufacturer will keep it secure through its support period. Write that question into the tender now rather than discovering the answer at acceptance.
Regulation (EU) 2024/1183 requires Member States to offer wallets to citizens by the end of 2026, and service providers that must identify their customers have to accept them. For a city that means the portal, the parking permit and the social care application will increasingly be authenticated by a credential whose signatures belong to a national scheme. Your exposure moves from your own identity provider to a dependency you do not control. Record it, ask the scheme operator for its post-quantum roadmap, and keep your own PKI and signing services on a route to ML-DSA for everything the wallet does not cover.
Children's social care records in England are kept until the child's 75th birthday. Adult safeguarding, housing, benefits and council tax files run years past the last contact; council tax recovery alone has a six-year window. Identity credentials and any biometric are useful to an attacker for the holder's lifetime. Traffic copied in 2026 and read in the 2030s lands well inside every one of those windows. The National ANPR Service deletes reads after 12 months, which is a reminder that the live link from camera to back office, not just the archive, is what an adversary records.
Because the back office runs on servers you can patch and the street runs on hardware you bolted to a pole. A signal controller, a lighting node or an EV charger installed in 2026 is expected to last 15 to 20 years, its cryptography is often in firmware with a fixed key store, and the NCSC singles out operational technology for exactly this reason: infrequent replacement cycles mean changes have to ride on planned maintenance. The practical answer is to classify every asset class as updatable in the field, replaceable on cycle, or isolate-and-wrap behind a gateway that can be migrated, and to fund the second category as capital rather than hoping for a firmware miracle.
The NCSC's guidance of 20 March 2025 sets the dates: discovery and an initial plan by 2028, highest-priority migrations by 2031, complete by 2035. MHCLG's Cyber Assessment Framework for local government is the place a council in England will be asked about it, through its self-assessment and independent assurance review, even though the framework does not yet name post-quantum cryptography. The Secure Connected Places playbook from DSIT and the NCSC's connected places principles cover the smart city estate. The Cyber Security and Resilience Bill, introduced on 12 November 2025, reforms the NIS Regulations 2018; a council is caught only where it runs a regulated service, but the managed service providers most councils depend on are its target.
Borrow the federal language. Executive Order 14412 of 22 June 2026 set 31 December 2030 for PQC key establishment and 31 December 2031 for signatures on federal high value assets, and CISA's January 2026 product categories list where PQC-capable products are already on the market. Put those requirements into your own procurement, use the CISA, NSA and FBI smart cities guidance of April 2023 for the planning, supply chain and resilience framing, and look at the State and Local Cybersecurity Grant Program, which has put $1 billion in front of state, local, tribal and territorial governments since FY2022, for the funding line.
Only through the contract, so the contract is where the work is. Ask every integrator, platform and cloud provider for a written post-quantum roadmap and the division of responsibilities under the shared responsibility model, write FIPS 203, 204 and 205 support and crypto-agility into every live tender and framework call-off, and require Cyber Resilience Act conformity evidence for connected products. The Third-Party Cryptographic Exposure Model on this page scores where the exposure sits. Peers in the Industry Conversation have found that a short questionnaire sent to every supplier at once produces more honest answers than one negotiation at a time.
For a small number of fixed links, possibly. Several cities and islands have run QKD across municipal fibre, and the lecture on Malta's country-wide network in the library shows what that takes. QKD protects a point-to-point link between two trusted sites and nothing else: not the sensor at the kerb, not a signed open dataset, not a resident's phone talking to the portal, and it needs its own authentication, which today means PQC. Treat it as a possible addition for a backbone link between data centres, not as a substitute for migrating the estate.
Name a migration lead with authority across council IT, transport, utilities and the smart city programme. Build a cryptographic inventory of the citizen portal, the data platform and the street assets they talk to. Map record types to retention periods and asset classes to replacement dates. Then send one post-quantum questionnaire to every integrator, platform and managed service provider. Those four steps give a chief executive or cabinet the evidence to set priorities and the number for the capital line.
Everything on this page. The two-minute readiness check scores your smart city and local government programme and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the OT Protocol Quantum Vulnerability Scanner, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.
It depends on the role. Councillors, cabinet members, mayors' offices and executive directors start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Council IT and security teams and transport and utility operations take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. City data platform managers and open data leads take Quantum-Safe Public Data Infrastructure and Open Data Security, the sector course for city data platforms, open data APIs and citizen portals. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.
Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your data platform, mobility and utility teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.
Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.
Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving smart cities and local government who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.
No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services and we are independent of any city's suppliers.
CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The smart city courses, including the public data infrastructure and urban mobility courses, are full days of six hours, in person or online. The business bootcamp is self-paced at your own speed.
The free weekly call runs every Tuesday at 15:00 CET. Bring your question.
Join the Tuesday call →
For your organisation
When your cabinet, your transport authority or your smart city board needs something specific, we shape the workshop, the training or the engagement around your systems, your retention rules and your capital cycle. Independent of any vendor and of any integrator.
Facilitated sessions for cabinets, audit and governance committees, mayors' offices and smart city boards, drawn from the six-session smart city programme and built on your own exposure, obligations and 2030 plan.
Private CPQCPM cohorts, live online or in person for your required delegates, with the public data infrastructure and urban mobility courses for your platform, transport and utility teams.
Cryptographic inventory, street asset lifecycle review, PQC migration planning and specialist teams sourced from 1,500+ members across 900+ organisations.
Prefer email? Write to info@qsecdef.com and tell us about your timeline.
Photos: Pexels (Yam Daisy, ThisIsEngineering, Atypeek Dgn, apertur 2.8, Christian Wasserfallen, ammar abbas, K, Mikhail Nilov) and QSECDEF, converted to black and white or brand duotone.
