42 countries scored · 45 jurisdictions tracked
The world is migrating away from today's cryptography. Here's how ready each country actually is.
A fixed five-axis rubric, applied the same way to every country, scored from the regulator's own document rather than a press release. The plain-language reference for post-quantum cryptography (PQC) migration and cryptographic bill of materials (CBOM) requirements, country by country.
Global PQC readiness
Most binding rules so far: Israel (80/100)
Strictness, not safety: a high score means a binding, dated, enforced rule, not a better-defended country.
Latest reading
View all →The 21 Data Fields CERT-In Requires in an SBOM, and the Separate Lists for CBOM, AIBOM and HBOM
CERT-In's Technical Guidelines v2.0 sets a different minimum-elements table for each bill of materials it defines. Here are all four, field by field, from the primary document, with the distinction most summaries get wrong.
7 min read
Who Actually Requires a Cryptographic Inventory in India: SEBI, IRDAI, RBI, CERT-In and TEC Compared
Four Indian authorities have published something on cryptographic inventory and one has not. Only two of them bind anyone, neither of those two specifies a format, and the one with the detailed format specification is not binding. Here is the map, with the circular numbers.
6 min read
The US Federal CBOM Mandate: What OMB M-26-15 Requires, and Who It Leaves Out
M-26-15 names a Cryptographic Bill of Materials as the foundation of every federal civilian agency's migration plan, with those plans due 22 October 2026. US banks have no equivalent requirement from any of their five regulators.
5 min read
Frequently asked questions
- What does a country's PQC readiness score mean?
- The score (0-100) measures how binding, dated, and enforced a country's post-quantum cryptography policy is. It does not measure how safe, advanced, or well-prepared the country is against quantum threats. A country can score 0 simply because it has published no rule yet, which says nothing about its actual security posture. A high score often means heavier compliance obligations for organizations operating there, not a technical achievement.
- Is a higher score better or worse?
- Neither. It depends on your perspective. For a compliance team, a high score means a real, dated deadline you need to plan around. For someone asking 'which country is most quantum-safe,' the score doesn't answer that question at all, since it only measures regulatory bindingness, not technical readiness or actual risk.
- How many countries have a real post-quantum cryptography policy?
- As of our latest research pass, every UN member state plus a small number of other jurisdictions (Taiwan, Hong Kong, the EU) has been checked. Around 30 have a verified, source-cited policy specific enough to score; 162 were checked against their central bank, financial regulator, and national cyber authority and confirmed to have no published PQC or CBOM policy yet, which is a real finding, not a gap in our research. The full list, with the specific authorities checked for each, is at pqc-security.org/data.
- Why do some countries show as 'checked, no policy found' instead of a score?
- We only score a country when we find a real, verifiable primary source: a government regulation, regulator circular, or official standards-body document. If our research genuinely checked a country's relevant authorities and found nothing on-topic, we say so explicitly rather than leaving the country blank, which would be indistinguishable from simply not having researched it.