Government Mandates for Quantum-Safe Encryption

Governments worldwide are turning quantum-safe encryption from a recommendation into a requirement. Understanding the regulatory landscape is now essential for compliance — and for doing business across borders.

United States

• NSM-10 (2022): a National Security Memorandum directing federal agencies to inventory cryptographic systems and plan migration to PQC.
• OMB guidance: requires agencies to report progress and prioritise long-lived data.
• NIST FIPS 203/204/205: the federal post-quantum standards, mandatory for federal information systems.
• CISA: publishes PQC readiness guidance for critical infrastructure.
• Sector regulators: financial (FFIEC, NYDFS) and health (HHS) are beginning to address quantum risk.

Federal contractors and critical infrastructure operators are effectively required to move toward quantum-safe cryptography.

European Union

• ENISA: publishes post-quantum cryptography guidance and threat reports.
• EU Cybersecurity Act: will allow certification schemes that may include PQC requirements.
• NIS2 Directive: broad cybersecurity obligations for critical and important entities — quantum risk fits within risk-management duties.
• eIDAS 2: digital identity infrastructure that will need post-quantum signatures.
• National authorities (BSI in Germany, ANSSI in France) issue migration guidance aligned with NIST standards.

United Kingdom

• NCSC: publishes clear guidance prioritising hybrid post-quantum TLS and a phased migration.
• Emphasis on crypto-agility and protecting long-lived data.
• Alignment with NIST standards for interoperability.

Israel

• INCD (Israel National Cyber Directorate): issues guidance on post-quantum migration for critical sectors.
• Strong defence-tech sector driving early adoption.
• Alignment with NIST and international standards.

APAC

• Singapore: CSA and IMDA actively promote PQC readiness.
• Japan: NICT and METI publish migration roadmaps.
• South Korea: KISA runs PQC standardisation and pilots.
• Australia: ASD's Information Security Manual addresses cryptographic modernisation.

Sector-Specific Pressure

• Finance: central banks and regulators (BIS, ECB, NYDFS) are studying quantum risk to financial stability; some require scenario planning.
• Healthcare: long-lived patient records make quantum risk acute; HIPAA-aligned guidance is evolving.
• Defence and critical infrastructure: often subject to the earliest mandates.
• Telecoms: standards bodies (3GPP, ETSI) are integrating PQC into future network standards.

What This Means for You

• If you operate across regions, you must satisfy the strictest applicable requirement.
• If you are a supplier to government or large enterprise, expect contractual quantum-readiness clauses.
• If you hold long-lived sensitive data, regulators increasingly expect you to have assessed quantum risk.
• If you do nothing, you risk non-compliance, lost contracts and liability as guidance hardens into law.

How to Stay Compliant

1. Track guidance from NIST, ENISA, NCSC, INCD and your sector regulator.
2. Maintain a cryptographic inventory and migration plan — regulators ask for evidence.
3. Adopt NIST PQC standards as they are finalised.
4. Use hybrid deployment to satisfy "reasonable steps" expectations during transition.
5. Document your quantum-risk assessment and decisions.

Bottom Line

Quantum-safe encryption is moving from best practice to legal expectation. The specifics vary by region and sector, but the direction is universal: organisations that hold sensitive, long-lived data are expected to assess quantum risk and migrate. Treating this as a compliance programme now will save far larger costs later.