6 stories
Show: Summaries / Headlines only
Federal ministries and the BSI want migration owners, binding plans, and a first cryptographic inventory in place by December 31, 2026. They asked public-sector and critical-infrastructure bodies to adopt the dates as bindingly as possible.
None of the 24 agencies GAO audited had fully carried out three preparatory steps for post-quantum migration. At six sampled agencies, none could document the algorithms listed for every sampled system.
With TU Berlin's TrustBOM, a software provider can prove that listed packages are absent from its SBOM without sharing it. The researchers wrote that the guarantee covers only the SBOM as generated, which an SBOM tool can get wrong.
In a circular dated August 27, SAMA required supervised institutions to make their procedures for identifying and classifying cryptographic assets accurate and comprehensive by the end of 2026, ahead of a quantum risk assessment due in March 2027.
Seventy-one percent of responding institutions had neither conducted nor planned a test of post-quantum cryptography. The HKMA framed its 2030 goal as an aim for the whole sector and listed four first steps banks can take now.
Executive Order 14412 set December 2030 and December 2031 post-quantum deadlines for federal agencies, and NSA dates bind national security systems. Outside those systems, the measures reviewed here would date a company's duty through a FAR rule not yet proposed.
