Quantum risk in telecoms, media and broadcasting

Yes. NIS2 brought providers of public electronic communications networks and services into the essential-entity regime alongside the digital infrastructure sector, and Member States had until 17 October 2024 to transpose it. Article 21 lists the risk-management measures every entity must take, and one of them is a policy on the use of cryptography and, where appropriate, encryption. The EU roadmap of June 2025 tells national authorities what good looks like: a national plan by the end of 2026 and high-risk use cases migrated by the end of 2030. Expect your competent authority to ask how your cryptography policy handles algorithm deprecation. The older Article 40 of the European Electronic Communications Code already asked providers for appropriate and proportionate measures, including encryption where appropriate.

Until July 2026, nothing explicit. The Code of Practice of 1 December 2022 sets out measures under the Electronic Communications (Security Measures) Regulations 2022, with Tier 1 deadlines of 31 March 2024, Tier 2 deadlines of 31 March 2025, third-party supplier measures on all contracts by 31 March 2027 and a final group by 31 March 2028. Version 1.1 of 14 July 2026 adds, under encryption and the protection of data, that approved algorithm standards may change as new ones are introduced and old ones deprecated in response to the threat to cryptography from quantum computing, and that NCSC algorithm profiles may change too. Read it with the NCSC timeline: discovery and a plan by 2028, priority migration by 2031, complete by 2035. Ofcom enforces the duties, with fines of up to ten per cent of turnover.

Studying, with normative work to follow. SA3 catalogued the cryptography in the 5G standard in TR 33.938 and opened TR 33.703, Study on transitioning to Post Quantum Cryptography in 3GPP, under Release 20; it reached version 20.1.0 in September 2026. SA3 has also specified 256-bit algorithm sets, SNOW 5G, AES and ZUC, in TS 35.240 to TS 35.248 for Release 20 to counter the halving of symmetric strength by Grover's algorithm. Protocols 3GPP borrows from the IETF, such as TLS, IPsec and PKI, migrate as the IETF profiles do; 3GPP-specific constructions such as SUCI calculation and MIKEY-SAKKE need their own work. Release 20 is expected to freeze by mid-2027 and Release 21 to complete not before early 2029, so an operator waiting for the standard before starting will start late.

Two documents. PQ.01, the Post Quantum Telco Network Impact Assessment Whitepaper of 17 February 2023, takes 5G as its baseline and asks every operator to build a cryptographic inventory across its own systems and its vendors' products, to run a cryptography risk assessment and to develop a transition plan. PQ.03, Post Quantum Cryptography Guidelines for Telecom Use Cases version 2.0 of 4 October 2024, turns that into a phased migration and works through the use cases one by one: physical SIM, remote eSIM provisioning, 5G transport security, SD-WAN, cloud, IoT, lawful intercept and retained data, device firmware and the privacy of customer data. Use the PQ.03 use-case list as the structure of your inventory and your supplier questionnaire.

Anything an adversary can record at an interconnect and that stays sensitive longer than the algorithm protecting it. Signalling and roaming exchanges carry subscriber location and authentication data, and a person's movement history never stops being sensitive. Lawful intercept product and the warrants behind it are protected for the life of the investigation and the source. Communications data held under a UK retention notice is capped at 12 months by section 87 of the Investigatory Powers Act 2016, but the recording an adversary made of it is not. Long-term SIM keys are the sharpest case: recover one and every session it authenticated becomes readable.

The long-term key itself is symmetric and survives, provided it is long enough. What changes is everything around it: the public-key cryptography in SIM provisioning and remote eSIM provisioning, the SUCI concealment of the subscriber identifier, and the certificates in the profile. GSMA PQ.03 treats physical SIM and remote eSIM provisioning as separate customer-impacting use cases and has identified actions for both. The EU 5G Toolbox of January 2020 had already named eSIMs and related cryptographic material as a candidate for EU-wide certification under measure TM09. Plan for profile and provisioning changes on the normal SIM refresh cycle rather than a recall.

As a product line, perhaps; as the migration, no. QKD distributes keys between two fixed points over dedicated fibre or a satellite link. It does not authenticate a handset, protect a roaming exchange or sign firmware, and the NCSC, BSI and ANSSI all put post-quantum algorithms first. ETSI's GS QKD 016 protection profile of January 2024 gives you a Common Criteria basis to evaluate vendors if you do proceed, and several QSECDEF members have built national QKD networks on operator fibre; their lectures are linked above. The QKD Network Readiness Qualifier tells you in a few minutes whether your fibre and your use case justify the cost.

It makes the manufacturer responsible for the cryptography inside them. The CRA entered into force on 10 December 2024, its reporting obligations apply from 11 September 2026 and its main obligations on products with digital elements from 11 December 2027. An operator or broadcaster that ships customer premises equipment under its own brand is a manufacturer for these purposes. Devices sold from 2028 will still be in homes in the mid-2030s, when RSA and ECC are disallowed, so the firmware signing and update chain you specify now has to be able to change algorithm. The UK Code of Practice already puts customer premises equipment measures on all contracts by 31 March 2027.

Three things. Content protection chains use public-key cryptography to issue licences and bind keys to devices, so recorded licence traffic for content with a long commercial life, studio libraries, sports archives and embargoed news, is exposed in the same way as signalling. CDN delivery runs on TLS whose key exchange is quantum-vulnerable until your CDN provider migrates. Archive integrity rests on digital signatures that have to be re-signed before the algorithm is broken. None of the major DRM systems had published a post-quantum roadmap when we last checked, so the question has to come from the content owner. The sector courses on DRM and content authentication, CDN and streaming infrastructure, and archive integrity each take a day on one of the three.

Through your equipment. CNSA 2.0 binds US national security systems, but it sets dates for the product categories vendors sell everywhere: traditional networking equipment such as VPNs and routers should support and prefer quantum-resistant algorithms by 2026 and use them exclusively by 2030. Vendors serving US government customers build to those dates, so the firmware your routers and gateways receive will carry ML-KEM and ML-DSA on that schedule whether or not you asked. Knowing the dates lets you plan the upgrade rather than discover it.

With a cryptographic inventory of the 5G core, the N32 and Diameter interconnects, IPsec backhaul, PKI, SIM provisioning and the content protection chain; a map of which data must stay confidential beyond 2030 against the algorithms protecting it; each interface placed in a GSMA PQ.03 use case with the standards timeline that governs it; and PQC roadmaps requested from every equipment vendor, SIM supplier, DRM and CDN provider and roaming partner. Those four give the board the evidence to set priorities and the regulator the evidence it will ask for.

Everything on this page. The two-minute readiness check scores your network or content operation and routes you to the right next step. The free tools, including the Third-Party Cryptographic Exposure Model and the QKD Network Readiness Qualifier, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Boards, executives and heads of regulatory affairs start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, risk and IT teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. Core network, signalling and security architects take PQC Migration for 5G Signalling and Authentication Protocols, the sector course on the 5G stack, 3GPP Release 20 and the GSMA guidelines; content security teams have sector courses on DRM, CDN and archive integrity. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your core network, transport and content security teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving telecoms, media and broadcasting who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The telecoms and digital media courses are full days of six hours each, listed with their formats on the training pages.