Resources for cryptographic security and PQC readiness.
Practical articles, research and primary sources for cryptographic inventory, CBOMs and post-quantum migration.
Featured articles and references
Read published Qinsight analysis on cryptographic inventory, CBOMs, crypto-agility and post-quantum migration.
FRAMEWORK
Post-Quantum Migration: A Practical Five-Stage Framework
A practical framework from cryptographic discovery and prioritization to verified migration and continuous crypto-agility.
Read the articleEXPLAINER
What is a Cryptographic Bill of Materials (CBOM)?
Understand what a CBOM records and how it supports visibility into the cryptography used in software.
Read the articleANALYSIS
Crypto-Agility and the Growing Gap Between Risk and Response
Explore the capabilities needed to adapt cryptography while preserving business operations.
Read the articlePRACTICE
The Four Pillars of Cryptographic Hygiene
Establish ownership, maintain a cryptographic inventory, and manage key and certificate lifecycles.
Read the articlePLAYBOOK
Post-Quantum Readiness Starts With Evidence
A migration playbook covering cryptographic inventory, CBOMs, PKI modernization and validation.
Read the articleReference
Cryptographic glossary
Look up cryptographic and post-quantum terminology in one dedicated reference, with links to deeper explanations.
Open the glossary →Cryptographic Posture Management: the evidence standard for the quantum transition
Why the migration gap, not a Q-day estimate, sets the timeline; a readiness ladder for negotiated cryptography, from configured to observed; and the dated regulatory schedule with five questions for the board.
Post-Quantum Migration: A Practical Five-Stage Framework
From discovery to verified migration.
A practical five-stage framework for moving from cryptographic discovery and risk prioritization to verified PQC migration and continuous crypto-agility.
Read the frameworkPractical analysis for the decisions security teams face now
Field guidance on discovery, crypto-agility and the operational realities of post-quantum migration.
More analysis from Qinsight
Browse all articles →47-day TLS certificates: the operational impact
The operational impact of shorter certificate lifecycles.
The compounding costs of delaying PQC migration
Early planning reduces uncertainty and preserves options.
CBOM and cryptographic inventory: two essential layers
Two views of cryptography. Both required.
Standards and reference documents
Consult the original publications to check scope, requirements and the status of standards or transition guidance.
Standards NIST · NSA
FinalFIPS 203ML-KEMModule-lattice key encapsulation. Parameter sets 512, 768 and 1024; the mechanism behind hybrid TLS groups such as X25519MLKEM768.↗FinalFIPS 204ML-DSAModule-lattice digital signatures. ML-DSA-65 is the common commercial choice; CNSA 2.0 specifies ML-DSA-87.↗FinalFIPS 205SLH-DSAStateless hash-based signatures. Conservative security assumptions, larger signatures; the alternative when lattice risk is unacceptable.↗DraftNIST IR 8547transition scheduleProposes deprecating 112-bit classical security after 2030 and disallowing classical public-key after 2035. Still an initial public draft; cite it as such.↗NSA policyCNSA 2.0 FAQnational security systemsThe algorithm suite, parameter sets and dates for NSS: 2027 acquisitions, 2031 mandated use, 2035 complete. Includes LMS/XMSS for firmware signing.↗United States policy Federal civilian
MandateExecutive Order 14412June 22, 2026Key establishment by end of 2030 and signatures by end of 2031 for HVAs and high-impact systems; directs a FAR rule for covered contractors.↗MandateOMB M-26-15execution memoAgency plans within 120 days, prioritized systems 2028 to 2031, TLS 1.3 support by January 2030, remaining systems by 2035. Excludes NSS.↗ProgramNIST PQC projectstandards statusThe authoritative index of finalized standards, drafts in progress (FIPS 206) and the additional signature round.↗FinalNIST SP 800-208LMS · XMSSStateful hash-based signatures used for firmware and software signing under CNSA 2.0.↗International roadmaps Guidance · targets
GuidanceUK NCSCmigration timelinesThree phases: discovery and plan by 2028, priority migrations by 2031, complete by 2035. The clearest published discovery-first sequence.↗RoadmapEU NIS Cooperation Groupcoordinated roadmapMember states start transition by end of 2026; critical infrastructure and high-risk use cases by 2030.↗GuidanceCanada ITSM.40.001Cyber CentreInitial plans and procurement clauses by April 2026, high-priority systems by 2031, remaining by 2035.↗GuidanceAustralia ASDplanning for PQCTraditional asymmetric cryptography not approved beyond 2030; hybrid permitted for interoperability, not recommended as an end state.↗RoadmapG7 Cyber Expert Groupfinancial sectorPublished January 12, 2026, co-chaired by US Treasury and the Bank of England. Illustrative 2030 to 2032 window for the most critical systems.↗Formats and certificates Specifications
SpecCycloneDX CBOMv1.6The cryptographic bill of materials: four asset types, the dependency graph and the nistQuantumSecurityLevel field that makes a CBOM actionable.↗SpecCA/Browser Forum SC-08147-day certificatesThe ballot that reduces public TLS certificate lifetime in steps: 200 days in 2026, 100 in 2027, 47 in March 2029.↗ReferenceWhat is a CBOMQinsight definitionOur own definition with a worked CycloneDX example and the library-is-not-an-asset clarification.↗