Reading
Articles
Deep-dives on post-quantum migration strategy, cryptographic risk, and how to read the country tracker.
The 21 Data Fields CERT-In Requires in an SBOM, and the Separate Lists for CBOM, AIBOM and HBOM
CERT-In's Technical Guidelines v2.0 sets a different minimum-elements table for each bill of materials it defines. Here are all four, field by field, from the primary document, with the distinction most summaries get wrong.
7 min readWho Actually Requires a Cryptographic Inventory in India: SEBI, IRDAI, RBI, CERT-In and TEC Compared
Four Indian authorities have published something on cryptographic inventory and one has not. Only two of them bind anyone, neither of those two specifies a format, and the one with the detailed format specification is not binding. Here is the map, with the circular numbers.
6 min readThe US Federal CBOM Mandate: What OMB M-26-15 Requires, and Who It Leaves Out
M-26-15 names a Cryptographic Bill of Materials as the foundation of every federal civilian agency's migration plan, with those plans due 22 October 2026. US banks have no equivalent requirement from any of their five regulators.
5 min readAFM's Trendzicht 2026: The Dutch Conduct Regulator Names Quantum Risk to Encryption
In its November 2025 annual Trend Outlook, the Dutch Authority for the Financial Markets (AFM) explicitly flagged that quantum computers could eventually break the non-quantum-proof encryption algorithms financial institutions use to protect data confidentiality. Here's what Trendzicht actually is, where the quantum passage sits, and what it does and doesn't commit AFM to.
7 min readAMF's 2026 Priorities: France's Securities Regulator Will Start Inspecting for Quantum Risk
In its supervisory priorities for 2026, published 14 January 2026, France's Autorité des marchés financiers stated that its cybersecurity inspections of regulated market participants will begin to include anticipation of the impact of quantum computing. Here's where that commitment sits in the document, what else AMF is prioritizing, and what it does and doesn't yet require.
7 min readDNB's Good Practice Information Security 2023: The Dutch Central Bank's Quantum-Risk Supervisory Expectations
De Nederlandsche Bank's Good Practice Information Security 2023 tells Dutch banks, insurers and pension funds to inventory their cryptographic landscape, run an annual Cryptography Risk Assessment, and account for quantum computing in a short/medium/long-term risk analysis. It's guidance, not law, but it's detailed and dated.
8 min readFDIC's 2025 Report on Cybersecurity and Resilience: What It Actually Says About Quantum Computing
FDIC's statutory 2025 report to Congress names quantum computing as a strategic cybersecurity threat, discloses 'harvest now, decrypt later' by name, and reveals that 2024 examinations of significant service providers specifically evaluated quantum-computing risk. It is real, dated supervisory activity, not a binding PQC rule.
8 min readTaiwan's FSC Publishes a Financial-Sector PQC Migration Guide, With a Real Regulator's Name on It
On 18 June 2026, Taiwan's Financial Supervisory Commission published a seven-part Post-Quantum Cryptography Migration Reference Guide for banks, securities firms, and insurers, complete with a 2026-to-2035 timeline. It's a reference guide, not a binding rule, but it comes from the regulator that actually supervises Taiwan's financial industry, a distinction that matters.
10 min readNBB's Swift Oversight: Why One Belgian Regulator's PQC Checklist Matters Everywhere
The National Bank of Belgium's Financial Market Infrastructures and Payment Services Report 2025 names post-quantum cryptography as a standing oversight topic for Swift, the messaging network behind nearly every cross-border bank transfer. Here's what the report actually says, how Swift oversight is structured, and why a single line item in a Belgian central bank's report has global reach.
8 min readSweden's Central Bank Flags Quantum Risk: What the Riksbank's Financial Stability Report Actually Says
On 29 May 2026, Sveriges Riksbank published Financial Stability Report 2026:1, the first FSR in which Sweden's central bank names quantum computing as a threat to encryption and calls for a coordinated migration to quantum-safe algorithms. Here's the exact passage, where it sits in the report, and what timeline it's actually pointing to.
9 min readSIX Group's Post-Quantum Security Post: What Switzerland's Payments Backbone Is Actually Doing
SIX Group, the operator of the Swiss stock exchange and the SIC payment system, published a blog post in April 2026 describing how it is reviewing cryptography across its interfaces, protocols, and hardware security modules. It names ML-KEM, ML-DSA, and SLH-DSA, cites a 2030/2035 deprecation timeline, and discusses crypto-agility, three months before FINMA's own guidance to the sector.
7 min readCERT-In's CBOM and QBOM Guidelines: What India's Technical Guidelines v2.0 Actually Requires
CERT-In's Technical Guidelines v2.0 is the most detailed CBOM specification published by any national authority on this tracker. Here's what it actually says, who it applies to, and where its 'shall' language sits inside a document framed as a guideline, not a statute.
5 min readNPCI and Quantum Risk: Why the Operator of UPI Hasn't Published Anything Yet
NPCI runs the payment rails behind UPI, RuPay, and IMPS, arguably the most consequential quantum-risk surface in Indian finance, but has published no independent PQC or CBOM guidance of its own. Here's what that absence means, and doesn't mean.
3 min readRBI's Q-SAFE Committee: What India's Central Bank Is Actually Asking About Quantum Risk
The Reserve Bank of India convened an 8-member expert committee in May 2026 to evaluate the financial sector's cryptographic inventory through a CBOM and recommend a quantum-safe roadmap. Here's who's on it, what it's been asked to do, and what RBI's regulatory style suggests about the report it will eventually produce.
4 min readSEBI's CSCRF: The One Clause That Already Requires a Cryptographic Inventory in India
SEBI's Cybersecurity and Cyber Resilience Framework has quietly carried a live, in-force post-quantum cryptographic-inventory requirement since August 2024, tucked inside a broad general cybersecurity circular. Here's exactly what it says and who it applies to.
5 min readWhy Post-Quantum Migration Isn't Optional, Even Without a Working Quantum Computer Yet
No quantum computer today can break production cryptography. Here's why that's the wrong question to be asking, and what the 'harvest now, decrypt later' threat model actually means for migration timelines.
3 min read