Regulatory & Compliance
Understanding the evolving landscape for quantum-safe cryptography
Regulatory frameworks worldwide are evolving to address quantum threats. Fira helps organisations navigate these requirements and implement compliant solutions.
EU Regulatory Framework
Cyber Resilience Act (CRA) ↗
Mandatory cybersecurity requirements for all products with digital elements sold in the EU. Requires manufacturers to handle vulnerabilities effectively throughout a product's lifecycle. PQC readiness becomes relevant as quantum threats are explicitly recognised.
NIS2 Directive ↗
Expanded scope covering more sectors and stricter security requirements. Requires "state of the art" security measures — PQC is increasingly interpreted as meeting this threshold.
eIDAS 2.0 ↗
Updated electronic identification and trust services regulation. Qualified electronic signatures must remain secure over their validity period — PQC signatures are essential for long-term validity.
GDPR (Article 32) ↗
Requires "appropriate technical measures" for data protection. As PQC becomes available, failure to adopt may constitute inadequate protection.
ENISA Recommendations ↗
Published PQC migration guidance recommending hybrid approaches and early preparation. Fira's methodology aligns with ENISA's recommended migration path.
UK Regulatory Framework
NCSC Guidance ↗
UK National Cyber Security Centre recommends organisations begin PQC planning now. "Prepare, don't panic" — but preparation means concrete technical steps, not just awareness.
UK Cyber Security Strategy ↗
Quantum threat explicitly identified. Government departments expected to lead by example.
Financial Conduct Authority (FCA) ↗
Operational resilience requirements increasingly interpreted to include quantum-readiness for long-lived encrypted data.
International Standards
NIST FIPS 203/204/205 ↗
Finalised August 2024. ML-KEM (key encapsulation), ML-DSA (digital signatures), SLH-DSA (hash-based signatures). These are the definitive PQC standards.
US NSM-10 ↗
National Security Memorandum requiring federal agencies to inventory cryptographic systems and prepare migration plans.
ISO/IEC Standards ↗
Standards bodies actively developing PQC integration standards for international alignment.
Greek Public Sector Context
- ΕΣΗΔΗΣ procurement framework requirements for information security
- Compatibility with Ελληνικό Σχήμα Πιστοποίησης (Greek Certification Scheme)
- Alignment with National Cyber Security Strategy (Εθνική Στρατηγική Κυβερνοασφάλειας)
- eIDAS / ΑΔΔΥ requirements for qualified electronic signatures
- PQC modules documentation for τεκμηρίωση τεχνογνωσίας in RFP submissions