Sign in Subscribe

PQC Information

Post-quantum cryptography news and analysis for security and compliance professionals.

PQC and SOX Compliance: What Public Companies Must Prepare For in 2026

PQC and SOX Compliance: What Public Companies Must Prepare For in 2026

TLS 1.0 was never explicitly listed in SOX. Neither was SHA-1. But ask any public company compliance officer who lived through the 2015–2018 deprecation cycle, and they will tell you exactly how fast "industry best practice" becomes an auditor's control deficiency. Post-quantum cryptography is

PQC Migration Cost: A Budget Framework for Finance Teams and CISOs

PQC Migration Cost: A Budget Framework for Finance Teams and CISOs

PQC Migration Cost: A Budget Framework for Finance Teams and CISOs NIST has finalized the algorithms. The DoD has set a hard deadline. The governance framework — published in draft form as NIST CSWP 48 in September 2025 — now maps post-quantum cryptography migration capabilities directly to CSF 2.0 and SP

PQC and HIPAA: What Healthcare Compliance Officers Must Do Before the Security Rule Rewrites the Rules

PQC and HIPAA: What Healthcare Compliance Officers Must Do Before the Security Rule Rewrites the Rules

You are already behind on one encryption overhaul. The proposed HIPAA Security Rule rewrite will convert previously "addressable" ePHI encryption safeguards into hard requirements — and the target finalization date is May 2026.[Federal Register, HIPAA Security Rule NPRM, 2024] If your organization is rebuilding cryptographic controls to meet

What Is Post-Quantum Cryptography? The Practitioner's Guide for CISOs and Security Architects

What Is Post-Quantum Cryptography? The Practitioner's Guide for CISOs and Security Architects

Your organization's encrypted data is being stolen right now — not to be read today, but to be decrypted the moment a cryptographically relevant quantum computer (CRQC) comes online. Nation-state adversaries running "harvest now, decrypt later" (HNDL) operations do not need a quantum computer to collect your

What Is Crypto Agility and Why Every Enterprise Needs It Before 2030

What Is Crypto Agility and Why Every Enterprise Needs It Before 2030

Your organization probably completed a TLS 1.3 upgrade, rotated some certificates, and called it a cryptographic refresh. That approach worked when the threat model was static. It will not work in 2026, when NIST's finalized post-quantum standards are triggering real procurement and compliance obligations, adversaries are already

FedRAMP and PQC: How to Manage Cryptographic Migration Inside FedRAMP's POA&M Framework

FedRAMP and PQC: How to Manage Cryptographic Migration Inside FedRAMP's POA&M Framework

Your FedRAMP authorization is under pressure from two directions at once. RFC-0026 has not been released or finalized; current FedRAMP RFCs are numbered 0019-0024 as of January 2026, with no RFC-0026 documented.[Government Contracts Legal Forum] Simultaneously, NIST finalized FIPS 203, 204, and 205 in August 2024, giving federal agencies

CNSA 2.0 Compliance Deadlines by System Type: The Complete Deadline Matrix for Government and Defense Teams

CNSA 2.0 Compliance Deadlines by System Type: The Complete Deadline Matrix for Government and Defense Teams

If your team is tracking CNSA 2.0 as a single 2030 or 2033 deadline, you are already behind on your most immediate obligation. The NSA's Commercial National Security Algorithm Suite 2.0 framework is a phased, system-specific mandate — and the first hard gate, January 1, 2027, falls