Insights that help security teams make better decisions.

US federal PQC is no longer inventory-only. EO 14412 and OMB M-26-15 set HVA key establishment by 2030 and signatures by 2031. CNSA 2.0 covers national security systems. Here is who is in scope and what to do first.

The UAE has no single cryptography law either, but a more prescriptive, sector-specific landscape than the EU or UK: NESA's IAS, DESC's ISR v2, CBUAE's brand-new Regulation C 1/2026, the PDPL, and a real national post-quantum migration program launched in 2026.

Switzerland has no single PQC statute. NCSC's technology briefs say start now; FINMA Guidance 05/2026 expects a board-backed roadmap by mid-2027, with inventory, crypto-agility and harvest-now-decrypt-later prioritisation.

What Commission Implementing Regulation (EU) 2024/2690 actually requires for cryptography and crypto-agility under NIS2, who it applies to, and what it leaves to member states.

BSI TR-02102-1 version 2026-01 names migration dates: classical-only key agreement ends 2031, high-protection systems by 2030, signatures by 2035. Here is who is in scope under BSIG and what to do first.

What DORA Articles 9-13 and the RTS on ICT risk management actually require for encryption, key management and crypto-agility, with a concrete technical checklist.

What DORA expects for encryption and key control: ICT risk, third-party concentration and evidence boards can defend, without surrendering keys to the cloud.

Build a funded post-quantum migration roadmap: inventory crypto, rank business impact and sequence algorithm change without freezing delivery.

Plan a Vault-to-OpenBao migration after HashiCorp BSL: keep the API, cut licensing cost and protect unseal keys with customer-held MPC.