The Two Dates in NIST IR 8547 That Govern Your Migration Plan
NIST IR 8547 is usually reduced to 2035. It sets two dates, and the earlier one is already shaping procurement and risk acceptance decisions.
How to Estimate Post-Quantum Migration Effort
Two planners can size the same estate at 2,000 tasks and 120,000. Here is the unit to count, the ratio that catches a bad…
Sequencing the Waves in a Post-Quantum Migration
Scope is not what sinks a post-quantum program. Order is. A practical guide to gates, dependencies, and how to cut a migration wave that…
The Real Size of a Post-Quantum Migration
One published program plan for a post-quantum migration runs to more than 120,000 scheduled tasks. Here is where the small estimate loses the work.
What a CBOM Scoping Exercise Finds Inside One Mobile Banking Payment
A payment from a phone crosses up to nine institutional boundaries. Only some of them are yours to inventory. Here is how a CBOM…
NIS2, DORA, and the Evidence a Supervisor Will Ask For
European post-quantum regulation rarely says "deploy PQC by date X." It says produce the file. Here is what that file contains, and what your…
Where Telecom Operators Should Start
The algorithms are settled. What stops most carriers is that nobody can yet read a cryptographic inventory and say which findings matter first.
What Actually Binds You in the US Post-Quantum Rulebook
Statutes, executive orders, OMB memoranda, federal standards, acquisition rules and standard of care all bind differently. A field guide to sorting them, with three…
Rethinking the CBOM
Complete cryptographic inventory is a mirage. A Minimum Viable CBOM maps trust boundaries first, records what you don't know, and produces migration decisions instead…
Q-Day Is a Confidence Crisis, Not an Outage
The morning a quantum computer factors an RSA-2048 key, nothing goes dark. What ends is the presumption of safety, and the questions start within…