Workshop Description
The quantum security regulatory landscape is fragmenting. NIST finalised three post-quantum cryptography standards in August 2024 (FIPS 203, 204, 205) with a fourth (FIPS 206) in draft. ETSI has published quantum-safe cryptography migration strategies and QKD interoperability specifications through its ISG QSC and ISG QKD working groups. The US has issued binding migration mandates through NSM-10, requiring federal agencies to inventory cryptographic systems and submit migration plans. The UK NCSC has published phased PQC migration guidance aligned with GovAssure. The EU Cybersecurity Act is developing quantum readiness requirements through ENISA. These frameworks overlap, sometimes conflict, and carry different enforcement timelines.
This workshop provides a structured comparison of every major regulatory framework affecting quantum security compliance. Delegates learn which standards apply to their jurisdiction, where frameworks diverge on algorithm selection and hybrid key exchange, and how to build a compliance roadmap that satisfies multiple overlapping requirements. The session is designed for professionals who must advise boards and regulators on quantum security obligations rather than implement the cryptography themselves.
What participants cover
- NIST FIPS 203 (ML-KEM), 204 (ML-DSA), 205 (SLH-DSA): standard scope, parameter sets, and compliance implications for procurement and audit
- ETSI quantum-safe specifications: TS 119 312 signature suites, TR 103 619 migration strategies, ISG QKD interoperability standards
- US NSM-10 and CNSA 2.0: federal agency migration deadlines, CISA reporting obligations, and the ML-KEM + X25519 hybrid mandate
- UK NCSC PQC migration guidance: phased approach, GovAssure integration, and Crown Commercial Service procurement alignment
- EU Cybersecurity Act quantum dimensions: ENISA PQC readiness guidance and NIS2 Directive interaction with quantum risk
- Cross-jurisdictional compliance: where NIST, ETSI, ANSSI, BSI, and CSA frameworks diverge and how to manage conflicting requirements