Post-quantum regulations are turning a distant cybersecurity threat into concrete deadlines. Although governments are clustering around 2030, differences in scope leave multinational organizations facing multiple migration paths.
Australia is pursuing complete migration, while Scandinavian and Baltic countries are generally following European Union timelines for roadmaps and high-risk systems, according to Naomi Wynn (pictured, right), chief executive officer of National Energy Public Key Infrastructure (NEPKI), and Jostein Stokkan (center), product manager of service offerings at Atea Norge AS. In the United States, Executive Order 14412 requires federal agencies to name post-quantum cryptography migration leads and transition high-value assets and high-impact systems to PQC for key establishment by Dec. 31, 2030.
“When it comes to PQC, we’re actually leading the charge in terms of a regulatory sense,” Wynn said. “The Australian Signals Directorate and the Australian Cyber Security Centre have requested full PQC compliance and complete migration by 2030.”
Wynn and Stokkan spoke with Dean Coclin (left), senior director and digital trust specialist at DigiCert Inc., at DigiCert’s World Quantum Readiness Day, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how regional mandates are shaping migration priorities and accountability. (* Disclosure below.)
Post-quantum regulations turn deadlines into roadmaps
Countries are also developing different post-quantum standards, creating complexity beyond regulatory deadlines. Organizations operating across jurisdictions may need to accommodate changing algorithms and requirements, according to Stokkan.
“I think [different standards] will affect [PQC],” Stokkan said. “But if we can help organizations to become more crypto agile, to be able to adapt to different types of encryption as they become important or just change, I think everything will be smoother and easier for all parties.”
Even as post-quantum regulations accelerate planning, organizations face unresolved implementation questions. That uncertainty is likely to shape the next phase of migration work, according to Wynn.
“There is no one-size-fits-all; there is no template,” she said. “But I’m hoping that by this time next year … we are seeing improved guidance as well in terms of what expectations are, what is good enough [and] what will actually meet the requirements.”
Register for free to watch the complete video interview, part of SiliconANGLE’s and theCUBE Research’s coverage of DigiCert’s World Quantum Readiness Day.
(* Disclosure: TheCUBE is a paid media partner for DigiCert’s World Quantum Readiness Day. Neither DigiCert, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)
