Which US Federal Post-Quantum Deadline Binds You
Federal post-quantum policy now sets dates, not intentions. Five June 2026 documents assign different deadlines to different system classes. Here is how to find…
Third-Party Cryptographic Risk at Enterprise Scale
Regulators require an inventory of cryptography your suppliers are not obliged to disclose. Four governance artifacts that close the gap and keep third-party PQC…
The CISO, the Three Lines, and Who Owns PQC Migration
Reporting lines say little about what a CISO controls. Who leads post-quantum migration depends on where the cryptographic estate sits and on decision rights…
CNSA 2.0 Explained: A Compliance Reading for GRC Teams
CNSA 2.0 is the one post-quantum directive written like a control rather than a goal: named algorithms, fixed parameter levels, dated procurement gates. A…
What Vendors Do When You Ask Hard Questions
A technical question deserves a technical answer. When a quantum security vendor substitutes something else, the substitution is your finding. A field guide to…
The Two Dates in NIST IR 8547 That Govern Your Migration Plan
NIST IR 8547 is usually reduced to 2035. It sets two dates, and the earlier one is already shaping procurement and risk acceptance decisions.
NIS2, DORA, and the Evidence a Supervisor Will Ask For
European post-quantum regulation rarely says "deploy PQC by date X." It says produce the file. Here is what that file contains, and what your…
What Actually Binds You in the US Post-Quantum Rulebook
Statutes, executive orders, OMB memoranda, federal standards, acquisition rules and standard of care all bind differently. A field guide to sorting them, with three…
Six Control Points in a Rented Quantum Computer
Most organisations will rent quantum access, not own it. Six control points decide how much sovereignty survives the contract, and each one is negotiable.
Deemed Exports: When Explaining Your Quantum Work Becomes an Export
Since September 2024, a screen share with a foreign colleague can require a US export license. What deemed export rules mean for quantum teams,…