A working reference, maintained by people doing the migrations

This site is maintained by a small group of security researchers and engineers who spend their working hours on cryptographic migration projects, largely with banks, payment processors, and fintechs, and largely in environments where the cryptography in question is holding up regulated production systems.

It exists because of a gap we kept hitting. The primary material on post-quantum migration is excellent but scattered: a NIST FIPS document here, an ENISA integration study there, an NCSC timeline, a sector regulator's risk-assessment circular that never uses the words “post-quantum” but plainly covers it. Answering a question as basic as what does my regulator actually require, and by when meant assembling the answer from six sources every time. So we started writing the answers down.

What this is

A country-by-country record of what each jurisdiction requires, recommends, or has said nothing about, with the primary source cited on every page, and a plain statement of whether the requirement is binding law, sector regulation, or non-binding guidance. That distinction matters more than anything else on this site, and it is the one most often blurred elsewhere.

Countries with a specific enough primary source are also scored 0 to 100 across five axes (mandate strength, deadline concreteness, scope of coverage, inventory/CBOM requirement, and regulatory activity) and plotted on the interactive map and rankings. The score is a measure of how binding and enforced a rule is, not a measure of how secure or well-prepared a country actually is; the highest score on the tracker often belongs to the country with the strictest compliance obligations, not the one doing the best engineering. The full scoring logic, including how we choose which regulator counts as the primary source when a country has more than one, is documented on the methodology page.

Many countries have more than one relevant regulator. Where that is true, country pages include a related regulators section listing each sector body we checked independently, including the ones we checked and found had published nothing. We report those explicitly rather than leaving them out, since an unlisted regulator would be indistinguishable from one we never checked at all.

Country pages also show the jurisdiction's flag and, where we could source a clean official image, the regulator or authority's own logo. These are shown to identify who issued a rule at a glance, not to imply any endorsement, partnership, or affiliation between that authority and this site. Flags are public domain; logos remain the property of their respective authorities.

Alongside the tracker there is a glossary for the vocabulary, and longer pieces on the questions that come up repeatedly in migration planning.

What this is not

It is not legal advice, and it is not a compliance attestation. Where a regulator's position is ambiguous we say so rather than resolving the ambiguity for you. Before you make a filing or a board commitment on the basis of something you read here, verify it against the primary source we link, and, for anything consequential, against your own counsel and your regulator.

It is also not a vendor comparison. No product is recommended anywhere on this site, and no page is sponsored.

Who funds it

This site is funded and operated by O3 Security, who sell cryptographic inventory and post-quantum migration tooling. That does not change what is written here: the country pages report what each regulator has actually published, with the primary source cited, including the jurisdictions where the answer is that nothing has been published yet.

We say it plainly so you can weigh it. If you want commercial help with your own migration it is offered here, deliberately on one page rather than threaded through the research.

Why it is written the way it is

The audience we write for is the person who has to produce the migration plan: a security architect, a head of infrastructure, a risk lead. That person does not need the threat model explained from first principles for the fifth time. They need to know what applies to them, what the deadline is, whether it is enforceable, and what the first concrete step looks like. We try to lead with that and put the background underneath it.

We also try to be honest about uncertainty. Quantum timelines are genuinely unknown, several national positions are still forming, and more than one regulator has published guidance that contradicts its own earlier guidance. Pages here reflect that rather than papering over it.

Corrections

Regulatory positions change, and we will get things wrong. Every page carries a last-reviewed date and its sources. If something is outdated, incomplete, or simply incorrect, particularly if you work inside one of the regimes described, please tell us. Corrections are made quickly and the revised date is updated on the page.

Our sourcing and classification rules are documented in full under methodology.