Why Regulators Now Care About Your Cryptography
Cryptography used to be an engineering detail. Payment standards, financial supervisors and governments now ask for evidence about it. Here is why, and what kinds of rules exist.
KNOWLEDGE HUB / REGULATION
Cryptography Compliance
What PCI DSS, DORA and government roadmaps expect from organizations on cryptography and quantum readiness.
PCI DSS 12.3.3 In Plain Language: The Cryptographic Inventory You Already Owe
PCI DSS requirement 12.3.3 asks for a reviewed inventory of the cipher suites and protocols you use. Here is what it covers, what an assessor will look for and how it links to quantum readiness.
DORA's Cryptography Rules: What Articles 6 And 7 Of RTS 2024/1774 Ask For
The DORA technical standards on ICT risk require an encryption policy, full key lifecycle management and a certificate register. Here is what each paragraph asks for and the evidence that supports it.
The Global Quantum Deadline Map: 2030, 2031 And 2035
Governments and supervisors have published post-quantum migration dates that cluster around the same few years. Here is what each date means, who it applies to and how binding it is.
US Federal PQC Policy From NSM-10 To The June 2026 Executive Order
US post-quantum policy moved from planning in 2022 to dated migration deadlines in 2026. Here is each instrument in order, what it added and why it matters beyond government.
CNSA 2.0 And National Security Systems: What Suppliers Need To Know
US national security systems follow a separate post-quantum track run by NSA under CNSA 2.0, while other federal rules now reach contractors. Here is how the two tracks fit together for suppliers.
EU Cryptography Rules Beyond DORA: The Recommendation, Roadmap, NIS2 And CRA
The EU has no single post-quantum law. Instead, a Commission Recommendation, a Member State roadmap, NIS2 and the Cyber Resilience Act each play a part. Here is how they fit together.
What Financial Supervisors Are Signalling On Quantum Risk
Central banks and financial supervisors are moving from awareness to specific asks on quantum risk. Here is what the G7, SAMA, MAS, FINMA, OSFI, the HKMA and Europol's forum have said, and how binding each is.
UAE And GCC Cryptography Rules, And One Inventory For Many Regulators
The UAE National Encryption Policy and SAMA's quantum circular set the Gulf's direction on cryptography. This article explains both, then shows how one inventory can answer several regulators.